Cloudflare Describes CryptoLabe, the Internal AI Tool It Uses to Find Cryptography in Its Code Ahead of a 2029 Post-Quantum Deadline

What happened

On September 29, 2026, Cloudflare published a post on its official blog, written by Sharon Goldberg and Tiago Silva. Cloudflare said its goal is to be fully post-quantum ready by 2029. "Post-quantum" cryptography means encryption and digital signatures designed to stay secure even against a quantum computer powerful enough to break today's methods. The company said it has already moved many products to post-quantum encryption, but its use of post-quantum authentication, which proves who or what is on the other end of a connection, is still at an early stage.

To that end, Cloudflare set out three goals. The first is to help product and engineering teams understand how cryptography is used and how it should be upgraded. The second is to provide metrics on migration progress. The third is to spot early the prerequisites that need outside cooperation. The company is developing an internal tool called CryptoLabe to meet these goals. It is named after the mariner's astrolabe, a navigation instrument refined by Portuguese navigators. Cloudflare said the tool is highly specific to its internal systems and will not be offered to customers.

Read the full description

Sources are collected, independently checked, then reviewed by Jev.

Why keyword search alone isn't enough

According to Cloudflare, cryptography rarely appears plainly in code. It hides in shared libraries, in protocol defaults, in configuration files far from where it is used, and in code paths that are dead, test-only or on a path to being deprecated. The company noted that simply searching for algorithm names such as "RSA" overcounts, because it finds unused code. It also undercounts, because it misses defaults and indirect use. And it cannot explain what the cryptography is for. For example, the same ECDSA signature may be used in a JWT (a kind of digital access token), IPsec, TLS (the protocol behind secure web connections) or SSH, and each has a different migration path.

Cloudflare said CryptoLabe's "discovery" phase maps a repository, meaning a project's store of code, and produces raw observations. The "analysis" phase then re-checks each observation against the source code. It investigates how the code behaves when it runs and which internal or external parties it depends on. It also looks for conflicting evidence such as configuration overrides and test-only code. When evidence is insufficient, the model labels a finding "More evidence needed", "External dependency" or "Unknown".

How the tool works and its known limitations

Cloudflare said CryptoLabe is built on its own developer platform. It consists of two Workers, one for scanning and one for the inventory, and stores data in D1. It uses the Agents SDK, Durable Objects and Cloudflare Workflows to run four stages in order: discovery, deep analysis, merging and publishing. To avoid damaging code, each scan saves a snapshot of the repository at one exact version (a specific commit) into R2. It then restores that snapshot into an isolated container, Cloudflare Sandbox, where the model can only read it through read-only tools.

Cloudflare said model requests go through AI Gateway to open-weight models, whose underlying model files are publicly available, hosted on Workers AI. Many scans running at once triggered HTTP 429 rate-limit responses. The company fixed this with a single global Durable Object that paces all requests and retries. The company also acknowledged that it has no ground-truth dataset for repeatably comparing how well different prompts perform. It is also not certain it has found every use of cryptography in its code.

Prerequisites and hard cases

Cloudflare uses "prerequisites" to flag problems a single team cannot solve on its own. For example, RFC 9964 already defines post-quantum JWTs. Even so, teams cannot be asked to upgrade across the board if libraries do not yet support verifying them or token issuers do not yet issue them. The post says CryptoLabe found six findings with post-quantum SAML as a prerequisite; SAML is a protocol for single sign-on. Cloudflare also noted that when it deployed X25519MLKEM768 in 2022, the scheme was still an IETF draft. It was not finalized as RFC 10024 until 2026.

Cloudflare also wrote a separate prompt dedicated to finding "hard cases". One example is a certificate carried in an HTTP header. Post-quantum certificates and signatures are larger, so if a system assumes a certificate has a certain size, switching algorithms could break it. Cloudflare's conclusion is that no single scan can find everything. Every finding still needs to be checked by engineers familiar with the system.

What it means for general readers and organizations

For ordinary users, the post shows that major internet infrastructure providers are already preparing for quantum computers that could break today's public-key cryptography. It also shows AI being used for this kind of massive inventory work. Cloudflare published a selection of its prompts but stressed that they are only a starting point. It said the quality of the results depends on the model, tools, context and engineering review.

For organizations, Cloudflare believes most do not need to, and should not, start by cataloguing all cryptography in every repository right now. It suggests the following way to begin:

1. Pick the repository of one important system, such as one that handles sensitive or long-lived data, authenticates users or software, or is exposed to the public internet.
2. Run cryptography discovery on that repository.
3. Have the team that owns the system validate the results. They should confirm whether each use is needed long-term and whether another safeguard (a compensating control) is already in place.
4. Separate the items that can be upgraded now from those that are blocked. Record shared prerequisites that need help from libraries, vendors or standards bodies, and deal with the highest-impact items first.

Browse the latest news in this topic

• Tech news