Cloudflare is betting that artificial intelligence can solve one of the hardest infrastructure problems of our time: finding and cataloging every instance of cryptography across millions of lines of code, understanding how it’s used, and plotting a migration path to post-quantum algorithms. I find their approach instructive because it reveals both the scale of the coming transition and why brute-force solutions won’t cut it.
The company has set a 2029 target for full post-quantum readiness across their platform. That’s not some distant theoretical goal - it’s a concrete deadline acknowledging that cryptographically relevant quantum computers are coming, and harvest-now-decrypt-later attacks against today’s traffic are already a threat. But here’s the problem: cryptography doesn’t announce itself. It hides in dependencies, configuration files, legacy protocols, and indirect uses that simple pattern matching completely misses.
Enter CryptoLabe, an internal tool built on Cloudflare’s Developer Platform that uses AI to do what grep cannot. Rather than searching for algorithm names, the model follows evidence across files, understands runtime behavior, and explains how cryptography is actually being used. A classical ECDSA signature in a JWT has a completely different migration path than one in TLS or SSH. The model gets that nuance.
The Two-Stage Hunt
CryptoLabe works in two distinct phases. The discovery stage scans repositories and produces raw observations about cryptographic usage. But that’s just the beginning. The analysis stage is where things get interesting. The model re-examines each finding, investigates runtime behavior, traces dependencies across repositories, and even searches for configuration overrides that might change how the cryptography is actually used.
This two-stage approach surfaces three critical things product teams need to know. First, what cryptography are they using? Second, what’s its current post-quantum status? Third, what are the blockers preventing migration?
That last piece matters most. Cloudflare discovered something important: you can’t migrate in isolation. If your authentication system depends on a standard that doesn’t exist yet, or a library that hasn’t implemented post-quantum variants, you’re stuck. CryptoLabe flags these prerequisites early so teams can work with standards bodies and ecosystems to unblock progress.
Why This Matters for Developers
I think most organizations building infrastructure today are three to five years away from facing similar pressures. If you work on https://mgks.dev/tags/cloud/ platforms, distributed systems, or anything touching cryptographic infrastructure, you need to be thinking about this now.
The interesting bit is how Cloudflare is using AI not as a replacement for human expertise, but as a force multiplier. An engineer can’t manually review millions of lines of code. A regex can find algorithm names but not understand context. AI can do both - it scales to the problem while maintaining the semantic understanding that simple tools lack.
But there’s a catch. Cloudflare openly admits they don’t yet have ground-truth validation. Their findings are reviewed iteratively with engineers, but reproducible comparison between different prompting strategies doesn’t exist. This is honest about the limitations of current AI tooling. You can’t just throw a model at a code scanning problem and trust it works perfectly.
The Infrastructure Investment
What impressed me most was the infrastructure discipline. Rather than building a one-off scanning tool, Cloudflare built CryptoLabe on their Workers platform using Durable Objects for persistent coordination, Workflows for reliable job orchestration, and R2 for isolated code snapshots. This meant they could handle rate limiting, retries, and concurrent scans without building custom orchestration logic.
They routed model requests through https://mgks.dev/tags/ai/ Gateway and open-weight models, making it easy to swap for cheaper or better alternatives as they emerge. They built a global rate limiter so concurrent scans share capacity instead of competing for it. These are the kinds of decisions that let you run massive migrations sustainably.
The Quantum Deadline
What strikes me about Cloudflare’s approach is the deadline-driven urgency without panic. 2029 is real enough to matter but distant enough to allow for ecosystem collaboration. They’re not trying to migrate everything immediately. They’re working with standards bodies, pushing on ecosystem readiness, and surfacing what they can’t fix alone.
The post-quantum migration isn’t coming as a surprise - it’s been on everyone’s roadmap for years. What’s changing is the realization that it requires organizational-scale tooling and cross-ecosystem coordination. Individual teams can’t solve this by themselves. Infrastructure providers like Cloudflare are now building the scanning and orchestration tools that make migration possible at scale.
The question isn’t whether your organization needs something like CryptoLabe. It’s whether you’ll build it before or after the migration pressure becomes critical.