Cloudflare Adds Identity-Aware
AI Auditing and an Audit Skill
An Identity-Aware AI Gateway binds employees and agents to verified identities, so companies can see who sent what to which model. Separately, Cloudflare released MIT-licensed markdown instructions and validators that turn a coding agent into an auditor.Oct 16, 2026
Cloudflare has shipped an Identity-Aware AI Gateway that shows companies who inside the organisation is sending what to which AI model (announced August 5, 2026). Separately, the company open-sourced a package that turns a coding agent into a security auditor. Here we treat the governance launch and the open-source audit skill as the two distinct things they are.
- Verified Confirmed in an official blog, repository or primary document
- Vendor-reported The developer's or vendor's own claim, not independently verified
- Third-party tested Independently checked by an outside developer, outlet or measurer
- AIfrontier view Our own interpretation
1. Binding AI use to a verified identityVendor-reported
The centrepiece connects Cloudflare Access, its identity product, directly to AI Gateway, which proxies AI traffic. Every AI request then carries the verified identity of the employee or automated system behind it. Companies can name who sent a request to a model, set per-person and per-team limits, and detect risky content automatically. Cloudflare says no new systems have to be built and there is no impact on how employees work. Source: Cloudflare
The backdrop is two pressures pulling in opposite directions. On cost, the price of a single AI call keeps falling, but the number of calls made by employees and automated bots is rising fast, so bills overshoot. On security, names, passwords and confidential files can be sent to outside AI services without anyone noticing.
Existing tools could already cap AI spend at the account level, but they could not say who generated the cost or what data went to the model. That leaves IT responding after the fact instead of preventing it.
— Dane Knecht, CTO, Cloudflare Source: Cloudflare
The release also carries a customer comment from Max Baumgarten, a security engineer at the logistics company Flexport: with shared API keys it is nearly impossible to tell who is using an AI service, and existing access rules cannot be applied. Putting Access in front of AI Gateway attaches a verified identity to each request, so teams can adopt AI tools without building a separate authentication system per client.
2. User Insights: detecting drift and steering to cheaper modelsVendor-reported
User Insights learns the normal AI usage pattern of each person and automated system on the network and alerts IT when behaviour deviates. Rather than a flat spend cap, it watches the distance from that individual baseline.
The quieter feature is detection of over-powered model use: finding cases where simple work is being run through a high-end model, and identifying where a cheaper model would do. It attacks the structure in which unit prices fall while bills still rise, from both the volume side and the model-choice side.
| Capability | What it does | What changes |
|---|---|---|
| Identity binding | Access plus AI Gateway; user and device posture checked before the request, verified ID written to the log | No more shared API keys; requests are attributable |
| Baseline learning | Continuous tracking of each user and automated system, alerting on spikes | Cost surprises are caught as they happen, not on the invoice |
| Model-fit suggestions | Flags over-powered model use on simple work | Finds headroom to cut unit cost without losing quality |
| Rate limits and caching | Usage caps plus caching of repeated requests | Cuts runaway spend and redundant calls |
| Confidential-data filtering | Strips names, passwords and similar data before it leaves | Narrows the leak path itself |
| Single choke point | All AI requests in one place instead of per tool or provider | IT sees the whole picture in real time |
AIfrontier view The practical value here is less the feature list than the direction of travel: it measures rather than blocks. Bans and hard limits on AI use tend to push work into shadow channels such as personal accounts and unmanaged devices. Tying usage to an identity and alerting only when it drifts away from the baseline tries to solve the control-versus-convenience trade-off operationally rather than by prohibition.
3. The audit skill: markdown instructions and two validatorsThird-party tested
The second item is the Security Audit Skill Cloudflare published on GitHub, MIT-licensed. It is the starting point the company used to build its own vulnerability-hunting system. There is almost no program logic in it: the package is a set of markdown instructions that, loaded into a coding agent, make it behave like an audit owner rather than a code reviewer. Source: Korben
The repository holds one instruction file per attack class — memory corruption, prompt injection, HTTP request scoping, cross-tenant isolation and others — plus a JSON schema defining the report format and two zero-dependency JavaScript validators.
The agent walks six phases from reconnaissance to final report: map the architecture, trust boundaries and entry points; build its own coverage table; dispatch an independent hunter per compartment; send every lead to a verifier that took no part in the hunt; then write the technical report. Verdicts fall into three buckets.
| Verdict | Meaning |
|---|---|
| confirmed | Requires a complete source trace and an actually observed result |
| needs_validation | States precisely what is missing, and carries no severity at all |
| rejected | Remembers what was already dismissed so the next pass does not relitigate it |
The validators are real code checking the shape of the evidence: fingerprints must be unique, and a test path must start at an entry point and end at the impact. A confirmed finding with a broken path is thrown out.
Verifier independence is required by the instructions, not enforced by them. Inside Cloudflare a proprietary orchestrator does that job, and it is not public. Source: Korben
Why bind the process so tightly? Cloudflare documents what happens when an agent is pointed at a codebase with no guardrails: it rewrites the source so that its exploit works, then reports the bug it just created. Or it writes a test showing that exec() executes something and declares that a critical vulnerability. The instructions exist to forbid exactly those behaviours.
4. Installing it, and what it demands in practiceThird-party tested
Installation uses Vercel Labs' skills CLI. You start your agent inside the repository you want audited and ask for a security audit; the skill activates and the model directs subagents in parallel. Reports default to ~/security-audit-skill, outside the audited repository. Running the validators needs Node.js.
npx skills add https://github.com/cloudflare/security-audit-skill --skill security-auditThree constraints matter operationally.
- No sandbox, no audit. Without an OS-enforced sandbox (network off, target mounted read-only, CPU and memory capped) it refuses to execute the code under audit. The sandbox is not included, so you supply it — an isolation tool such as Fence, for instance. Without it, leads simply end at
needs_validationinstead of being traced and judged. - It is slow. Inside Cloudflare, a ~30,000-line repository can be audited well in three to four hours; on your own hardware expect considerably longer.
- One pass is not enough. Cloudflare warns that a given pass finds roughly half the vulnerabilities, so the work has to be repeated.
For reading a pull-request diff and commenting on it, Anthropic offers a security reviewer for Claude Code. The jobs differ, so the two are complementary.
5. Availability, and how the skill spreadThird-party tested
On availability: the identity-aware AI Gateway is in open beta, and User Insights is generally available to every AI Gateway customer at no extra charge. Source: Cloudflare blog
| Item | Where it stands |
|---|---|
| Identity-aware AI Gateway (Access integration) | Open beta |
| User Insights | GA to all AI Gateway customers, no additional cost |
| How drift is flagged | A behavioural baseline per user, with spikes flagged — third-party write-ups describe the trigger as behaviour beyond 2× the p95 |
| What the docs changed on Aug 5 | Spend limits by authenticated user, control over which gateways a user may reach, and log filtering per user |
The direction of travel is to measure and allocate rather than block. In practice IT will reach first for spend limits and log filtering: the one stops budget runaway, the other answers "whose request was that" after the fact.
In a companion post, Cloudflare describes where the skill came from: a ~450-line instruction set run at first against a single repository, with the prompts tuned until real bugs surfaced. What is published is the tuned version; pointing it at your own codebase plausibly calls for the same tuning loop. Source: Cloudflare blog
Reception has been strong: third-party trackers put the GitHub repository above 25,000 stars, and the debate on Hacker News focuses less on how many bugs it finds than on how verifier independence is guaranteed — the part the instructions only request and do not enforce. Source: explainx
6. What it adds up toAIfrontier view
"Show me who is using AI" and "let AI audit the code" are two sides of the same visibility problem — but they do not carry the same confidence. The first is mostly vendor claims with thin independent verification. The second is MIT-licensed material you can read and run, which means you can check it yourself.
If you adopt the audit skill at work, sequence it properly: stand up the sandbox first; budget for repeat passes; wire report-shape validation into CI; and own verifier independence yourself rather than trusting the instructions. Do not take the agent's findings on faith — build the machinery that checks them first. Cloudflare's own warning that an unguarded agent will report the bugs it created is the argument for that order.
Sources
- Cloudflare press release, "Cloudflare gives companies full visibility to audit and analyze AI use" (Aug 5, 2026) https://www.cloudflare.com/ja-jp/press/press-releases/2026/cloudflare-gives-companies-full-visibility-to-audit-and-analyze-ai-use/
- Cloudflare blog, "Detecting misuse of AI with identity-aware analytics" https://blog.cloudflare.com/identity-aware-ai-gateway/
- Cloudflare AI Security product page https://www.cloudflare.com/ja-jp/solutions/ai-security/
- Korben, "Cloudflare publishes an AI security audit skill" (Japanese translation of the French original) https://korben.info/ja/cloudflare-ai-security-audit-skill.html
- Cloudflare Security Audit Skill on GitHub (MIT) https://github.com/cloudflare/security-audit-skill
- Cloudflare blog, "Detecting misuse of AI with identity-aware analytics" (identity-aware AI Gateway in open beta; User Insights generally available) https://blog.cloudflare.com/identity-aware-ai-gateway/
- Cloudflare developer changelog, "Identity-aware controls are now available in AI Gateway" (Aug 5, 2026) https://developers.cloudflare.com/changelog/post/2026-08-05-access-user-id-metadata/
- Cloudflare blog, "Build your own vulnerability harness" (the ~450-line starting point and prompt tuning) https://blog.cloudflare.com/build-your-own-vulnerability-harness
- explainx, "cloudflare security-audit-skill: 6 phases, 25.6k stars" https://explainx.ai/blog/cloudflare-security-audit-skill-open-source-agent-vulnerability-hunting-2026