Democratizing Security for the Agentic Web with CloudFlare CTO Dane Knecht

Summary

• Knecht expects security to absorb most engineering attention over the next 18 months. Vulnerabilities comparable to Log4j, once seen roughly annually, are now appearing weekly. He cites a talk’s statistic suggesting more than 50% of engineers’ time could go to security, but frames this as temporary catch-up before software productivity improves.
• AI-generated software still needs simpler architecture and human judgment. Early models “like to create complexity,” making smaller codebases, explicit engineering principles, and independent reviews essential. Knecht says Cloudflare will probably expand from one red team to four or five by the end of next year while continuing to ship products.
• Knecht argues that defensive capabilities should reach people who need them. His position is that “eventually everything should become open source,” because attackers and leading companies will get access anyway. Cloudflare extends protection against major vulnerabilities to free users as part of its public-utility role.
• Agent traffic creates a potential payments market beyond advertising. Knecht imagines an agent deciding whether to surface a publisher’s content, with the user choosing whether to pay at an advertising-CPM rate. This would require millions of micropayments per second. Cloudflare has released a monetization gateway and provides agent wallets and a stablecoin; “instead of them paying us, we pay them” is his creator-economics test, although technological and commercial readiness remain uncertain.
• Cloudflare OS is used more by go-to-market and administrative teams than by engineering. Marketing has built hundreds of internal tools. One customer-email workflow replaced handoffs across three teams with a product manager using one tool and obtaining managerial approval: “We didn’t move to having three teams do it faster.”
• Cloudflare measures AI by shipped outcomes and manages token costs through visibility. It avoids a “leaderboard for the number of tokens,” instead escalating spending notifications from employees to managers and vice presidents. Knecht thinks requiring people to select the right model for every task is “pretty pointless”; intelligent routing should eventually handle that.
• AI-native interns are part of Cloudflare’s approach to organizational change. After roughly 200 interns helped their managers adopt AI faster, the approximately 5,000-person company decided to hire 1,000 interns throughout the year. Knecht favors bottom-up experimentation and curiosity, while Guo points to fear and skepticism as reasons people may hesitate to use AI.

Deep dive

1. Security becomes the priority for the next 18 months

• Knecht says vulnerabilities reported to CDE rose exponentially over the past 3–6 months. Incidents like Log4j or Shellshock, once seen perhaps annually, now occur weekly, though some are not publicly reported. Some major vulnerabilities, he says, are found by high school students—the conversation’s “agent kitties”—using agents and pursuing bug bounties. His example is a key protecting TLS and WebPKI that was seeded with “the number four,” making it easy to find through reverse engineering. He also thinks OpenAI found seeds for NIS curves released in 2000; MTOS was “just the tip of the iceberg” as models, tools, and users improve.

• The immediate cost is engineering capacity: Knecht expects most team time to go toward security over the next 18 months. He says a statistic presented at one of the talks suggested more than 50% of engineers’ time would be spent on security. Guo relays Greg Brockman’s forecast that security-token spending will match engineering spending by 2027. Knecht sees temporary catch-up on “70 years of software,” followed by substantially greater new-software productivity.

• Guo raises a darker scenario: disconnect important systems and assume critical infrastructure and government services eventually fail. Knecht is “a little less pessimistic”: competitors cooperate during emergencies, people adapt, and 5–10 years of movement from castle-style infrastructure toward zero trust have put companies in a better position to protect devices and data streams.

• On security models, Knecht argues “eventually everything should become open source”: bad actors will still find a way to get access, and leading companies will have access too, while restrictions exclude people who need these capabilities. Cloudflare extends protection against major vulnerabilities, including last year’s React issue, to free users. He contrasts roughly 3,000 sites with large-scale CDNs before Cloudflare with hundreds of millions now.

2. Smaller systems and competing reviews keep development moving

• Guo’s concern is that software production accelerates alongside vulnerability discovery. Knecht starts with “reduce the attack surface”: simplify systems and shrink code, then apply formal verification, safer languages, and runtime protections. Early AI “likes to create complexity”; Guo recognizes having to ask models to try again “ten times easier.” Human design judgment remains necessary.

• Cloudflare records engineering principles in an internal “Codex,” distilling RFCs and best practices into “10 commandments” agents follow during reviews. Product engineers still need training, and security teams must provide a second look. Code-writing agents are balanced by people conducting performance and security reviews.

• Knecht says Cloudflare will “probably” expand from one red team to four or five by the end of next year. Guo challenges prioritizing detection over fixing update processes; Knecht says crises spur improvements, and overwhelming workloads push engineers to automate tasks and eventually fix vulnerabilities at scale. Security cannot halt releases: “if you don’t release updates, you die.” Cost optimization may take the tradeoff; he believes AI can accelerate both shipping and fixing.

3. Agents force a new payment model for the web

• Knecht describes humans and agents “using the same rails” during a messy transition. An agent can visit a thousand pages in the time a person browses, without participating in the same advertising economy. Translating human pages for machines burns tokens; existing APIs cover only part of the internet’s information.

• His Substack-style example starts with a publisher’s known advertising CPM: an agent could decide whether to surface the content to its user, who could then choose whether to pay at that rate. This requires payment systems handling millions of tiny transactions per second. Micropayments have long been “always two years away”; he thinks agents will propel a new economic model for creators.

• Cloudflare has released a monetization gateway and provides wallets for agents and a stablecoin to facilitate transactions. With OpenAI, its Signals project helps agents discover new content without repeatedly crawling the web. Knecht’s success criterion is “instead of them paying us, we pay them”: covering infrastructure costs, sustaining creators, and enabling more people to publish.

• Guo points to personal agents making transactions urgent. Knecht names Instinct and Muse as examples, and says companies are trying to preserve leverage in negotiations; he cites Amazon’s decision to disallow personal purchases from agents. He expects personal agents eventually to perform tasks as easily as humans, but qualifies the timing: he does not know whether the technology or business models are ready.

4. Cloudflare OS turns secure AI access into redesigned workflows

• Cloudflare OS began as an internal platform for deploying AI tools while controlling data sharing and encoding company principles. Knecht calls it a reference architecture showing how to build internally on Cloudflare and branch out to a company-specific system. The developer platform has grown over 10 years from a simple serverless primitive to more than 100 tools. Security is built in so employees can concentrate on their tasks.

• Go-to-market and administrative teams use it more than engineering. Knecht identifies training as the early bottleneck: a chat interface is “too much of a blank slate,” while a business-specific environment supplies data and guidance. Marketing has built hundreds of internal tools, doing work that previously would have required different agencies and moving faster with a smaller team.

• One redesign followed May’s difficult restructuring and departures. A product-manager email previously touched BI for the recipient cohort, marketing for presentation, and marketing operations for delivery. Now one tool accepts a cohort description, rewrites the email in Cloudflare’s style, and routes it to a manager for approval before sending. “We didn’t move to having three teams do it faster”: the workflow itself changed.

5. Adoption spreads through feedback and AI-native employees

• Model routing remains manual: Knecht suggests using the most advanced models for planning and review, with open models potentially doing some work once a plan is agreed upon. Cloudflare judges outcomes rather than token consumption. At $300 a day, he says, an employee gets an email; at $500, it goes to a manager; at $1,000, it reaches a vice president within a day. People often had not realized what they were spending.

• After roughly 200 AI-native interns helped their managers adopt AI faster, Cloudflare decided to hire 1,000 throughout the year at a company of about 5,000. Guo asks whether dependence on AI is good; Knecht compares losing AI to losing Google. Established employees, himself included, still overlook opportunities to stop doing tasks manually.

• The operating method is bottom-up experimentation. A January inbox inviting employees’ AI-use requests initially looked automated, but interns were producing the requested files. It exposed real workflow friction without hiring consultants to catalog every task.

• Knecht sees not using AI personally as a hiring red flag for curiosity. Guo points to fear and skepticism as reasons for reluctance. He argues Cloudflare’s unusual scale requires people who invent new ways to work—and that starts with curiosity.