🔥 Hot Repo: The AI Bug-Hunter Cloudflare Runs on Its Own Code

Cloudflare open-sourced the multi-agent security auditor that powers their internal vulnerability discovery harness — and it works with Claude Code right now.

By OMC Editorial on 2026-10-21

One-liner — A coding-agent skill that coordinates isolated AI agents through a six-phase adversarial security audit, producing schema-validated, machine-readable findings — the same tool that seeded Cloudflare's internal vulnerability discovery harness. - Repo: cloudflare/security-audit-skillhttps://github.com/cloudflare/security-audit-skill - Stars: ⭐ 35,155 +1,997 today - Language: JavaScript / Markdown - License: MIT --- What It Does security-audit-skill turns any capable coding agent — Claude Code, Codex, Cursor — into a multi-phase security auditor. It orchestrates isolated agent instances through six sequential phases: reconnaissance, coverage-led vulnerability hunting per attack class, adversarial candidate validation, schema-validated structured output, independent record verification, and target-neutral reporting. Every confirmed finding requires a complete source trace; without one, it lands in needsvalidation, not confirmed. Why It's Blowing Up In June 2026, Cloudflare published "Build your own vulnerability harness"https://blog.cloudflare.com/build-your-own-vulnerability-harness/, revealing that this skill — originally 450 lines — was the seed of a fleet-wide AI security system that can discover, validate, deduplicate findings, and open draft PRs across their entire codebase in roughly 14 hours. The open-source release was intentional: the README states it is "the skill that seeded Cloudflare's vulnerability discovery harness." Today's +1,997 star spike — a 6% single-day jump at 35K stars — points to renewed attention, likely from a conference talk or follow-up coverage. The adversarial design is what's catching developers' eyes: the agent that validates a finding is never the agent that found it, which systematically eliminates a class of hallucination false positives that plague simpler "ask the model to review this code" approaches. The skill also covers attack classes most AI code reviewers ignore: AI/LLM prompt injection, supply chain com

More agent news