Cloudflare says four developers rebuilt a product in three days for $1,100 of Codex tokens, while its OpenAI-powered vulnerability service is still invite-only
OpenAI's 21 October customer story pairs Codex productivity claims with Cloudflare's Daybreak-based security service. Verdict: useful design detail, vendor-reported numbers; pilot before you believe the 10x.
Cloudflare uses OpenAI Daybreak with live traffic and security signals to investigate vulnerabilities and propose fixes for customer review.
Comprehensive take
The security design (code-evidenced findings, checks outside the model, customer review) is worth copying; the 3-day, $1,100 rebuild is a single vendor-published anecdote with tokens-only costing.
Use cases
Security teams with large scanner backlogs
Ask for a pilot of Cloudflare's service on one application and measure how many prioritized findings survive your own review.
Engineering leads weighing coding agents
Time a postponed internal rebuild with Codex and record developer review hours alongside token spend.
Teams building their own vulnerability harness
Borrow the pattern: require code evidence for each finding and run proposal checks outside the model.
Specs
| Service | Vulnerability Discovery and Remediation, part of Cloudflare Managed Defense source |
|---|---|
| Availability | Early access, by invitation; starts with one customer-authorized application source |
| Model used | OpenAI GPT-5.6 Cyber via Daybreak, routed through Cloudflare AI Gateway source |
| Rebuild claim | 4 developers, 3 days, $1,100 in tokens (Cloudflare executive, tokens only) source |
Insights
- Axion reading: the story is a sales asset for both companies; the more verifiable material is Cloudflare's own engineering post.
- Axion note: no false-positive rate, finding counts or patch-acceptance data have been published for the service.
- Axion note: the rebuilt product is not named, so the 3-day claim cannot be checked.
What Cloudflare and OpenAI are claiming
OpenAI published a customer story on 21 October about Cloudflare's use of two products: Daybreak, its security-focused model access, and Codex, its coding agent. The headline numbers come from a Cloudflare executive, Mark Anderson, its President of Revenue. He says Cloudflare postponed a product rebuild because it lacked manpower, that the work would have taken months and "maybe 10x more developers," and that a team of four built it in three days and spent $1,100 on tokens. He also says 100% of the third of the company that are software developers use Codex.
Read those numbers carefully. The $1,100 covers tokens only, not four developers' time or the review and rollout around the build. The "10x" is Anderson's own estimate of a counterfactual, the page does not name the product that was rebuilt, and the speaker is a revenue executive rather than an engineering lead. It is a vendor-published case study, which makes it a data point, not a benchmark.
The more useful part: how the security service works
The substance is in Cloudflare's own engineering post, published in early September, describing Vulnerability Discovery and Remediation. It is part of Cloudflare Managed Defense and in early access by invitation, starting from one customer-authorized application. Cloudflare says model prompts go from Workers through AI Gateway to OpenAI's GPT-5.6 Cyber for reconnaissance, hunting and validation.
Three design choices stand out. Every finding must be corroborated by evidence in the source code; traffic data can raise priority but, in Cloudflare's words, does not establish that a vulnerability exists. Proposed patches and WAF rules must pass checks implemented outside the model, and are tested against synthetic fixtures rather than customer traffic. And the customer reviews every result before deciding whether to test or deploy.
One nuance: the post also says that if a customer has authorized the service to defend a zone, Cloudflare will deploy the scoped WAF rules. So "nothing changes without you" applies to code patches, while edge rules can go live under that authorization.
Should you act on it?
If you run Cloudflare Managed Defense and have a noisy scanner backlog, ask your account team about early access and request the false-positive rate on a pilot application. If you are evaluating Codex for rebuild-style projects, run your own timed pilot and count review hours, not just tokens. No independent results for either claim have been published.