Skip to main content
CloudflareSecurity incident

Are You Ready for an AI Agent Swarm Attack?

What happened

Cloudflare blocked 23.2 million network DDoS attacks across its infrastructure in the first six months of 2026.

Source

sebastianbarros.substack.comAug 14, 2026

Are You Ready for an AI Agent Swarm Attack?

Article excerpt

Highlighted: the sentence this signal was extracted from

Telco security teams are used to ridiculous cyber numbers. For example, in the first six months of 2026, Cloudflare blocked 23.2 million network DDoS attacks across its infrastructure. That is about 128,000 attacks every day, or more than 5,300 every hour. It also recorded 935 attacks above one terabit per second during the same period. The volume is so high, and many attacks are so short, that human response became unrealistic years ago. Telcos face the same reality as the rest of the security industry. Someone is always scanning the network, trying credentials, looking for exposed systems, attacking customers, testing APIs, or targeting suppliers. At the more serious end, state-sponsored attackers have gone after the routers at the heart of telecommunications networks. CISA has documented Chinese state-sponsored actors targeting backbone, provider edge, and customer edge routers at major telecom providers, then using compromised devices and trusted connections to move further into other networks. Most of these attacks still have one important constraint. The expensive part is intelligent human attention. A botnet can scan ten million IP addresses, but someone still has to determine which result matters, examine the unusual server, link a leaked credential to an old supplier account, study the API documentation, inspect the software package, write an exploit, and decide...

Keep reading with a free account

The rest of this article, and every signal for Cloudflare, is in your free account.

Extracted by Autobound

From the Signal API record
Event
Security incident

What this signalsA breach often leads to new security spend.

Issue
23.2 million network DDoS attacks

More security incident signals at other companies

The full record

From the Signal API record

Details

Issue named
23.2 million network DDoS attacks

Extraction

Confidence
90%
Detected
Aug 14, 2026
signal_type
news
signal_subtype
security_incident

Use this data

Get every security incident signal for Cloudflare and the companies you sell to, in the tools you already use.

  1. Ask Claude about it

    Connect Autobound to Claude, Claude Code or Cursor with MCP. Then ask: “What changed at Cloudflare this week?”

  2. Send it to your own tools

    The Signal API returns security incident signals for any list of companies as JSON, for your CRM, warehouse or app.

  3. Try it free

    Sign up and spend your free credits on the companies you sell to.

    Start Free1,000 free credits

The API returns more than this page shows

This page shows a preview. The full news record in the Signal API and MCP can also have these 8 fields. Some fields are empty for some signals.

Company

  • linkedin_urlValue in the API
  • industriesValue in the API
  • employee_count_lowValue in the API
  • employee_count_highValue in the API
  • revenueValue in the API
  • descriptionValue in the API

Signal

  • signal_nameValue in the API
  • associationValue in the API
Show the full JSONThe record on this page and the API request

GET /v1/signals/cb53090d-a919-ff11-6dbe-a9c7c0f8c6cb returns this record as JSON. POST /v1/companies/enrich returns every signal for cloudflare.com.

{
  "signal_id": "cb53090d-a919-ff11-6dbe-a9c7c0f8c6cb",
  "signal_type": "news",
  "signal_subtype": "security_incident",
  "detected_at": "2026-08-14T22:53:54+00:00",
  "company": {
    "name": "Cloudflare",
    "domain": "cloudflare.com"
  },
  "data": {
    "url": "https://sebastianbarros.substack.com/p/are-you-ready-for-an-ai-agent-swarm",
    "title": "Are You Ready for an AI Agent Swarm Attack? - Sebastian Barros Newsletter",
    "excerpt": "Telco security teams are used to ridiculous cyber numbers. For example, in the first six months of 2026, Cloudflare blocked 23.2 million network DDoS attacks across its infrastructure. That is about 128,000 attacks every day, or more than 5,300 every hour. It also recorded 935 attacks above one terabit per second during the same period. The volume is so high, and many attacks are so short, that human response became unrealistic years ago. Telcos face the same reality as the rest of the security industry. Someone is always scanning the network, trying credentials, looking for exposed systems, attacking customers, testing APIs, or targeting suppliers. At the more serious end, state-sponsored attackers have gone after the routers at the heart of telecommunications networks. CISA has documented Chinese state-sponsored actors targeting backbone, provider edge, and customer edge routers at major telecom providers, then using compromised devices and trusted connections to move further into other networks. Most of these attacks still have one important constraint. The expensive part is intelligent human attention. A botnet can scan ten million IP addresses, but someone still has to determine which result matters, examine the unusual server, link a leaked credential to an old supplier account, study the API documentation, inspect the software package, write an exploit, and decide what...",
    "summary": "Cloudflare blocked 23.2 million network DDoS attacks across its infrastructure in the first six months of 2026.",
    "planning": false,
    "image_url": "https://substackcdn.com/image/fetch/$s_!lt9b!,w_1200,h_600,c_fill,f_jpg,q_auto:good,fl_progressive:steep,g_auto/https%3A%2F%2Fsubstack-post-media.s3.amazonaws.com%2Fpublic%2Fimages%2F63babf46-ba2a-4025-a3c9-ca332e5d95ca_736x414.jpeg",
    "confidence": 0.9,
    "published_at": "2026-08-14T22:53:54Z",
    "vulnerability": "23.2 million network DDoS attacks",
    "article_sentence": "For example, in the first six months of 2026, Cloudflare blocked 23.2 million network DDoS attacks across its infrastructure."
  }
}

Long text fields are shortened on this page.

Looking up one signal by its id is free. Enrich costs 2 credits per signal returned; a call with no results is free.