AI bot management system configuration error triggers global Cloudflare outage
A configuration error in Cloudflare's AI-powered Bot Management system caused a global outage on 18 November 2025, affecting millions of users and major websites including Twitter, ChatGPT, and Spotify. The error resulted from a database permissions change that caused the system's configuration file to double in size, exceeding limits in the core proxy software and triggering cascading network failures.
What happened
On 18 November 2025 at 11:20 UTC, Cloudflare's network began experiencing significant failures across core traffic. A routine change to database system permissions within a ClickHouse cluster caused the database query that generates the Bot Management system's configuration file to output multiple, duplicate entries.
The configuration file more than doubled in size, exceeding a hardcoded size limit within the core proxy software that reads and deploys it across Cloudflare's global network. When the software tried to load the oversized file, it experienced a crash, leading to cascading failures. Core traffic was largely flowing normally by 14:30 UTC, with all systems functioning normally by 17:06 UTC.
Reported impact
Millions of users worldwide were unable to access numerous major websites and applications relying on Cloudflare for content delivery, security, and DNS services. Affected services included the Content Delivery Network, Web Application Firewall, Cloudflare Access, and the customer dashboard.
Popular services that experienced outages or significant degradation included X (formerly Twitter), ChatGPT, Canva, Spotify, Uber, Zoom, and DownDetector. The incident caused massive economic disruption estimated at indirect losses in the hundreds of millions of dollars for affected businesses.
Index analysis
The outage was not caused by a cyberattack but by an internal engineering failure. The file generated by the AI system's machine learning model for bot scoring doubled in size due to duplicate entries, exceeding the storage limit of the software that deploys it.
The incident highlights latent risks as AI-driven security and traffic management systems become more complex and integral: a single automated configuration error propagated globally and crippled core internet functions. Cloudflare acknowledged a lack of sufficient automated validation and boundary-checking for critical internal configuration files.
Governance controls
Cloudflare was transparent in its post-incident report, detailing the root cause and specific technical steps that led to the failure. The company noted that even internal data ingestion needs the same scrutiny as external data sources, pointing to the need for improved automated validation and boundary-checking of critical configuration files.
Classification
Sources and evidence
This record was researched and written by the Index, based on the following original reporting.