Cloudflare announced 46 launches and updates during the company’s 16th Birthday Week, held from September 28 to October 2, 2026. The announcements were divided into five main areas: open source; application security and the transition to post-quantum cryptography; monetization models for AI agent usage; developer platform tools; and improvements to performance, observability, and network management.
The week does not represent a single product so much as a map of Cloudflare’s direction at a stage when automated activity exceeds human activity, according to the company’s description. Cloudflare says that the growth in requests originating from AI agents requires new tools for developing and protecting services and for defining access conditions for content and services.
From Open Tools to an Agent Browser
On the first day, the company launched cf, a command-line interface that mirrors the Cloudflare API and uses JSON-based output and typed configurations. It also unveiled Forge, an open-source pipeline that operates within CI to generate SDK packages, command-line interfaces, and documentation from API definitions.
The open-source announcements also included EmDash, a content management system built on Astro and Workers that isolates extensions inside Worker environments with predefined permissions, and Vinext 1.0 for running Next.js applications on Vite. The company also presented an update to Kitesurf, its Workers-based browser for agents, with WebMCP support, improvements to DOM operations, and broader web compatibility.
Post-Quantum Cryptography and Application Security
Cloudflare announced its intention to become a public certificate authority, 12 years after the launch of Universal SSL, with the goal of adding resilience to free and automated certificate issuance. It plans to issue Merkle Tree Certificates designed to facilitate post-quantum authentication without significant costs for certificates or handshake operations.
It also revealed the use of the AI-powered CryptoLabe to detect and classify cryptography within the codebase, as part of its goal of completing the post-quantum transition by 2029. It announced optional support for the ML-KEM and ML-DSA algorithms in Web Crypto within Workers, along with updates showing whether requests negotiated a post-quantum key exchange through HTTP Analytics, Log Explorer, and Logpush.
In application protection, the company introduced Application Profiles to learn the expected structure of HTTP requests, and Threat Signals to convert open-source threat intelligence reports into indicators that can be linked to WAF rules. The company also tested its WAF using advanced AI models and discovered gaps across six attack categories, according to Cloudflare.
A New Economy for AI Agents
Wednesday’s announcements focused on enabling content publishers and service providers to treat AI agents as a separate audience. Monetization Gateway entered beta, allowing charges to be imposed on resources using HTTP 402 and x402, while Pay Per Use provides usage reports, billing, and payments for publishers when automated buyers use their content.
Cloudflare also launched improvements to Containers for running agent environments, with faster startup, more options for images and instances, and filesystem snapshots, as well as tools in AI Gateway for identifying model overspending and selecting an appropriate model for each request. Auto Router uses request classification at the edge to route requests to a suitable model, with the goal of reducing costs while maintaining response quality.
Expanding the Developer Platform and Observability
Cloudflare Basin became generally available as a data-serving platform built on Apache Iceberg and R2 for ingesting, managing, and querying large datasets. The company also launched K2 for streaming ordered, durable events on top of R2, and Workers KV Instant, which targets reads with latency below two milliseconds at the 99th percentile, with global replication across more than 300 locations.
AI Search reached general availability with visual search, optical character recognition for scanned PDF files, support for larger files, and support for any conversational model. In observability, Cloudflare introduced Traces, which provides request-level visibility across security rules, transformations, caching, Workers, services, and origins without requiring an agent or SDK, along with eight updates to the Cloudflare Observability platform.
What Changes in Practice?
The announcements show that Cloudflare is attempting to connect layers that were previously managed separately: development interfaces, agent execution, application protection, cryptography, data, and billing. The clearest practical effect for developers is the expansion of the set of tools available within the platform, while service operators and content publishers gain clearer mechanisms for seeing and pricing agent usage.
However, some announcements remain in beta or are pending, such as Monetization Gateway, OHTTP Gateway, and Cloudflare OS. Likewise, announcing the intention to create a certificate authority does not yet amount to operating a public certificate authority. Therefore, the importance of these initiatives will depend on their transition from announced launches to stable services, and on how they address interoperability, cost, and content owners’ rights.