When The Agents Take The Keyboard: Inside Cloudflare’s Next.js Rewrite

I’ve spent much of my career as both an analyst and a practitioner advising people against “the big rewrite.” It’s called second-system syndrome for a reason: You usually throw away years of hidden bug fixes and security patches just for the sake of “cleaner” code. But after sitting down with Cloudflare’s Dane Knecht (CTO) and Steve Faulkner (engineering director) to discuss their project vinext, it’s clear that the old rules of technical debt are being rewritten by agentic software development.

Reality Check: The End Of Monkey Patching

For the last 18 months, the Cloudflare community relied on OpenNext to run Next.js on their infrastructure. It worked, but as Dane noted, it wasn’t a first-class experience. “It was a hack, you know, in a sense … where you’re kind of monkey-patching it to try to work in other places.”

In a traditional software development lifecycle, you live with that technical debt because a rewrite is too expensive or impractical. But Cloudflare took a different path. By moving to a completely agentic workflow (where, as Dane put it, “no [human] hands have been on the keyboard”), they rebuilt the framework from first principles.

The result? A codebase that is smaller, faster, and optimized for a world where developer experience sometimes takes a back seat to agent experience (AX).

A New Rhythm: The 3 A.M. Barbell

The world (myself included) has become obsessed with how AI changes the rhythm of work. Steve shared something that should make every engineering leader pause: His workflow has become “barbell-shaped.”

“Either I had very short like 5–10-minute sessions targeted at a problem or these like 5–6-hour-long sessions,” Steve explained. But the real shocker was when he checked his session data: He noticed his peak token usage was often at 3 a.m.

“I am not awake at 3 a.m.,” Steve told me. “I’d just brain-dump … here’s five things to go work on while I’m asleep and, like, see how far it gets.”

This is the shift from “manager” to “dispatcher.” Steve emphasized that he isn’t a “100x engineer” — he’s an engineering manager who has learned to manage agents in parallel while he sleeps.

The “Mirror Problem”: AI Inherits Our Human Challenges

An interesting moment of the project was a security oversight that perfectly illustrates a core challenge with agentic development. During the initial rewrite, the AI agents repeated the exact same security vulnerabilities (CVEs) found in the original Next.js source code.

“AI is more humanlike than you expect in a lot of ways,” Dane observed. “It made the same mistakes that they made when they were writing it originally.”

He noted that this one change to their prompting would have greatly improved the project’s security profile: “Please review all past CVEs on Next.js and ensure that we’re not vulnerable.” It was a lesson in context. While the AI missed vulnerabilities at first because it was mimicking its training data, Dane noted that once they pointed it to the right corpus of information, it “immediately identified them and was able to fix them.” The takeaway for the maturity curve is that agentic outcomes are a reflection of the context you provide. If you don’t explicitly take action to avoid your past mistakes, agents will recreate them with perfect, automated efficiency.

The Maturity Curve: Biased Toward The Merge

Perhaps the most interesting takeaway is Steve’s philosophy on merging code. Many organizations are gun-shy about merging, because fixing production is expensive.

In this case, Cloudflare is doing the opposite. “That’s been our default … we’re kind of, like, biasing toward merging,” Steve said. “We just know that there are bugs. We know there’s gaps. We know there’s stuff that’s got to get fixed. So we’re just trusting that the community comes up with good solutions.”

This works because the cost of an agentic fix is near zero. If a bug is found, an agent triages it, writes the fix, and submits a pull request. Are we reaching a level of maturity where the speed of correction is more valuable than the certainty of the commit?

Prepare For AX

Steve made a comment that will stick with me for a long time: The vinext repository is actually difficult for a human to navigate. “If you’re not interacting with this repo with AI, you’re going to have a bad time,” he warned. “It’s actually really not designed for you. It’s designed for AI-first approaches.”

This is a key part of AX: As we move further up the maturity curve, we must start building environments where agents can thrive.

Much of the chatter in this space is about how AI can make developers more productive. The path to agentic ROI starts with the realization that sunk cost and technical debt mean something different today than it did in the past — especially if you’re brave enough to let the agents take the keyboard.