Cloudflare Cuts Agent Hallucinations With Deterministic Recon

Key takeaways

• 6 Cyber), while final mitigation decisions remain under human analyst control.
• The backend runs across Cloudflare’s developer stack, utilizing Workers for isolation, Workflows for durable multi-stage orchestration, D1 for state, R2 for evidence artifacts, and Durable Objects with Flue for case collaboration.

Deploying agentic security operations at internet scale requires addressing the industry-wide alert paradox: as detection rules multiply across distributed infrastructures, human security analysts face an unmanageable volume of concurrent, ambiguous signals. To accelerate threat investigation without surrendering operational boundaries to stochastic models, Cloudflare Managed Defense has rolled out an evidence-grounded multi-agent harness. The architecture strictly separates deterministic data collection from generative inference, deploying four specialized investigation agents, lightweight open-source decision models, and vetted frontier large language models to construct structured incident advisories while keeping human defenders firmly in control of remediation actions.

Modern security information and event management (SIEM) systems and security operations centers (SOCs) routinely generate thousands of daily alerts. While automated rules identify anomalous behaviors, determining whether an individual alert represents a benign misconfiguration, an ongoing multi-stage intrusion, or routine scanner noise remains an exhausting human task. When an enterprise environment experiences a credential spike or application anomaly—a friction point highlighted as credential layers blind enterprise security teams—SOC analysts must gather disparate logs, correlate detections, verify historical dispositions, and assess mitigation trade-offs under severe time pressure.

Why Monolithic Agents Fail in Security Triage

The standard architectural instinct when building artificial intelligence tools is to provide a single frontier model with broad system context, tools, and an expansive prompt describing the security alert. Cloudflare’s initial engineering prototypes revealed that this single-shot approach creates systemic operational vulnerabilities. When telemetry, detection descriptions, organizational policies, and external threat intelligence were flattened into one conversational prompt, the boundaries between hypothesis, raw evidence, and authoritative proof collapsed.

Cloudflare identified three recurring failure modes that disqualified general-purpose single-agent harnesses from enterprise production environments:

• Context conflation with authority: A detection trigger is merely an unproven hypothesis indicating that a rule condition was met. Unconstrained models routinely treated alerts as verified breaches, hallucinating successful exploitation chains where none existed in the underlying telemetry.
• Autonomous scope drift: Without programmatic sandbox boundaries, language models given autonomous tool access drifted across client accounts, queried improper time horizons, or inspected unapproved datasets. System prompts proved completely incapable of serving as hard security or tenant boundaries.
• Silent query failures: When an external API lookup, telemetry database query, or threat feed timed out, the general-purpose model frequently failed to distinguish between an unexecuted query and a verified negative result, assuming the absence of recorded data implied a clean bill of health.

These architectural deficiencies demonstrated that language models cannot be trusted to independently define their own investigative scope or fetch arbitrary raw telemetry. To eliminate these vulnerabilities, Cloudflare restructured its pipeline to handle evidence collection and boundary enforcement purely within application code before any inference model is invoked.

Deterministic Reconnaissance Before Inference

Rather than placing autonomous agent reasoning at the initial point of alert ingestion, Cloudflare established a strict architectural rule: reconnaissance first, inference second. The front half of the Managed Defense harness executes zero machine learning inference. Instead, compiled application code triggers a deterministic set of versioned reconnaissance workflows.

When an alert fires, deterministic routines collect a comprehensive snapshot of the customer’s operational footprint:

• Customer identity and policy configurations
• Historical detection records and previous analyst dispositions
• Baseline application traffic profiles and network behavior norms
• Real-time edge enforcement outcomes and firewall execution statuses
• Direct telemetry observations captured across Cloudflare’s edge proxy

Because Cloudflare operates the reverse proxy network, its infrastructure observes both the inbound network request and the specific edge control outcome applied to that request (such as block, challenge, or rate-limit actions). This allows the deterministic harness to establish direct causality between observed traffic patterns and security policy enforcement before analytical reasoning begins.

Crucially, this reconnaissance snapshot is immutably packaged with strict cryptographic source tracking, schema versions, and exact millisecond timestamps. Freezing the evidence dossier ensures complete evaluation reproducibility. In unconstrained agent architectures where models query APIs interactively, two consecutive runs often diverge because external states change mid-investigation. Under Cloudflare’s model, the identical snapshot can be replayed across different models or prompt versions, isolating discrepancies strictly to model interpretation rather than retrieval drift.

Early Noise Reduction via Clef Decision Models

The vast majority of automated security alerts do not constitute active incidents. Alert fatigue frequently stems from static rules triggering repeatedly on benign, known traffic patterns. Paging human analysts or spinning up complex frontier model chains for routine alerts rapidly exhausts engineering budgets and operational focus.

To prevent queue saturation, Cloudflare deploys an early triage gate powered by Clef, its open-source family of specialized decision models running locally on Workers AI. Unlike generative chat models that produce autoregressive token streams requiring brittle parsing logic, decision models evaluate state inputs (such as JSON dossiers and historical context) against predefined queries and return calibrated probabilities.

The Clef model evaluates three foundational triage questions:

1. Has this identical event or traffic pattern been observed for this specific customer before?
2. How did human Managed Defense analysts disposition previous instances of this pattern?
3. Does the observed traffic match normal human client behavior across the customer’s baseline?

Alerts assigned a high probability of being false positives bypass downstream specialist agents entirely. High-volume, known benign noise is deterministically classified as passive telemetry, remaining accessible for forensic context while keeping the active incident response queue unburdened.

Get the Weekly Brief

Curated analysis for tech leaders. Every Thursday.

Subscribe

Parallel Specialist Investigation and Strict Synthesis

For alerts that pass the initial noise filter, an orchestration coordinator dispatches four specialist agents running concurrently in parallel. Each specialist is restricted to a narrow, typed investigative domain, preventing cross-domain hallucination and scope creep:

• Traffic Analysis Specialist: Evaluates raw request properties, temporal deviations, header anomalies, payload behaviors, and edge control enforcement results.
• Customer Context Specialist: Analyzes historical account activity, previously documented operational baselines, tenant-specific exemptions, and prior analyst determinations.
• Global Telemetry Specialist: Cross-references observed threat artifacts (such as scanning IP addresses or request fingerprints) against privacy-preserving Internet-wide signals aggregated across Cloudflare’s global network.
• Threat Intelligence Specialist: Queries indicators and signatures already formally admitted to the investigation against threat data curated by Cloudforce One.

Once the specialists complete their parallel reviews, a dedicated synthesis agent compiles their typed outputs into an operational advisory. The synthesis agent operates under draconian programmatic guardrails: it cannot query external tools, cannot retrieve new evidence, and cannot invent incident classifications outside a strict, pre-approved taxonomy. Restricting the synthesis step to structured aggregation ensures every finding maps directly back to auditable evidence.

Privacy-Preserving Telemetry and Gap Tracking

A persistent limitation of traditional on-premises SIEM deployments is isolation: an enterprise security tool understands its own environment but possesses zero visibility into broader Internet dynamics. An anomalous IP scanning an API endpoint might be an isolated targeted attack or an indiscriminate global botnet probing millions of web properties.

Cloudflare bridges this gap by leveraging telemetry from its global proxy network—incorporating aggregated features from its content delivery network, Web Application Firewall (WAF), distributed denial-of-service (DDoS) mitigation engine, Turnstile bot challenges, and Rate Limiting infrastructure. However, multi-tenant security demands rigorous data isolation. The global telemetry specialist agent operates exclusively on anonymized, privacy-preserving statistical aggregates. It never accesses another tenant’s raw logs, payloads, or corporate identities, ensuring global context informs threat scoring without compromising data sovereignty.

Equally critical is the explicit representation of missing information. Distributed network telemetry often encounters timeouts, missing metadata, or unindexed feeds. Rather than allowing generative models to assume missing data implies normalcy, the Managed Defense advisory formally enforces three distinct evidentiary states:

• Not checked: The data source or telemetry feed was unreachable, timed out, or not queried.
• Checked, with no matching result: The query executed successfully, but returned no matching indicator.
• Checked, with evidence supporting absence: Telemetry confirms the specific indicator or artifact was actively absent during the evaluated timeframe.

If global telemetry is temporarily unavailable, the system transparently documents the limitation, noting that while the activity is anomalous for the specific customer, its global prevalence cannot be determined.

Infrastructure Orchestration and Human-Governed Remediation

Building a resilient multi-agent architecture requires infrastructure capable of managing durable distributed state. Cloudflare deployed the harness entirely on its edge developer platform:

• Cloudflare Workflows orchestrates multi-stage state transitions, saving validated intermediate findings at each milestone so pipeline failures can resume without reprocessing raw telemetry.
• Cloudflare D1 manages relational investigation metadata and active advisory states.
• Cloudflare R2 provides durable object storage for immutable evidence dossiers and forensic artifacts.
• Durable Objects powers real-time case chat persistence, integrated with the open-source Flue framework and indexed through Cloudflare AI Search.
• Deeper qualitative contextual reasoning taps approved frontier models, including GPT-5.6 Cyber through the OpenAI Daybreak Defense Network and Anthropic’s Mythos model.

Validating whether autonomous security agents can operate reliably without introducing catastrophic blind spots has become an industry priority, echoing emerging simulation environments like Hack The Box’s enterprise range for testing security agents. In Cloudflare’s harness, the final output is not an automated, unvetted action, but a highly structured, auditable advisory delivered to human Managed Defense analysts.

The advisory outlines the affected attack surface, observed enforcement outcomes, relevant controls, and concrete mitigation recommendations—such as precise rate-limiting thresholds, WAF custom rules, or DDoS profile updates. While fully managed clients can authorize analysts to apply mitigations directly, the human analyst retains final accountability, reviewing the verified evidence package before executing defensive changes.

Bottom line

Cloudflare’s agentic security operations harness offers a critical architectural lesson for enterprise teams deploying artificial intelligence in high-stakes environments: generative models excel at structured synthesis and contextual interpretation, but they cannot serve as reliable data retrievers or boundary enforcers. By anchoring the front half of the workflow in deterministic code, filtering noise with calibrated decision models, and enforcing programmatic citation verification across parallel specialists, Cloudflare demonstrates how to eliminate hallucinations and scope drift while delivering actionable leverage to overburdened security analysts.