Cloudflare's 68% cheaper AI reviewer still needs quality-adjusted cost controls
Cloudflare cut automated code-review cost from $2.43 to $0.77 by fixing caching, tool scope and repeated work. Engineering teams should optimise cost per validated review, not token prices.
Cloudflare reported on 19 October 2026 that it reduced the average cost of its AI code-review system from $2.43 to $0.77 per review, a 68% drop, while median turnaround fell from 4 minutes 9 seconds to 1 minute 32 seconds. The achievement was not a cheaper foundation model alone. It came from changing how the reviewer assembled context, selected models and delegated work. The operational lesson is that cost per token is a poor proxy for cost per accepted security review.
Cloudflare's reviewer uses a coordinator and specialist agents to inspect merge requests at different risk tiers. Its internal numbers show that the number of tokens per review had more than tripled, even as cache hit rates improved. By September, cache reads accounted for 34% of spend and writes another 43%. A high cache-hit percentage concealed an increasingly expensive conversation loop.
A stable prompt must actually remain stable
The first LLM request in each review initially hit a shared cache only 14% to 26% of the time. Cloudflare traced this to a prompt block that mixed a common agent instruction with repository-specific paths and dates before the cache breakpoint. Splitting the stable prefix into a separate cacheable block raised the first-request hit rate to 91%–99.5%.
This is a testable design choice, not a universal caching recipe. Capture cache-write and cache-read tokens separately, fingerprint stable instructions, and flag volatile metadata that lands inside a supposedly reusable prefix. Recalculate savings whenever tool definitions, provider prices or retention settings change.
An AI review pipeline can achieve excellent cache hit rates while becoming more expensive with every extra model turn.
Unused tools and duplicate work have a direct bill
Cloudflare found that specialist reviewers repeatedly attempted a tool they were not authorised to call; the rejected operation cost another reasoning turn. Removing that tool also shortened every prompt by roughly 2,900 tokens. The team reduced redundant file-reading calls and avoided rerunning unchanged specialist checks on repeat reviews. These changes attack orchestration overhead rather than model reasoning quality.
Security teams should inventory which tools each reviewer actually needs. Instrument denied tool calls, repeated file reads, unnecessary follow-up turns and re-review duplication. Route high-risk changes to deeper review only when an explicit risk rule justifies the extra cost.
Keep a quality gate beside the savings chart
Cloudflare also changed its execution framework, comparing the previous and replacement systems in shadow mode and reporting 98% agreement on approval decisions before the switch. Agreement is a useful regression signal, but shared mistakes can still produce matching approvals. Track independently labelled security findings, missed defects and false positives alongside review expense and latency.
The reported 68% reduction is Cloudflare's workload-specific result, not a promised saving for every engineering organisation. A sensible rollout measures cost per accepted, validated review and sets a rollback threshold if defect detection degrades. Optimising the agent loop is successful only when lower spend preserves the review's purpose.
Produced through Devence Lab's automated research and publishing workflow, without prepublication human review. Devence Lab retains editorial responsibility. Sources are linked; report factual errors to contact@devencelab.com.
Sources
Written by the Devence Lab research team.
