Democratizing Security for the Agentic Web with CloudFlare CTO Dane Knecht

Cloudflare CTO Dane Knecht went on No Priors and made two claims worth taking seriously, even if not at face value. First: serious internet vulnerabilities, the Log4J kind, are now showing up weekly because AI models are being pointed at codebases to find holes. Second: by 2027, companies will spend as much on AI tokens for security as on engineering. He's also shipping product against the thesis: a pay-per-crawl content toll booth that charges AI agents to read your site, and a partnership with OpenAI called Signals that lets sites publish a feed of what's changed so agents fetch updates instead of re-crawling everything.

Take the claims with some skepticism. The 2027 budget number came from OpenAI's Greg Brockman, and Knecht is repeating it. Both men sell exactly what that forecast makes you buy. Knecht also adds a hedge: the crunch is a "short transition," 18 months, then it normalizes. A scary budget line that is also conveniently temporary and unfalsifiable is not a budget line you should act on without vendor usage data in hand. The "weekly Log4J" claim has the same problem. "Not all of them are publicly reported on," Knecht says, which means you can't check it. Underneath the noise there is a real capability signal: OpenAI's models reportedly reconstructed how the NIST elliptic curve constants were chosen in 2000. Those numbers underpin the encryption protecting most web traffic, and their origin has been a 25-year suspicion. If a model reverse-engineered the recipe, that's meaningful. But Knecht lumps "finding known bug classes faster" and "finding genuinely novel cryptographic breaks" together as if they're the same thing. They're not.

He also makes a point that cuts against his own hype: AI models today write verbose, complex code, which creates more surface area for bugs. Security is getting worse before it gets better.

On openness, Knecht is right and contradicts himself at the same time. His argument: security models must be open because bad actors get the capability regardless, so locking it up only excludes the defenders who need it most. That's the correct call, and it runs against the usual frontier-lab line that capability must stay closed for safety. For a buyer it's practical: open-weight defensive tooling means small teams can run it against their own stack without waiting on a vendor's roadmap. The problem is that Cloudflare's own agent-web products are the opposite of open. The toll booth and Signals are proprietary rails. Open where it recruits defenders; closed where it books revenue. Both can be true. Only one pays his salary.

Of the two products, Signals is the one with aligned incentives. Agents re-crawl your pages constantly to detect changes. That burns the lab's tokens and hammers your servers. Signals publishes a feed that says "here's what's new," so agents fetch instead of scrape. Both sides save. That's a real cost argument. The toll booth is shakier. Micropayments on the web have been two years away since 2001. Knecht's bet is that agents, unlike humans, will pay without friction because an agent doesn't resent a bill. Plausible in theory. Unproven at any volume that matters. The labs also have every incentive to keep crawling free while the law on training data is still unsettled.

The practical takeaway: If you run a content site that agents already crawl, Signals is worth testing. It cuts server load, it costs little to publish a feed, and the incentives on both sides are aligned. The toll booth can wait for actual transaction volume figures before you build toward it. On the org side, Cloudflare's most copyable move has nothing to do with either product: they distilled their engineering standards into a short document they call a Codex, which an AI reads during code review. Give the model your rules in writing so it reviews against them. You can do that next week without buying anything.

The prediction: Cloudflare's pay-per-crawl toll booth will not report a publicly verifiable paid-transaction volume above a token pilot level by its Q3 2026 earnings call in November 2026. The monetization story will keep leaning on partner logos and sites enrolled. Confidence is medium. Micropayment rails have stalled on demand for 20 years, and nothing in Knecht's pitch names a buyer committed to paying real volume. When a company has a working revenue product, it reports the dollars. Silence on paid volume while touting enrollment is the evidence that the dollars aren't there yet.

Cloudflare CTO Dane Knecht went on No Priors and made two claims that, if true, change how you budget for AI next year. First: serious internet vulnerabilities, the Log4J kind that used to show up once a year, are now showing up weekly, because people are pointing AI models at code to find holes. Second: by 2027, companies will spend as much on AI tokens for security as they spend on engineering. He's also shipping product against it: a toll booth that charges AI agents to read your content, and a partnership with OpenAI so agents stop hammering your site.

What's actually being decided here is where a buyer's AI dollars go over the next 18 months, and whether the "agent web" plumbing Cloudflare is building becomes something you have to plug into or something you can ignore. Nothing forces your hand this month. These are directional bets, easy to walk back. But the security-spend claim, if it holds, resets budgets, and that's hard to undo once it's baked into a plan.

The Skeptic. "As much on security tokens as on engineering by 2027" came from Greg Brockman of OpenAI, and Knecht is repeating it. Both men sell the thing that forecast makes you buy. OpenAI sells tokens. Cloudflare sells security. A number that says "buy twice as much of what we sell" deserves a hard squint. And notice the hedge Knecht adds: the security crunch is a "short transition," 18 months, then it "normalizes back." So the scary budget line is also conveniently temporary and unfalsifiable. The "weekly Log4J" claim has the same problem. "Not all of them are publicly reported on," he says. Translation: you can't check it.

The Researcher. Strip the marketing and one claim is checkable and interesting: OpenAI's models reportedly reconstructed how the NIST elliptic curve constants were chosen back in 2000. Those are the magic numbers inside the encryption that protects web traffic, and how they were picked has been a 25-year suspicion. If a model actually reverse-engineered the recipe, that's a real capability signal, not a demo. But "comparable to Log4J, weekly" lumps together two very different things: a model finding a known bug class faster, versus a model finding genuinely novel breaks. Knecht doesn't separate them. His own aside cuts against the hype too: today's models write verbose, complex code, which creates more places for bugs to hide, so AI is making software less secure right now. The security picture is getting worse before it gets better.

The Open-Source Advocate. Knecht's cleanest position: security models have to be open over time, because bad actors get the capability anyway, so locking it up only excludes the defenders who need it most. He's right, and it's worth sitting against the usual lab line that frontier capability must stay closed for safety. For a buyer this is practical. If the defensive tooling that matters is open-weight, the mass of small companies and in-house teams can actually run it, tune it to their own stack, and not wait on a vendor's roadmap. The catch: Cloudflare's own agent-web products, the content toll booth and the OpenAI Signals feed, are the opposite of open. They're proprietary rails. Open where it recruits defenders, closed where it books revenue.

The Compute Pragmatist. The Signals project with OpenAI is the part with real money behind it. Today agents re-crawl your pages constantly to see what changed. That burns the lab's tokens and hammers your servers. Signals lets a site publish a feed that says "here's what's new," so agents fetch instead of scrape. Both sides save: the lab burns fewer tokens, you serve less junk traffic. That's a genuine cost argument, not a vision slide. The content toll booth, charging agents micropayments to read, is shakier. Micropayments on the web have been "two years away" since 2001. Knecht's bet is that agents, unlike humans, will actually pay without rage-quitting. Plausible, because an agent doesn't resent a bill. Unproven at any scale that matters.

The Builder. What would you touch on Tuesday? Signals, if you run a content site agents already crawl, because it cuts load for free and costs you little to publish a feed. The toll booth, not yet, because you'd be pricing access to buyers who don't exist in volume. The more useful signal is the org stuff. Cloudflare went from 200 interns to 1,000 at a 5,000-person company, on the theory that AI-native juniors drag their managers into using the tools. And they distilled their engineering standards into a short "Codex" that an AI reads during code review. That's a concrete, copyable move: give the model your rules in writing so it reviews against them. You can do that next week without buying anything.

Where they split. The Skeptic and the Researcher agree the "weekly Log4J" line is unverifiable, but the Researcher thinks the elliptic-curve result is a real capability underneath the noise. The Open-Source Advocate and the Compute Pragmatist expose the cleanest contradiction in Knecht's own pitch: he argues security must be open because excluding defenders is dangerous, while building the agent-web as closed, Cloudflare-owned toll roads. Both can be true, but only one of them pays his salary.

What it hinges on. Three things. Is the security-spend surge real demand or a forecast sold by the people who profit from it. Will anyone actually pay to let agents read content, or does the toll booth stall like every micropayment scheme before it. And does Signals get adopted because it saves tokens, which is the one claim with aligned incentives on both sides. The council leans skeptical on the budget number, skeptical on the toll booth, and genuinely positive on Signals, because that's where the lab and the site owner both save money at the same time.

Before you move budget on "security tokens equal engineering by 2027," ask your vendors for actual usage numbers, not forecasts. Before you build on the toll booth, wait for a payment volume figure. For Signals, the test is simpler: does OpenAI's crawler actually back off when you publish a feed. That you can measure in your own server logs.

Prediction: Cloudflare's agent-payment product (the pay-per-crawl content toll booth) will not report a publicly verifiable paid-transaction volume figure above a token pilot level by Cloudflare's Q3 2026 earnings call in November 2026, and the monetization story will keep leaning on partner logos and "sites enrolled," not dollars paid.

Confidence: Medium — micropayment rails have stalled on demand, not plumbing, for 20 years.

Why: Cloudflare built the plumbing, but the buyers are AI agents with wallets that mostly don't exist yet at scale, and the labs have every incentive to crawl free rather than pay a per-page toll while the law on training data is still unsettled. Every prior web micropayment scheme failed because demand never materialized, and nothing in Knecht's pitch names a buyer committed to paying real volume. The Signals feed, which saves both sides tokens, has aligned incentives and will get uptake. The toll booth asks one side to start paying for what it currently takes for free, so it's the piece that stalls, and a company shipping a working revenue product usually reports the dollars. Silence on paid volume while touting enrollment is the signal that the dollars aren't there yet.

Revisit by 2026-11-30: We're right if Cloudflare's Q3 2026 results and commentary cite enrolled sites or partnerships for pay-per-crawl without a disclosed paid-transaction dollar or volume figure. We're wrong if Cloudflare discloses a specific, growing paid-crawl revenue or transaction-count number.