No Priors · Oct 24, 2026 · 41m · 34m saved
With Dane Knecht, CTO, Cloudflare
Vulnerability disclosures on the scale of Log4j or Shellshock used to arrive about once a year. Dane Knecht, chief technology officer of Cloudflare, says they now arrive weekly.
Most of the alarm over AI and cybersecurity still points at nation-states. Dane said many of the worst recent breaches trace back to individuals, sometimes teenagers, pointing AI agents at targets the way people once ran capture-the-flag contests.
"AI has become the tool that's causing this kind of security apocalypse to happen, but it is also the tool that can help us solve it faster as well."
Dane runs the engineering and security decisions behind Cloudflare's network, including the internal rulebook, which he calls "the codex," that trains Cloudflare's own AI agents how to write and review code.
The full interview is covered here so you can skip it. 41 minutes of audio, 7 minutes of reading.
Here are the 7 takeaways that matter.
Key Takeaways
Vulnerability disclosures on the scale of Log4j or Shellshock once arrived about once a year; Dane said they now surface weekly, partly because AI tools can find and exploit flaws like a WebPKI key secured by the number four
OpenAI recently found the seeds behind the elliptic-curve constants NIST released in 2000, Dane said
Many of the largest recent attacks have come not from nation-states but from individuals, including high schoolers, pointing AI agents at targets the way people once ran capture-the-flag contests
Dane expects the majority of engineering teams' time to go to security through the rest of this year and into 2027, a shift he called temporary rather than permanent
Cloudflare is still working through 70 years of unpatched legacy software, and Dane's fix starts with cutting attack surface and distilling internal rules into "ten commandments" its AI agents are trained to follow
The internet is in a "messy middle" where agents inefficiently parse a web built for humans, which Dane said needs new payment rails such as Cloudflare's content monetization gateway and stablecoin-backed agent wallets
A May restructuring, Cloudflare's first layoffs, cut an email-marketing process from three teams to one tool, a change Dane compared to rethinking a factory floor
Cloudflare auto-emails employees once their daily AI spend crosses $300, and hired 1,000 interns this year partly because last year's smaller class turned out fully AI-native
1. Weekly, not yearly
Speaking at Cloudflare Connect, Dane said the pace of change over the past year "feels like 10 years compacted into one," and vulnerability disclosures have accelerated sharply over the last three to six months.
Incidents on the scale of Log4j or Shellshock now happen weekly, not yearly
"Previously on the internet, we would see these Log4j moments or these Shellshock type of incidents maybe once a year... these things are now happening weekly." — Dane Knecht
He pointed to a cryptographic flaw making the rounds that day as the kind of thing AI tools can now find at scale.
"One of the keys on the internet that protects all TLS and WebPKI, which secures all your connections, was secured by the number four." — Dane Knecht
Dane added that OpenAI had recently found the seeds behind the elliptic-curve constants NIST released back in 2000, evidence that AI can now reverse-engineer cryptography that stood unchallenged for decades.
