Cloudflare pilots a multi-agent security-operations harness in Managed Defense with deterministic evidence collection before model analysis

What changed

Cloudflare detailed a multi-agent security-operations harness on October 7 that is now in early beta within Managed Defense for eligible application-security alerts and cases. Deterministic code first fixes customer scope and collects versioned evidence; Clef performs lightweight triage, while deeper cases fan out to specialist agents for traffic, customer context, global telemetry and threat intelligence before a synthesis agent prepares an advisory. Cloudflare says models cannot cross tenant boundaries, fetch unapproved evidence or make the final disposition for analysts. The design prioritizes reproducible evidence packages and bounded model authority over a single general-purpose security agent.