- Event: Cloudflare Connect 2026
- Dates: October 19-21, 2026
- Location: Moscone West, San Francisco
- Host: Cloudflare
I write code for a living at SoftDevStudio.com, a small studio that ships small infrastructure tools. So I went through Connect 2026 the way coders go through any conference. Skip the slogans, find the numbers, then find the talk where somebody shows how their thing actually works. Cloudflare billed this year’s edition as the agentic conference of the year, and for once the billing held up. Nearly every session I cared about came back to the same customer, and it isn’t a person with a browser.
It’s an agent. It doesn’t load your CSS or look at your ads. It just makes a lot of requests.
The numbers worth writing down
The opening general session ran Tuesday morning for just over two hours. Matthew Prince started with more than 10 million developers now building on Cloudflare, then said he expects agent traffic to reach a thousand times human traffic within five years. He added that his past forecasts have come in too low. Matthew Conroy put a present-day figure next to it: more than 600 billion agent requests on the network last quarter, close to four times the level at the end of 2025. Fewer than one in ten automated requests comes from a bot that says who it is.
Stephanie Cohen had the clearest arithmetic of the week. An agent 50 milliseconds from the network fits 30 calls into a second and a half. Put it 300 milliseconds away and it gets five. If you write agent loops, that one slide is the whole case for running close to the user.
Grant Bourzikas put attacks at 310 billion a day this year, up 63 percent from 190 billion in 2025. Wesley Evans went through the post-quantum schedule. Every onramp to Cloudflare’s edge and to Cloudflare One already supports quantum-secure encryption, Merkle Tree Certificates bring post-quantum authentication in 2027, and the rest of Cloudflare’s systems get there in 2029. The new Data Residency Architecture moves Cloudflare’s own control and logging systems onto Workers and Durable Objects so a customer can choose where they run. It’s in private beta.
Agents that pay at the door
The commerce demo is the part I keep replaying. Jorn Lambert, Mastercard’s chief product officer, ran an agent inside a $3.50 spending limit held by a smart contract. Sellers answered its requests with HTTP 402 Payment Required, a status code that sat reserved and mostly unused for decades. The agent paid, got its response, and the sellers settled the batch afterward. Cloudflare’s Monetization Gateway is the product built around that flow. You put a price on a page, a dataset, an API or an MCP tool, and the agent sees the price before it sees the content.
Conroy’s breakout, Building an open agentic Internet, sketched the web this assumes. Agents have to be able to read a site, discover it, call it and pay it, with an identity layer underneath that lets an agent vouch for the human behind it. He argued for open standards across all of it. Otherwise a handful of stacks end up owning discovery, identity and payments, and everyone else routes through them.
The customer stories showed what building on the platform looks like now. Telus runs an internal platform called Gizmos where an employee describes a tool and an agent publishes it, each one as its own Worker. Employees built more than 11,000 of them in four months. Tecovas built Boot Runner, a stockroom request app for store staff, on Durable Objects, D1, Queues and R2. Sam Rhea, Cloudflare’s CIO, showed Cloudflare OS, the company’s internal workspace, and said it’s being packaged as open source for other companies to run under their own name.
The talk I’d send every backend developer to
Ramp’s Raphaël Beamonte spent 48 minutes on Ferrisway, a single Cloudflare Worker that has carried all of Ramp’s production traffic since January. That’s about half a billion requests a day, more than 5,000 a second on average and roughly 10 TB daily, covering API calls, authorizations, webhooks and MCP tool traffic. The edge decides routes from cached configuration. On a cache miss it asks Gother, a cloud-hosted counterpart that holds the source of truth.
What I liked was the boring part. Tail Workers feed tracing that lines up Worker execution with Gother’s spans. New Worker versions go through zero-traffic and forced-traffic tests before real payments touch them. And when a request has nowhere to go, what happens is written down instead of left to chance. A router that can explain every decision after the fact is the same itch our own BareProxy scratches, on a much bigger stage.
The prompt is lava
The shortest talk carried the warning I’d print on a sticker. Greg Pstrucha from Sentry spent 21 minutes on prompt injection through telemetry. Sentry ingests error data its customers don’t fully control. Now those customers point MCP clients and local agents at Sentry issues to debug them, so whoever can shape an error message can shape what the agent reads. Every log line and stack trace is untrusted input to a model. Treat it that way.
That’s the same worry that pushed us to build VPN Works, which seals a coding agent inside its own network namespace so a poisoned instruction can’t phone home. Micah Wylde’s session on Cloudflare Basin came at data from the opposite end to our Precomputing. With Basin you ask the business question first and agents generate the pipelines and storage to answer it. I’m curious how readable those generated pipelines stay after a year of questions. I’d like to be proven wrong about my doubts.
What a small studio takes home
The week’s blog posts filled in the developer side. Cloudflare is collaborating on tsrs, a Rust port of TypeScript that the team says runs up to eight times faster with 70 percent less memory. The WAF can now read a response alongside its request, which catches successful exploits that request-only rules miss. Almost 100,000 Commerce.com storefronts now hand agents real shopping tools through WebMCP. Evan You, creator of Vue and Vite, who joined Cloudflare with the VoidZero acquisition, was on the keynote stage as well. That tells you where the company wants front-end tooling to live. The session recordings are online, and Connect returns in 2027.
My takeaway is short. If an agent can’t read your service, find it, call it and pay for it, it’ll pick a competitor it can. Prince’s own example was lunch: the agent reads thousands of restaurant sites, one gets the order, and the rest still pay to serve the traffic. That holds for a small studio as much as for a retailer.
Before the event I wrote about the five SoftDevStudio projects headed to Moscone West. After this week I’d add one line to every one of their READMEs.
Assume the next visitor is a program.