Last week, auditing my Cloudflare API tokens, I found one I never created: “Cloudflare Agent Token - 2026-04-28”, created by the dashboard’s AI assistant (“Ask AI”).

Cloudflare’s tooltip says it exists so the AI can “understand your environment and take actions on your behalf.”

Its actual grant, from the token’s own summary page: read access scoped to All accounts, All zones, and All users — more than 160 permissions. Every one is :Read: it cannot change anything. But “read-only” undersells it. The list includes Secrets Store:Read, Access: Keys:Read, Access: Service Tokens:Read, Zero Trust: PII:Read, Logs:Read, Account Audit Logs:Read, Billing:Read, API Tokens:Read, and every DNS, Access and identity-provider config you have.

It also has no expiry date.

A leaked token like this isn’t “an attacker reconfigures your infrastructure.” It’s total reconnaissance and data exfiltration: your security posture, your logs, your PII, your org and user structure — readable in one pass. For most teams that is a reportable breach by itself.

I used the “Ask AI” feature. That minted a standing, account-wide read credential that sat in my account for three weeks before I happened to notice it — and, never expiring, would otherwise have stayed valid forever. I was never meaningfully told that asking a question would do this, and “Ask AI” does not signal “provision a permanent agent that can read everything I have.”

An assistant answering a question needs read access scoped to that question, for that conversation. A permanent credential that reads your whole estate is a different thing, and must be a deliberate, informed, visible opt-in.

Check yours: dash.cloudflare.com/profile/api-tokens. If you see “Cloudflare Agent Token” and don’t use the agent, revoke it.

Yes: read-only, first-party, revocable. But it never expires, and it was never surfaced to me — so “revocable” means nothing unless you already know to go looking. None of that makes standing, permanent read access to your secrets, logs and PII proportionate to “I asked a chatbot a question.”