Cloudflare's "Ask AI" created an API token with read access to my entire account | frr.devLast week, auditing my Cloudflare API tokens, I found one I never created: “Cloudflare Agent Token - 2026-04-28” , created by the dashboard’s AI assistant (“Ask AI”).<br>Cloudflare’s tooltip says it exists so the AI can “understand your environment and take actions on your behalf.”<br>Its actual grant, from the token’s own summary page: read access scoped to All accounts , All zones , and All users — more than 160 permissions. Every one is :Read: it cannot change anything. But “read-only” undersells it. The list includes Secrets Store:Read, Access: Keys:Read, Access: Service Tokens:Read, Zero Trust: PII:Read, Logs:Read, Account Audit Logs:Read, Billing:Read, API Tokens:Read, and every DNS, Access and identity-provider config you have.<br>It also has no expiry date .<br>A leaked token like this isn’t “an attacker reconfigures your infrastructure.” It’s total reconnaissance and data exfiltration : your security posture, your logs, your PII, your org and user structure — readable in one pass. For most teams that is a reportable breach by itself.<br>I used the “Ask AI” feature. That minted a standing, account-wide read credential that sat in my account for three weeks before I happened to notice it — and, never expiring, would otherwise have stayed valid forever. I was never meaningfully told that asking a question would do this, and “Ask AI” does not signal “provision a permanent agent that can read everything I have.”<br>An assistant answering a question needs read access scoped to that question, for that conversation. A permanent credential that reads your whole estate is a different thing, and must be a deliberate, informed, visible opt-in.<br>Check yours: dash.cloudflare.com/profile/api-tokens . If you see “Cloudflare Agent Token” and don’t use the agent, revoke it.<br>Yes: read-only, first-party, revocable. But it never expires, and it was never surfaced to me — so “revocable” means nothing unless you already know to go looking. None of that makes standing, permanent read access to your secrets, logs and PII proportionate to “I asked a chatbot a question.”