Research
Building an evidence-grounded agentic security operations harness on Cloudflare
First reported · Discovered cloudflare.com
Page published
Earliest dated coverage: 7 Oct 2026 · First observed: 29 Oct 2026 · Latest dated coverage: 7 Oct 2026
Coverage timeline
Single-source research — one report is available.
Why it matters
Cloudflare’s findings illustrate why investigation agents need code-enforced query boundaries and explicit evidence gaps rather than relying on prompts to constrain their behavior.
Cloudflare reports failures in a single-agent security-operations prototype, including unsupported conclusions, incorrect query scopes, and obscured lookup failures. Its revised architecture moves evidence collection and scope enforcement into application code before model analysis.