Dane Knecht says vulnerability reports at Cloudflare have risen sharply, with Log4j or Shellshock style incidents now arriving weekly instead of yearly.
Knecht says the largest recent vulnerabilities have mostly come from teenagers using AI agents for bug bounties, not from nation states.
Knecht expects security to consume most of engineering team time within eighteen months, as AI finds most bugs and shrinks the transition.
AI floods security teams while agents split the web in two
AI is flooding the internet with vulnerabilities while also offering the fastest way to find and fix them. Knecht expects a short, intense stretch where security eats most engineering time, with discovery and automated patching as the way through. At the same time, agents are forcing a second web with its own payment rails, and Cloudflare is reorganizing itself and its products around both shifts.
Takeaways
AI is both the security threat and the fix. Vulnerability reports have risen sharply over three to six months, and Log4j or Shellshock scale incidents now arrive weekly instead of yearly. Knecht says the big recent exploits came from high school kids pointing agents at bug bounties, not nation states.
Security will consume most team time within eighteen months. Knecht calls it a short transition as AI finds most bugs. Greg Brockman predicted token spend on security would match engineering by 2027. A Cloudflare Connect keynote showed over 50% of engineering time going to security.
Patching old software means discovery, not freezing shipping. Cloudflare is patching seventy years of software, and reducing attack surface comes first. Early AI is verbose and adds complexity, so it has not yet made software more secure. Cloudflare plans four or five red teams by the end of next year.
Agents will push the web into two parallel webs. An agent can visit a thousand pages in the time a human visits one, and APIs cover only a small fraction of information. Knecht expects separate machine and human webs, with sites charging agents per read.
Agent payments need new rails that are not ready. Stripe's X402 revives the HTTP 402 payment code. Cloudflare released a monetization gateway with wallets and a stablecoin for agents. Businesses still tend to block agents to keep leverage, and Amazon has refused personal shopping agents.
Cloudflare rebuilt itself as an AI-first company. Cloudflare OS, its internal AI platform, is used more by go-to-market and G and A teams than by engineers. It also serves as reference architecture for the developer platform. One new tool replaced a process spanning three teams.
Cloudflare is betting on a thousand AI-native interns. The company of about 5,000 people had around 200 interns two years ago and will hire a thousand this year. Knecht says interns are fully AI-native and that curiosity is the key hiring trait.
Open security and token budgets
Knecht argues security models will eventually be open, because withholding them excludes the defenders who need them.
Cloudflare gives protection against major vulnerabilities, such as the React one last year, to every customer including free ones.
Tap a name to go there · tap a line to see why they are linked
On this episode 2
Show 1
Token spending has no leaderboard. An employee gets an email at $300 a day, their manager at $500, and a VP at $1,000.