On a Wednesday afternoon in a SaaS company, a developer ships a feature she’s been working on for a week. To finish testing, she asks her AI coding assistant — Cursor — to query the staging database and check a specific edge case. The query runs cleanly. The bug is found. The fix gets merged.
What nobody on the IT team will see, that afternoon or any other, is that the query touched a handful of rows containing real customer information that staging had been seeded with. Those rows left the network and travelled to the AI provider’s cloud. There’s no SIEM alert. There’s no DLP entry. There’s no audit log labelled “AI accessed customer data”. From the network’s point of view, the developer was just doing her job.
This is the security gap most SMBs haven’t noticed yet — and Cloudflare’s new Mesh product is one of the more practical answers to it.
AI Agents Are “Users That Move Themselves”
IT teams built the security stack on an assumption that’s about to expire. The assumption is that users hesitate. A human reading a CRM record before pasting it somewhere has — somewhere in the second between read and paste — a moment where rules and training and conscience kick in. The DLP, the policy, and the audit log are all calibrated against that moment.
AI agents don’t have it. A coding assistant asked to “check the customer table” doesn’t pause to consider whether the customer table contains regulated data. A sales-side AI helper asked to “summarise this client portfolio” doesn’t reconsider when the portfolio includes financial details. The agent reads, processes, and produces an answer — fast, consistent, untraceable from the perspective of the controls that were designed for human-paced decisions.
The result is a category of data flow that exists, is significant in volume, and is essentially invisible to the controls the businesses paid for. Not because the controls are broken — because the controls weren’t designed for users that don’t hesitate.
Three Scenarios Businesses Haven’t Spotted
The pattern shows up in three places consistently across businesses in 2026.
1. The developer using an AI coding tool against staging
A software company runs a tidy stack: production data is gated, but staging is seeded with anonymised snapshots that, in practice, still include enough real identifiers to be useful for testing. The developer connects Cursor or Claude Code to her local environment so she can write database queries by describing them in English.
Each prompt sends the table schema, the relevant rows, and her natural language description to the AI provider. None of that traffic is treated as data exfiltration because it isn’t — it’s a normal API call from a workstation that has legitimate access. But the data has left the company’s network, sat in a third party’s logs, and may have been used for model improvement depending on the contract — none of which appears in the company’s audit chain.
2. The sales person using an AI assistant on the customer list
An insurance broker exports a list of clients into Excel to clean it up before a campaign. He asks ChatGPT Plus to deduplicate, categorise by product, and draft personalised follow-up emails. The list contains policy numbers, partial card details, and notes on prior conversations.
The work is good — better and faster than doing it by hand. But the entire customer dataset now exists in a chat history, accessible to whoever has the broker’s account credentials, retained according to the AI provider’s policy rather than the broker’s. This is exactly the kind of movement that, under Australia’s notifiable data breach expectations, would matter — except the company has no way to know it happened.
3. The IT manager using an AI assistant to troubleshoot
A Brisbane logistics company’s IT manager is debugging a recurring database performance issue. He pastes the error log into an AI assistant, then asks it to suggest commands to try. The assistant suggests several. One of them is destructive in production but harmless in development; the assistant has no way to tell the difference. The IT manager, tired and trusting the chain of reasoning, runs it.
The system recovers but takes longer than expected to fully reconcile. There’s no record of why; the AI session lives in the IT manager’s browser. The next quarter’s audit asks who authorised the operation. The answer is technically nobody.
Why VPN Can’t See This Problem
The traditional security architecture handles network access as a perimeter problem. A VPN authenticates the user, the user gets onto the network, and from that point onward the assumption is that traffic from the user’s device is the user. Endpoint protection watches the device, DLP watches the data, network monitoring watches the flows.
What none of those tools is designed to do is distinguish between the user typing and the AI agent invoked through the user’s session. From the network’s perspective, the AI tool is just an HTTP request from an authenticated endpoint. The VPN granted access at the door; what happens inside is the application’s problem, not the network’s.
This isn’t a fault in the VPN. It’s a category problem. The model the VPN was built for — humans accessing internal resources, with controls applied at the application layer — doesn’t fit a world where the human’s session is also being used by software that operates faster, broader, and with no judgement of its own.
How Cloudflare Mesh + Zero Trust Close the Gap
Cloudflare Mesh — announced in April 2026 — is a private networking layer that runs on top of Cloudflare One. The way it changes the AI agent problem isn’t by being a clever AI detection tool; it’s by changing what “being on the network” means.
Three design ideas matter for SMBs.
Identity is granular and inherited. Every device, user, and headless node on the network is its own principal. When traffic flows, every request can be authenticated and policy-checked against that principal — not against the perimeter. AI tooling running through a developer workstation doesn’t automatically inherit the developer’s full trust budget.
AI agents can be given their own identity. Rather than running as the developer, the AI coding tool can be granted its own narrowly-scoped identity with explicit, auditable access to specific staging resources and nothing else. The agent gets enough access to do its job; the company gets a record of what the agent did.
Policies live at request granularity, not session granularity. Cloudflare One’s Gateway, DLP, and CASB policies — already running for organisations using the platform — apply per request. Combined with Mesh’s network model, this means an unusual data access pattern by an AI agent can be policy-blocked at the moment it happens, not flagged in next quarter’s report.
For the architectural background, our existing Zero Trust security guide covers the framework Cloudflare Mesh implements.
Three Things SMBs Should Do Now
The practical sequence for an SMB IT team starting from a standard VPN-and-endpoint setup is short.
First, inventory the AI tools actually in use. Not the approved list — the actual list, including the Cursor session a developer added last month and the ChatGPT Plus account a sales lead uses on her own credit card. Cloudflare One’s CASB scans for Shadow IT usage of AI services across the network; user surveys make it visible at the business level. Run both.
Second, decide what data is off-limits to AI. Some data simply shouldn’t be available to a generic AI agent — customer PII, financial detail, identifiable health information. Naming those data zones explicitly is a one-afternoon exercise that most SMBs have never done.
Third, build a controlled architecture. This is where Cloudflare Mesh combined with the broader Cloudflare One stack starts paying back. Granular identity, per-request policy, and inherited Gateway controls give the IT team a path to letting AI tools be productive without giving them the run of the network.
Frequently Asked Questions
Does Cloudflare Mesh replace our existing VPN?
For most SMB use cases, yes. Mesh covers the same employee-to-internal-resource access patterns a VPN handles, with the addition of granular identity and per-request policy. Some organizations keep VPN running in parallel during transition, which Mesh supports.
Can a small business actually use Mesh for free, or is the free tier a trap?
The free tier includes 50 nodes and 50 users per Cloudflare account, which is genuinely usable for a small Australian business with a single office. Paid tiers add scale, advanced DLP, Browser Isolation, and the higher-volume Gateway processing most mid-market organisations need.
Does it work with our Microsoft 365 and Azure environment?
Yes. Mesh integrates as a network layer underneath the identity providers and cloud platforms most Australian SMBs already run. Microsoft 365 SSO, Entra identity, and Azure connectivity all sit alongside Mesh rather than competing with it.
How is Mesh different from Cloudflare Tunnel — do we need both?
Tunnel is a one-way connection from a specific service out to Cloudflare’s edge — useful for exposing a single internal app to authenticated users. Mesh is bidirectional and many-to-many: devices, servers, and services on the network can reach each other through Cloudflare’s backbone. Most organisations adopt Mesh as the default and keep Tunnel for specific app exposure cases.
Close the AI Agent Gap on Your Network
The AI agent gap is real, growing, and largely invisible in current Australian SMB security architectures. Closing it doesn’t require an AI-specific security tool — it requires rethinking how identity and policy work at the network level. ANP Technology helps SMBs assess where AI agents currently sit in their stack and design a Cloudflare Mesh rollout that closes the gap without disrupting the people doing real work.
Talk to ANP Technology about Cloudflare Mesh for your business →
