与 Cloudflare 首席技术官 Dane Knecht 谈智能体网络安全普惠化

1. State of Internet Infrastructure

AI has become a tool that is causing a kind of security apocalypse, but it can also help us solve this problem faster. It all started with how to get everyone to use AI. Now suddenly everyone is trying to figure out what AI safety means. I’ve heard serious tech experts say things like, “Isolate everything important from the network,” that we won’t be able to trust the internet for a while, and that we should assume all critical infrastructure and government services will eventually fail. Do you also expect that to happen?

Dane, I’m so happy to do this with you.

Yes, thank you.

Thank you for coming here too. I’m sure I’m not the first person to joke about this, but your last name is “Connect.” This is quite apt for Cloudflare’s value proposition.

Yes. There were jokes about renaming the show next year.

2. Cloudflare CTO Top Priorities

So, with everything Cloudflare is doing, what are your top priorities as CTO right now?

This past year feels like 10 years compressed into one. Our priorities are constantly changing, but it all comes back to our mission: to help build a better internet. That hasn’t really changed in the last 15 years. We want to make sure the internet is safe, everyone has access to it, and people can easily put content online and scale it.

Over the course of AI development last year, the question went from “How do you get everyone to use AI?” to “How do you make it easier for them and their agents to deploy?” As with most technical transitions, security initially took a back seat, and now everyone is suddenly trying to figure out what AI security means. Different parties perceive that somewhat differently. As a company, you think about how to secure data from leaking through AI, but it’s also important to prevent outside interference.

Over the last 3 to 6 months, the number of vulnerabilities reported to CDE has increased exponentially. We’ve seen things like Log4j or Shellshock on the internet, or incidents like that, maybe once a year. At Cloudflare, we’ve all worked together to protect not only our enterprise customers but all our free users, because we see keeping the internet safe as a kind of public good. Now this happens every week. Not all of them are reported publicly, but there are things just as serious as Log4j; they’re just happening a lot more often.

I expect that by the end of this year and into next year, over the next 18 months, the majority of our teams’ time will be spent on security. Today, one of our talks included a statistic that suggested over 50% of engineers’ time will be spent on security, and I don’t think that’s going to last forever. I think it’ll be a short transition period. At some point, AI will analyze most of the code and find most of the bugs or vulnerabilities.

There’s one case that came out today and has already been blogged about and tweeted about. One of the keys on the internet that protects TLS and WebPKI, which secure all your connections, was seeded with the number 4. If you know anything about cryptography, you understand that it’s all about randomness. That’s why Cloudflare has its lava lamps: to get quality randomness. When you use a seed for a key—an initial value for its creation—like the number 4, it’s very easy to find through reverse engineering.

AI can just do all these things. It doesn’t sleep. This is not the only engineer who was involved in red-teaming for you. Last week, I think OpenAI found the seeds for the NIS curves that were released back in 2000. This is all moving too fast, and the bar is rising. Models are getting better and better at cybersecurity. MTOS was just the tip of the iceberg. Since then, it’s not just the models that have gotten better; the tools are improving, and people are learning how to use these advanced models to find vulnerabilities.

3. Today’s Attacker Landscape

Given your knowledge, what can you say about the people behind these attacks and the patterns they’re using to increase the volume of vulnerability detection so rapidly? Are these state-level entities? Are they small, novice hackers? What can you say about how the attack landscape has changed?

I actually think some of these big vulnerabilities that have come up recently aren’t coming from state entities. These are even high school students who—

We’ll call them “agent kitties.”

Yes. They’re just wasting their time, like they used to do in “capture the flag” security competitions. They direct their agents to a specific area and work on it. There’s a financial reward for them, too: bug bounties, for which they’re paid considerable sums.

But this has given the masses tools that states had had for much longer, whether through agents or simply because of the sheer number of people working on these tasks.

This is the first time in 15 years that I’ve heard serious tech experts say, “We should just disconnect everything important from the network. We won’t be able to trust the internet for a while, and we should assume all critical infrastructure and government services will go down sooner or later.” Is that your expectation, or what’s going on?

Humans are quite adaptable, and we can act quickly when necessary. I’ve seen the industry come together when things like this happen. People you usually consider competitors cease to be competitors. We’re literally protecting critical infrastructure, like you said, and I think that when such critical moments come, people are able to accept the challenge. So I’m a little less pessimistic.

I really think that a lot of the things we’ve done in the last 5 to 10 years, moving away from the “castle” infrastructure model to “zero trust,” put a lot of companies in a better position. You’re no longer saying the office is completely isolated from the network. You’re saying these devices and data streams are protected differently. And everything will be significantly enhanced.

4. Shift Towards Security Spend

What will organizations need to do to implement what you describe? Currently, about 50% of engineers don’t work on security. Last week, I had Greg Brockman from OpenAI on the No Priors podcast, and he said he thinks that by 2027, people will be spending as much on security tokens as they do on engineering. You’re talking about a very similar idea. What will drive this change?

There’s an emergency, right? You’ll be shifting all your security costs over the next 18 months, both on the red-team side, which is actively looking for vulnerabilities, and on the defense side, which is about how you prepare systems. But I don’t think it’ll last forever. I see a world in 18 months where the productivity of creating new software will increase significantly because all these resources will be directed toward it. But right now, there’s definitely a period where security should be a priority for everyone.

5. Road to Better Software and Internet Security

What do you think are the key elements to achieving better security for software and the internet in general? People are certainly learning that there are libraries and services everyone uses that had vulnerabilities that they spent a lot of effort to find, and now they’re gone. I think we’ll touch on some of those points. What else is important there? One of my concerns is that the speed of software production is also increasing significantly. To some extent, we have to fix everything we’ve already created, then keep up with and get ahead of the pace of delivery.

First of all, we’re currently fixing 70 years of software that already exists, so partly it’s just catching up. In the future, I think the software and agent development lifecycle will need to change. Fortunately, just as we’re using security now for red teams and things like that, it’s going to be built into the process every step of the way. I think software is just going to get more secure over time.

6. Building Secure Production Software

What have you already learned about building secure production software in-house that you think could be useful to others? What does this mean? For example, shift-left security: there are many theories on how to do this, including more use of formal verification and using agents for security in the development process. What do you think will create better software from the start?

I go back to the basic principles: you need to reduce the attack surface. The simplest thing you can do is reduce the number of places where vulnerabilities can arise. Look at all your software and ask yourself, “How can I simplify this? How can I reduce this footprint, this code?”

After that, things like formal verification, safer programming languages, and things built into the runtime will make everything safer in the future. But I think it all starts with the fact that AI, at least early AI, is very verbose; it likes to create complexity. So AI, in the form we’re dealing with right now, isn’t really helping to create safer things. But I think we’ll get there.

That’s where we still need people. We still need human judgment, and we still need to make sure that we design software so that it can safely function on its own.

7. Reducing Surface Area

That was actually my reaction when you said we want to reduce the attack surface. I thought, “Oh, yeah, of course, in principle.” But that’s not the natural inclination of today’s models, is it? I ask you to do something, and then I say, “Well, try it again, but 10 times easier.” Is this the role of engineering and safety engineering today? Is this something that will be resolved at the model level?

Just like people did before, this needs to be addressed at all levels, including with agents.

You have to train the engineers who write the code—the product engineers. You need the security teams to still be involved to ensure that they provide checks and balances, a second look at things. You need to build processes.

We’ve moved to being much better at defining internal things about how we build at Cloudflare. We write down our principles. We have a document called the Codex, which is a compilation of a lot of RFCs that teams have created about how to build secure software in the cloud. This is how you build accessible software at Cloudflare. Here are our best practices. It boils down to 10 commandments that agents know to follow and use at every stage of the vetting process, which can help ensure these things are followed.

You have agents that just write a bunch of junk, and then deeper in production you have people who do performance and security reviews. Just like the way the company worked before, I think you need these complementary checks.

8. Near Future of the Web

When you step back a little and look at the total traffic on the internet, and how much of it has become agent-driven over the last year, I think it exceeded most people’s expectations. What has changed in your worldview about what the network will look like in a year, in terms of the economic model, security, or required infrastructure?

Can we get parallel networks? Is there a human network and a machine network, like everyone is trying to do now? What’s it called—AEO?

Yes. I think of it this way: we’re in a messy transition right now where people and agents are using the same rails on the internet. Agents are trying to analyze the human network, even though it’s inefficient and was designed for people who can do things at a different speed.

Going to a website lets you read, see advertising, and participate in a full economic model. An agent can now visit a thousand web pages in the same amount of time. That’s great—you just need to find a new economic model to support it.

I think we’ll find ways to deliver content and meet agents and people where they are, instead of trying to meet them in one place. There are these layers of broadcasting now. A lot of companies help an agent look at a webpage, but it’s all just extra tokens burned on things that probably shouldn’t happen.

A website usually knows what data it has, and we’ve had APIs for years—ways that computers talk to each other. APIs only covered a small portion of the information on the internet, and agents are trying to understand everything. So they go out and explore the human internet, and we need to make it easier for them. We need to make it less costly for website owners, and we need to find a way for them to get compensated.

I think this is a world where things can become very simple. A content site like Substack knows its CPM—how much money it should be getting from advertising for the site. If an agent reads the site, there’s a world where the agent can decide whether to read this content to him or not, and then he can decide whether he wants to pay at a CPM rate, right?

You’re going to need new payment systems for the internet that can do millions of transactions per second for all these little micropayments—all the things we’ve been talking about for years. Micropayments have always been two years away, but I think agents are really going to push this forward. I think we’re going to see a world with a new economic model for content creators.

Who do you think are the players, or what are the variations of this infrastructure?

I think, of course, Cloudflare plays a big role here, but the emergence of personal agents like Instinct and Muse has also made this a pressing issue from a transactional perspective. I don’t think everybody knows what the business outcome would look like. Everybody went through these transformations where the internet was supposed to kill small businesses. It didn’t; small businesses are still thriving.

There were people who lost their jobs, so there’s always some skepticism, and there’s a natural desire to just block them, right? You saw Amazon simply say, “No, no personal purchases from agents.” All these people are in a chaotic state right now, trying to figure out what the path forward is going to be and trying to keep some of their leverage in the negotiations.

I think we’ll get to the point where Muse, Dots, and all these personal agents can perform tasks as easily as a human, or even more easily. But I don’t know if the technology is developed enough for this yet, nor are the business models.

9. Monetization and Signals

Is there anything on the roadmap or technical research plan at Cloudflare that personally inspires you and that you think will help the ecosystem grow in the future?

Yeah, of course. On the content side, we released a monetization gateway that allows people to easily host their sites behind us and accept microtransactions for their content. We also provide wallets for agents to use and a stablecoin to help facilitate these transactions.

We’re also working with OpenAI on a project called Signals, where we’re making it easier for agents to find content so they don’t have to scan the entire internet and keep coming back to the same pages. We make it easier for them to learn about new content and do so more proactively. This is a win for both AI labs and website owners, who don’t have to constantly endure scanning and pay for this infrastructure.

There are a whole bunch of new rails on the internet, and I’m really excited to see them evolve, like X42 when Stripe introduced it. I liked this because it’s a reference to the 402 code, the HTTP code that Tim Berners-Lee created 20 or 30 years ago for payments. We always knew that the internet needed a better payment system, but we just couldn’t figure it out. I think agents will lead us there, too.

10. Success for Content Creators

When you think about these initial products that you released, what would be a success for a content creator or someone who previously monetized their website with advertising? What kind of successful case do you need to see or show the world for this to become a standard approach?

Well, I guess instead of them paying us, we pay them, right? This covers their infrastructure costs. This provides the funds that support their existence. We can increase the number of content creators, which the last generation of the internet did very well with YouTube, TikTok, and X. I think we can do it even more massively.

11. Workplace OS and Use Cases

When you look at the release of the operating system and the ecosystem you’re working on, what are the biggest use cases you expect in the future?

This is a small step forward from what we released, called Cloudflare OS. Cloudflare OS is our internal platform for how our employees use AI every day. This brings us back to security issues, because we were very concerned that customer data or internal data could be leaked. We wanted to make sure our employees could use new AI tools and models, but have a way to deploy them securely within the company, understand how that data is being used and shared, and ensure that this process is properly managed.

Also, the reason my company called it Cloud OS is because we started to realize that as we brought in more agents, we needed to educate them on what makes Cloudflare special and how we build Cloudflare. For people, we did that through Cloudflare University, the onboarding process, and getting to know our colleagues. But we needed to define this more clearly and document it for agents.

Cloudflare OS is a platform where our employees can create anything they want in a safe way, without thinking about security itself. For example, a professional trying to create a call list doesn’t have to worry about security; it’s already built in for them. They also know that it’s being done in a way that’s consistent with Cloudflare’s principles and values.

Why did you release this? I see this as a bit different from other products Cloudflare offers today, as it’s not infrastructure but an end-user product designed to manage the use of AI in an organization. Why exactly was it released? Do you consider this a departure from the usual course?

Yes. First of all, it’s a kind of reference architecture. Over the past 10 years, we’ve built our developer platform from a simple serverless primitive to over 100 different tools—from storage and databases to Durable Objects. We wanted to show how you can build a solution entirely on Cloudflare: how we build things internally, and give people the ability to branch out from that and build their own version of the operating system for their company.

How exactly does this help your people and organization? What do you think is a clear success?

In fact, it’s more commonly used by our go-to-market teams and administrative departments, even more often than by our engineering teams. It gives them a very quick result.

Early on, we saw that training was the biggest gap for people using AI. When you just show them a chat interface or some other tool, it’s too much of a blank slate for them. This is a platform that you design for your business to run on, and they can jump right in with all the data they need.

They can be directed and guided, which helps them quickly understand, “Oh, this isn’t trying to replace me. This is trying to help me do my job better.” It was really interesting to watch all the different ways people in the company used it. A lot of it comes from the way this conference was organized. The marketing team has built hundreds of internal tools. Before, they would have had to turn to different agencies, but the speed at which they can move with a smaller team now is simply amazing.

12. Restructuring for AI-First

Assuming this is a continuation of what started in May, when you restructured to become an AI-focused organization, what else has worked or not worked over the last few months that you could advise others to do?

Yes, the restructuring was difficult. Saying goodbye to some of our colleagues was a first for Cloudflare. We’ve always been very careful not to hire too many people, but this time the reasons were different. We saw how AI was transforming some teams and their work. We saw it as a factory floor that we really had to rebuild and rethink how things were done.

There were certain processes, such as the way a product manager would send an email to customers, that involved 3 teams. You went to the BI team to get the cohort of people you wanted to email. You went to the marketing team to help with the design of the email and choose the right communication style. Then you went to the marketing operations team to send it.

You can never really redesign this process until you make some difficult changes and get people to rethink what the right way to do it is. It may not involve those 3 teams at all. It could just be a new way of working. The result was a tool where the product manager comes in and describes the cohort, writes an email, and the tool rewrites it in the Cloudflare style. It’s sent to their manager, who can click “approve” if they like it, and then the email is sent.

We didn’t move to having 3 teams do it faster. We moved to 1 tool that gives a product manager a superpower they didn’t have before.

When you think about all the different workflows and tasks in an organization of about 5,000 people like Cloudflare, how do you decide who’s responsible for rethinking a process? Was it a bottom-up initiative from one of these teams in this case? Does it have to be the head of the organization? There are so many things that can be changed to work faster and make more sense, like you described.

Yeah, there were always a thousand more things to do at Cloudflare than we could do, whether they were products and features or things like this. We’re always looking for people who will show initiative and take responsibility. It doesn’t really matter whether you rank these things from 1 to 100 and try to prioritize them. Any of those 100 things is likely to be successful if someone is passionate about it.

We gave people the tools early last year and started watching them experiment. People quickly divided into different groups that got actively involved and naturally started doing these things, taking responsibility for them. I think it was completely a bottom-up initiative in how we were going to do these things.

13. Token Budgeting

That was a major topic of discussion for organizations: how to think about token budgeting. What amount of spending is acceptable? How do I compare that to human capital? Who in our organization should receive tokens? What’s your philosophy on that right now?

It’s definitely changed. Every model forces you to rethink everything when the cost dynamics change. But overall, I think it’s pretty pointless to force people to decide which model to use for each task.

This should be routed intelligently.

That’s right. Humans will just never be effective at this, right? First, you do it kind of brute force: you let people experiment and say, “Hey, let’s try to use the best, most advanced models for planning.” Then, when the plan is written, agreed upon, and finalized, perhaps some of the work can be done by open models. Then you go back and ask one of the advanced models to do a review, a red team, and other things like that.

Right now, it’s all pretty manual work. But I think as we learn and experiment, people will get smarter, and over time there will be more control over this. At Cloudflare, we’re mostly letting people use the models and tools they feel are appropriate for the job. We don’t have a leaderboard for the number of tokens, and we don’t encourage that. We encourage people to focus on the outcome. They’re not judged by whether they used tokens; they’re judged by what they released and what they created.

We have a certain approach: if someone suddenly spends $300 a day, they just get an email saying, “Hey, did you know about this?” For the most part, people didn’t even realize they were doing it, and they’re like, “Oh, wow.” If the number reaches $500, it goes to your manager. If it reaches $1,000, it reaches the vice president in a day. This rarely happens, and usually people are happy to receive those notifications.

14. Cloudflare’s Intern Strategy

Where do you think you are in the evolution of taking the current capabilities of the models, without new developments, and rethinking approaches at Cloudflare, from go-to-market to engineering?

Oh, I think we’re still at the very beginning. We did something in the company 2 years ago. We had about 200 interns, and we saw that they were probably the first to be completely AI-native. If you took away AI, they probably wouldn’t be able to work.

Is that good?

I think so. They know how to use the tools better than we do. It’s like if Google had been taken away from me over the last 10 years. How could I possibly learn anything? That’s what they turn to first, and we saw that managers who had interns that summer started implementing AI faster. Last year, we decided to hire 1,000 interns.

For a company of 5,000 people?

Yes.

Wow.

Yes, all year round.

Yes.

It’s just incredible because, first of all, the number of ideas from interns allows a smaller team to experiment faster thanks to AI. Having more ideas and engaging more people is great, and it’s also amazing how they’re using AI. They need to fill out a form, and they turn to AI. I still find myself thinking there are a lot of things where I’m like, “Oh, wait, I’m still doing this manually.” Then I think, “Yeah, I should actually use AI.” I don’t think it’s come naturally to most of us. This will take time. So yes, I think we’re still at the very beginning of our journey with AI.

I love this strategy for mass recruiting interns. I run a very small partnership, and we always have 1 or 2 interns helping out a team of about 12 people for ideas, intern energy, and all that. We just promoted one of our student interns to full-time, and he dropped out for this. I think you’re right. Maybe we should increase the proportion of people with truly AI-native DNA.

Yes, I think it’s great for them, too. You see universities like Waterloo and Northeastern with their internship programs, and we see that people who get that real-world work experience become some of our best employees many years later and achieve great results.

What’s interesting and encouraging is that instead of having a master plan where we map out every department and subdepartment at Cloudflare and try to redesign all the workflows, we choose a strategy: assume that people spend their tokens rationally if they have information about their usage, hire a bunch of interns, and count on proactive people who, over time, will be able to make these workflows smarter.

Yes, and then just proceed by trial and error. At the very beginning, we created an email inbox for agents at Cloudflare. It was back in January of this year, and we asked people to write in if they were interested in using AI for something: “Can I use AI for this?” They’d send us their tasks, and we’d respond with ready-made files.

For a while, people thought it was completely automated by AI. It was actually a group of interns who helped people write these files. But it allowed us to see everything with our own eyes, without spending money to hire a consulting firm to catalog every task. These are the people who notice, “Hey, this seems harder than it needs to be. I wonder if an agent can help me here.”

15. Importance of Curiosity

Has anything else changed in the last year besides the number of interns, such as your hiring philosophy and who you look for to work with?

One of the main things we’ve always valued is curiosity. If people aren’t using AI at home, in their personal lives, that’s quite a red flag. How can you not use AI if you have at least some level of curiosity? I think we need to focus even more on key characteristics like focus, curiosity, and empathy, which will become even more important for new employees.

I’ve always been, and remain, an alpha user of all products and technologies. But I think the answer lies in fear and skepticism, don’t you? So perhaps an integral part of this idea of curiosity, including experimenting with cutting-edge tools, is that this should become a core principle for people who work at Cloudflare.

Yes. Much of what we do isn’t just work; we invent new ways to get things done. The scale at which we operate, the number of sites we serve, and the amount of free services we provide simply aren’t possible with standard technologies. So you need people who can come in and literally invent something new. That starts with curiosity.

16. Attacking the Legacy Software Security Problem

I have a few closing questions, mostly about security: how to approach it in new ways, both within Cloudflare and in the broader ecosystem. What do you think the process is if half of the engineering team goes to work on security to fix 70 years of vulnerabilities? How do you solve this problem from the inside, assuming that not all software is perfect, even amazing industrial software at Internet scale? Then we’ll talk about the ecosystem.

Yes. I think that today we mostly have one red team. By the end of next year, we’ll probably have four or five red teams. We’ll divide people into groups that act more aggressively, actively looking for vulnerabilities.

Why take this approach instead of finally fixing our update systems and processes?

Processes and things like that can always be improved. We have a vulnerability detection process and an update process. Are they perfect? No. But I’ve found that the best way to improve these things is through a crisis. That’s how they eventually get fixed. When the workload becomes too large for an engineering team to handle using conventional methods, engineers are naturally lazy—in a good way—so they automate these tasks when they realize there’s no other way. I think we need to focus on detection, and people will eventually do the right thing and find a way to fix vulnerabilities at scale over time.

17. Engineering Team Prioritization

Do you have a philosophy on prioritizing this versus releasing new features? To me, it’s not like we didn’t have a backlog of vulnerabilities in every major software product that needed to be fixed. The only question is whether this was a priority for engineering teams earlier, as a general state of affairs.

I think we need to find a way to do both. This may come at the expense of cost optimization or other things, but for companies, the rule is: if you don’t release updates, you die. That’s how we see it. So it won’t be a work freeze for its own sake.

Oh, no, absolutely not. You have to be able to keep creating and releasing new things. But you must ensure that you do it safely by correcting errors.

I think if we do it right, we can do both faster thanks to AI. While AI has become a tool causing this “security apocalypse,” it’s also a tool that can help us solve it faster. So it works both ways.

18. Open vs. Closed Models

What’s your position on this debate about the role of open and closed models in cybersecurity, both positive and negative? The general argument is that defensive and offensive cyber capabilities exist in parallel in the same model, despite the security features and safeguards built into them. So it’s impossible to have open defensive models without them simultaneously becoming offensive. Another argument, or concern, about concentrating security features only in closed, advanced models is: “How are you going to distribute them?” It’s impossible to deliver them to all the distributed participants who need to be protected. So what do you think? Did I describe everything correctly?

Yes. I think eventually everything should become open source because everyone will have access to it anyway. That’s how open source usually works. Bad guys will still find a way to get it, and top companies will have a way to get it too. So I think you’re just excluding a huge number of people who simply don’t have access but probably need it.

19. Democratizing Security for Everyone

Mm. And finally, one last question: since Cloudflare is a very mission-driven company that carries the burden of some internet sustainability, what about all those who can’t afford to have four penetration testing teams, or have never had one, but manage critical systems? How do they protect themselves?

I would say: host your sites on Cloudflare, host your infrastructure on Cloudflare, build on Cloudflare. When serious vulnerabilities arise, like the one in React last year, we provide protection not only to paid customers who have advanced firewall and WAF features, but to everyone. We view things like that as part of the utility we offer. Just as we want to ensure productivity for everyone, we want to democratize security for everyone.

Before Cloudflare came along, there were probably 3,000 sites in the world that had a large-scale CDN to cache their content at the edge. There are now hundreds of millions of such sites, so Cloudflare has always seen its goal as democratizing security and productivity for everyone.

Perfect. Thanks, Dane, for coming, and you guys heard it first: we have “agent cats” and “wolf apocalypse”.

Am I pronouncing this word correctly?

Yes. Yes. But this can be solved.

Okay. Thank you very much, guys.

Thank you.