Cloudflare Ask AI: How Good Is Agent Lee, Really?

Cloudflare Ask AI is the button in the top right of the dashboard. Behind it sits Agent Lee, an agent that reads your account, answers questions in plain language, and since April 2026 also changes your configuration once you approve the change.

This is not another docs chatbot. It is an agent holding credentials inside a control plane that sits in front of a large share of the internet. That deserves a closer look than a launch post.

Everything below comes from Cloudflare's own documentation and blog, plus public incident reports from people who ran into it. I have not aimed it at a production account, and after reading those reports I am in no rush to. That choice is the article.

What sits behind the Cloudflare Ask AI button

Agent Lee is built on Cloudflare's own stack: the Agents SDK, Workers AI for inference, Durable Objects for per-user conversation storage and the write-approval gate, and Cloudflare's MCP server for the API tool definitions.

The interesting part is how it calls tools. Instead of emitting tool calls one at a time, the model writes TypeScript against a generated API, and that code runs sandboxed through a Durable Object acting as a credentialed proxy. Cloudflare calls this Codemode. API keys never appear in the generated code, they get injected server side. Read operations run directly. Write operations stop at what Cloudflare calls an elicitation gate, and in their launch post they are explicit that the confirmation prompt is the gate itself, not a UX nicety.

Cloudflare says Agent Lee handles roughly 250,000 tool calls a day across DNS, Workers, SSL/TLS, R2, Registrar, Cache, Tunnel and API Shield.

As architecture, this is a real design, and it is more careful than most vendor copilots I have looked at. The failures are not in the architecture.

What Cloudflare Ask AI gets right

The pitch holds up in the narrow case. Ask it where a setting lives and it beats clicking through eight tabs. Ask it to run a DNS lookup or a certificate check and you get an answer without leaving the page. Ask for a traffic chart and it renders one from your analytics through generative UI.

Account awareness is the genuine upgrade over a docs search. It answers about your zone, not about a hypothetical zone in the documentation. For anyone who touches the Cloudflare dashboard twice a year and cannot remember whether a rule lives under Rules, Caching or Configuration, that alone is useful.

Three failures are documented publicly, and they are not the same kind of failure.

The token nobody asked for

In late February 2026, Cloudflare users started finding an API token in their account named "Agent Lee (auto-generated)" that they had never created. Deleting it did not help. It reappeared on refresh. A community thread worked out the cause: a setting called "Let AI view your account", buried behind a small control inside the Ask AI panel, shipped enabled. Turning it off removed the token for good.

One user in that thread said they had never enabled it and had received no notice. A former Cloudflare staffer replying in the same thread agreed the feature had gone out without notification, and flagged something sharper: the agent did not know about its own token. The team shipped beta documentation and a token fix afterwards.

Then in May, a developer auditing credentials found a similar token on their account, created on 28 April and discovered three weeks later. Their write-up, Cloudflare's Ask AI created an API token with read access to my entire account, describes read access spanning all accounts, all zones and all users, more than 160 permissions, and no expiry date. Their argument lands: "An assistant answering a question needs read access scoped to that question."

Cloudflare's documentation today lists API tokens under what Agent Lee cannot access. Both things can be true at once if the credential provisioned for the agent is broader than the agent's intended use. That is the whole problem with a permanent, wide-scope, non-expiring token.

Go and look: dash.cloudflare.com/profile/api-tokens.

Silent non-answers

In May, a user reported on the Cloudflare community forum that Ask AI sat on "thinking about it" through several traffic analysis questions and then returned nothing. No error, no partial answer, no signal that anything had failed. A Cloudflare-side responder reproduced it and said the team was shipping changes to stop the non-answers.

This one is a beta bug and will get fixed. I mention it because of what it reveals about the interface. A chat panel with no system feedback gives you no way to tell a hard question from a broken pipeline.

A cache rule broken by an approved write

The July report is the one worth your attention. A user troubleshooting a caching issue worked through it with Ask AI, watched it save successfully, and found the problem back the next morning. Digging in, they found that the agent had set browser_ttl to 0 with override_origin through the Rulesets API. The API accepted the value. The dashboard later flagged it as invalid when the rule was opened in edit mode. The rule had already deployed in a broken state, and the cache bypass silently did nothing.

Read that sequence again, because the guardrail worked exactly as designed and the outcome was still a broken production rule.

The gap the approval gate does not cover

The elicitation gate answers one question: do you authorise this write? It cannot answer the question that actually bit that user: is this value correct?

Approving "set browser TTL on this cache rule" is not the same as knowing that 0 combined with override_origin produces a rule the API accepts and the dashboard rejects. To catch that at the approval prompt you would need to already know the constraint, and if you knew the constraint you would not be asking an agent.

That is the structural limit of confirm-before-write on infrastructure. Authorisation is not validation. A human approving a change they cannot evaluate is a rubber stamp with extra steps, and the failure mode is worse than a refusal, because a silent misconfiguration looks like success until traffic tells you otherwise.

If you build agent systems, this is the transferable lesson. I hit the same wall building agent-driven publishing and CMS workflows: the approval step only protects you if the human at the gate can actually judge the payload. Otherwise you need validation in the tool, not consent in the UI.

The free plan paradox

Agent Lee is still in beta and still limited to Free plan accounts as of September 2026.

Think about who that puts in the test group. The accounts with real complexity, multiple zones, Enterprise WAF rules and revenue riding on cache behaviour cannot use it. The accounts that can use it are the ones least likely to spot that a browser_ttl of 0 is wrong before it costs them something.

I understand the blast radius logic. It also means the feedback loop is running on exactly the wrong population, and the July cache incident is what that looks like in practice.

How I would use Cloudflare Ask AI today

Read-only reconnaissance, yes. Asking where a setting lives, what a zone is currently configured to do, whether a certificate is valid, or for a quick chart of traffic. Low risk, real time saved.

Writes, no. Not on anything carrying traffic I care about. Let it tell you what it would change, then make the change yourself where the dashboard validates your input.

Three things worth doing this week whether or not you use it:

None of that is anti-Cloudflare. I build on their stack, including Workers and D1 for production waitlists. The point is that an agent inside your control plane earns a different level of scrutiny than an agent inside your editor.

Verdict

Agent Lee is the most architecturally serious vendor copilot I have read the internals of. Codemode, a credentialed proxy, a real approval gate, all built on their own primitives. Cloudflare did the hard part properly.

The scoring, as of September 2026:

The gap between the architecture and the rollout is the story. Cloudflare engineered the credential path carefully and then enabled it by default without telling anyone, which undid a lot of that care in one move.

Useful for questions. Not yet trustworthy for changes.

Sources

Checked 18 September 2026.