# Cloudflare's policy automation platform generated a routing policy that leaked BGP prefixes for 25 minutes; the fixes it lists include automated policy checks in CI/CD, and none is human review

Page: https://flyvolo.ai/en/changes/ev-20260122-devops-engineer-3
Date: 2026-01-22 · Stage: Deployment
Can this record move a task judgement? yes
Occupation: https://flyvolo.ai/en/careers/devops-engineer

## Scope

One company, one edge router in Miami, 25 minutes (20:25-20:50 UTC). What the automation authored is the point: a change pushed through Cloudflare's policy automation platform removed prefix-list references and left a policy term so permissive that it marked every internal prefix as acceptable to advertise. A human reverted it and paused automation on that router. Recorded as deployment rather than constraint because adoption was not suppressed: the remediations Cloudflare lists include adding automatic routing policy evaluation into its CI/CD pipelines and patching the automation itself — a machine checking the machine, and none of them a human gate. It establishes that at one large network operator, engineers make routing policy changes through an automation platform that generates and applies the configuration in production; it does not say what share of that operator's configuration is machine-written, and one incident at one provider is not a measure of the industry.

## Source

- Cloudflare — Route leak incident on January 22, 2026 (Bryton Herdes, Tom Strickx) — https://blog.cloudflare.com/route-leak-incident-january-22-2026/ (primary source)

## What this means

At one large network operator, routing policy changes reach production routers through an automation platform that generates and applies the configuration, rather than being typed onto each router by an engineer. The disclosure comes from the company itself, in its account of what happened when that platform wrote something wrong.

## What it does not show yet

It does not say how much of this operator's configuration is machine-written, and it is one incident at one provider. It also does not show the failure pushing the work back to people: the remediations Cloudflare names include an automated check inside the pipeline and none is a human review step, and the human action in its own timeline is the revert.

## How to verify it yourself

Look at your last ten infrastructure changes and count how many were authored by a person rather than produced by a template, a pipeline or a tool. That ratio, not an industry average, is what your own job currently looks like.


More: https://flyvolo.ai/llms.txt