- Author
- Dan Jones, Alexandra Godoi and Grant Bourzikas, Cloudflare
- Published
- June 18, 2026
- Kind
- Company engineering blog post, with an architecture and internal metrics
- Original
- blog.cloudflare.com/build-your-own-vulnerability-harness/
- Subject
- Harnesses and agent loops
- Themes
- Checking the work, How things break
What it is
Three Cloudflare authors follow up an earlier post on pointing frontier models at its code. They explain how a 450-line audit skill became a fleet scanner covering 128 repos. The stated aim is to help readers build their own model-agnostic harness.
What it says
- Cloudflare uses one model for discovery and another for validation. The two check each other.
- The harness grew from a 450-line skill. One run finds about half the bugs that repeated runs find.
- Every stage writes to one SQLite database. A crash costs only the task in flight.
- Every confirmed finding must ship a proof-of-concept test and a patch. The test runs on untouched code.
- Hunter agents never called Semgrep in a month. The wishlist tool was the most used.
- The discovery harness produced 20,799 raw candidates, and about 12,057 survived validation. The shared pool reached 13,841 findings, with 7,245 actionable.
- Cloudflare claims no false-negative rate, because no labeled set of all real bugs exists.
What evidence it gives
The post gives internal counts of candidates, duplicates and surviving findings. It gives rejection-rate changes over time and some cost and timing figures. It releases the original skill on GitHub but not the harness.
Interests and limits
Cloudflare sells security products and wrote the post about its own system. The figures are self-reported and the post says they are out of date. The funnel chart image was not viewed, only the page text. The post says the findings come from a test environment. It claims no recall figure.