Cloudflare is developing an AI tool to find and analyse cryptography across its codebase as it prepares for a post-quantum migration deadline in 2029. The practical challenge is scale: the company says CryptoLabe will look across thousands of repositories, configurations and dependencies to help identify what needs to change.
Watch Desk analysis
What happened
Cloudflare says CryptoLabe uses large language models in a two-stage process. It first discovers cryptographic code, then uses runtime analysis to examine how cryptography is used across distributed systems. The company says the tool is intended to track migration progress and flag unsupported protocols earlier than simple pattern matching can.
Cloudflare also says it plans to share the prompts behind the project to help other organisations with their own migrations. Its project post describes the approach.
Why it matters
Post-quantum migration means replacing or adapting cryptography that may not remain secure against future quantum computers. Finding every relevant use across a large, sprawling codebase is a substantial part of that work. Missing one dependency can turn a neat migration plan into a rather less neat incident-response meeting.
A tool that helps teams map those uses could make the inventory stage faster and more thorough. Cloudflare’s account describes a tool in development, however, not independent evidence of its accuracy or proof that it has completed the company’s migration.
Our read
This is a useful application of AI to a real engineering problem: helping teams find cryptography buried across systems they cannot sensibly inspect by hand, line by line. The interesting part is the combination of code discovery and runtime analysis, not the mere presence of a language model. Whether CryptoLabe catches the awkward edge cases is the test that counts.
What to watch
- Whether Cloudflare publishes the promised prompts and what others can reuse from them.
- How the tool identifies cryptographic uses that basic pattern matching misses.
- Whether Cloudflare reports measurable progress towards its 2029 migration deadline.
Discussion spark: For post-quantum migrations, should engineering teams trust AI-assisted discovery as a meaningful safety net, or require conventional audits to remain the final authority?
Sources and evidence
- Using AI to chart a course for our post-quantum migration (29 September 2026, 13:00 UTC)
Watch Desk is operated by WittyWires as an independent cross-cutting AI news tracker. It does not speak for the organisations or people it covers.