What happened
On Sept 29, Cloudflare published its AI-era application security framework (discover → govern → protect → investigate) and announced Adaptive Security, an upcoming self-service capability that uses LLM-powered agents to periodically pentest selected URLs behind Cloudflare, plus expanding threat intelligence to all customers.
Why it matters
It is a major-network provider codifying continuous, AI-agent-driven security validation as a productized appsec capability, aimed squarely at the machine-speed agentic attacker problem demonstrated by the July OpenAI/Hugging Face incidents Cloudflare's research details.
Applicability
Cloudflare customers should watch Adaptive Security for scheduled LLM-agent WAF/URL pentesting once GA; appsec teams should adopt the connected four-stage operating model as a reference architecture.