Cloudflare cuts its AI code review cost 68%, to $0.77, mostly by fixing prompt caching

Cloudflare says it cut the average cost of an AI code review on its internal merge requests by 68%, from $2.43 to $0.77, in about a month, and that the median review now finishes in 1 minute 32 seconds instead of 4 minutes 9 seconds. In a post published on 19 October 2026, engineer Ryan Skidmore explains where the money was going and which changes mattered. The finding most teams running AI agents can reuse: the first request of each session was almost never reading from the prompt cache, even though 11,000 to 21,000 tokens of it were identical in every repository.

Key points

• Cloudflare's average AI review cost rose from $1.19 (its April figure) to about $2.46 by the end of August, then fell to $0.77 with code quality at high effort, a 68% drop from the $2.43 average of its two most expensive weeks.
• About 40% of the saving came from changes to the reviewer's code and the rest from model and effort choices; the post puts code changes at $0.65 of the $1.67 drop and model and effort changes at $1.06.
• Before the fix, a session's first request found a cached prefix only 14% to 26% of the time; splitting the system prompt so the shared part had its own cache breakpoint on 16 September took the cost per review from $2.47 to $2.02.
• Moving every Sonnet reviewer to Sonnet 5.5 cut cost per run by 62% (code quality), 58% (performance) and 47% (security) over a two-and-a-half-day split test, because it used fewer tokens at the same per-token price.
• Cloudflare reports that authors acted on 59% of the code quality reviewer's serious findings, up from 34%, while "important" findings per review went from 0.28 to 0.30; it flags that its samples are small.

What happened

Cloudflare runs an AI code reviewer inside its CI pipeline. When an engineer opens a merge request, a coordinator agent launches specialist reviewers (security, performance, code quality, documentation and others), merges their findings and posts one comment. The system runs on OpenCode, an open-source coding agent. Cloudflare described it in April 2026, when it said an average review cost $1.19.

By the end of August that figure had climbed to roughly $2.46, although, the company says, the architecture had not changed. Around mid-September it asked its agents to find where the tokens were going and cut them. The result, per the 19 October post, is an average review of $0.77 with code quality running at high effort, compared with $2.43 over the two most expensive weeks before the work began. The median review time fell from 4m 09s to 1m 32s. Cloudflare says speed was not the goal, but fewer model calls means less waiting.

The post separates the saving into two parts. Changes to the reviewer's code account for $0.65 of the $1.67 reduction. Experiments with which models to use and how hard they "think" account for $1.06.

Background

Cloudflare's April post, "Orchestrating AI Code Review at scale", reported 131,246 review runs across 48,095 merge requests in 5,169 repositories between 10 March and 9 April 2026, with a median review time of 3m 39s and an average cost of $1.19. Reviews were tiered by risk: trivial changes (up to 10 lines) got two agents, "lite" changes (up to 100 lines) four, and "full" reviews more than seven. At that time the top-tier models were reserved for the coordinator, standard-tier models for the security, code quality and performance reviewers, and Kimi K2.5 for documentation-type reviewers.

The October post explains the drift upward. Cost per review rose from $1.22 in March to $1.44 in June, $1.74 in July and $2.32 in August. More reviews landed in the most expensive tier (59% in March, 65% in August), which Cloudflare attributes to engineers producing bigger changes. But most of the increase came from model changes. At the start of August every reviewer moved onto Anthropic models, which raised cost per job from $1.38 to $2.03. The company says its evaluations showed those models performed better on this workload. One reviewer, the internal standards checker, moved to Claude Opus 4.7 and went from about $0.25 to $0.88 per review, more than the coordinator itself.

Token volume grew as well. Tokens per review more than tripled, from 0.91 million in April to 2.99 million by September, while the cache hit rate rose from 85.7% to 97%. High hit rates on three times as many tokens still add up.

How it works

Before the optimisation, Cloudflare says spend split into output tokens (about 23%), cache writes (43%) and cache reads (34%). Most of the money was going on context the model had already seen or was about to see again. The code quality reviewer made 16.6 model calls per review on average, writing 72,000 tokens to the cache and reading back 1.08 million, because each call resends the whole conversation.

Anthropic's documentation explains the mechanics Cloudflare relies on. Caching works on prefixes: the prompt is read in the order tools, system prompt, then messages, up to a block marked with a cache breakpoint. Cache writes cost 1.25 times the base input price for the default five-minute lifetime and reads cost 0.1 times (the documentation lists lower read multipliers for some newer models). And "a cache entry only becomes available after the first response begins", so parallel requests that need a hit have to wait for the first one.

Cloudflare then logged the token usage of every reviewer's first call from 14 September, plus a hash of the first system block. The first request found a cached prefix only 14% to 26% of the time. The cause was OpenCode v1's prompt layout: one block holding the agent prompt followed by an environment section (working directory and date), with the only breakpoint at the end. The shared part was never stored on its own, so a review in one repository could not reuse what another had written.

The fix, deployed on 16 September, added a marker at the end of every agent prompt and a plugin hook that split the block there, giving the shared half its own breakpoint. Anything repository-specific was removed from in front of it, which meant disabling the skills list and freezing tool descriptions. The same day Cloudflare moved the standards reviewer's reference index into its prompt, cutting that reviewer's calls from 15.9 to 9.6 and its cost per run from $1.12 to $0.72. Together the changes took the cost per review from $2.47 to $2.02.

Further changes on 21 and 23 September together took about $0.20 off each review:

• Sub-reviewers could see the tool that posts the final comment; in 57% to 76% of sessions they tried to call it and were rejected, wasting a call.
• In 64% of the code quality reviewer's turns the model made exactly one tool call, usually reading one file. Reviewers now read shared context and all their patches in the first response, up to 150 KB.
• On full-tier re-reviews (about two-thirds of jobs are second or later reviews), the AGENTS.md reviewer is skipped 56% of the time, performance 23% and documentation 13%.
• Stopping after the review is posted, instead of one more model turn to write an unseen summary, saves about $0.07 per job.

The largest structural change is a shared prefix across three reviewers. Code quality, security and performance now send identical first requests (the same tools, a shared rules file, then the merge request with every patch) and add their own instructions afterwards. Because the three start at once, the second and third wait up to 20 seconds for the first one's response to begin, so one writes the cache and two read it. That saves about nine cents per reviewer.

The numbers

Mar1.22

Jun1.44

Jul1.74

Aug2.32

Now0.77

Average cost of one AI code review at Cloudflare (US$)

	US$
Mar	1.22
Jun	1.44
Jul	1.74
Aug	2.32
Now	0.77

Source: Cloudflare, "Cutting our inference bill by 68% by being obsessive about optimization" (19 Oct 2026); "Now" is the post's figure with code quality at high effort

The model changes were the bigger lever. On 3 October Cloudflare split every Sonnet reviewer between Sonnet 5 and Sonnet 5.5. After two and a half days Sonnet 5.5 was cheaper per run in all three reviewers, and since both models cost the same per token the whole gap came from fewer tokens.

Code quality62

Performance58

Security47

Cost per run saved by Sonnet 5.5 versus Sonnet 5 (%)

	%
Code quality	62
Performance	58
Security	47

Source: Cloudflare, 19 Oct 2026 (two-and-a-half-day 50/50 split from 3 Oct)

On Sonnet 5.5 at medium effort the code quality reviewer makes 1.7 model calls per run instead of 6.2, and more than half its runs finish in one call. At high effort it makes 3.4. In a 50/50 split from 5 October, high effort cost 61% more per run than medium but posted 58% more critical and warning findings, about two cents per review, so Cloudflare moved code quality to high. Opus 5.5 at medium effort showed no measurable change in outcomes against Opus 5, and Opus 5.5 at high cost more without a meaningful rise in findings.

What it means

For teams running agents at volume, the post's practical lesson is to inspect what actually reaches the provider. Cloudflare found its biggest single saving by checking whether each session's first request read from the cache, rather than assuming it did. A prompt that mixes shared instructions with per-repository details such as the date or working directory defeats prefix caching, because the cache can only be reused up to the first byte that differs. Putting stable content first, and giving it its own breakpoint, is the general pattern.

The second lesson is that a newer model at the same per-token price can be much cheaper because it uses fewer calls and tokens. The reverse also applies: Cloudflare's costs rose when it moved to more capable models that did more work per review.

Third, cheaper is not automatically better, and Cloudflare is careful about that. With code quality at high effort, the reviewer posts 40% fewer critical and warning findings than in late August. Security and performance, which stay at medium effort, post 56% and 71% fewer. The company checked two ways. Authors changed the flagged lines 59% of the time against 34% before (a baseline of about 15% of nearby lines changing by coincidence), so findings that led to a change per 1,000 reviews were about the same, 132 against 145. And two models from different providers judged a blinded sample of 657 findings: important findings per review went from 0.28 to 0.30, while those rated more severe than deserved dropped from 0.46 to 0.14 per review, a 70% fall.

The picture is not uniformly good. Judges found about 64% fewer important performance issues per review, roughly one fewer important finding every 24 full-tier reviews, and security fell by about a quarter, a result that is not statistically significant. Medium effort on code quality produced roughly a quarter as many acted-on findings as high.

What we don't know yet

• The figures are Cloudflare's own and cover one internal workload; other pipelines may see different results.
• The company says the step-by-step savings are not a controlled experiment: each step compares weekday hours before and after a change.
• The samples behind the quality checks are small (35 to 66 findings per group), and the "now" window was a single day. Cloudflare says the judging models are models too, and that an author changing flagged lines does not prove a finding was right.
• Whether performance and security reviewers regain their lost findings at high effort is untested; Cloudflare lists it as the next experiment.
• The post is dated 19 October 2026; later changes are not covered.

What to watch next

Cloudflare says it is testing other ways to run the reviewer, including entirely on Durable Objects using a library called pi-durable, and that more is coming. The author was due to speak about building the reviewer at Cloudflare Connect in San Francisco on 20 October. Watch for the high-effort results on security and performance, and for whether other teams report the same cache-hit problem in their own agent harnesses.

Sources

• Cloudflare: Cutting our inference bill by 68% by being obsessive about optimization (primary, 19 October 2026)
• Cloudflare: Orchestrating AI Code Review at scale (20 April 2026)
• Anthropic documentation: Prompt caching