Data as of 2026-09-14. All prices are closing prices. The Q3 print on October 29 is a pending event; we will update the readings against the verification calendar at the end of this note when it lands.
On September 9, in a down session for the broad market, Cloudflare (NET) closed up 10.51% at $314.18. The company put out no announcement that day. The move came from two slightly earlier pieces of news compounding in sentiment: late on September 8, Meta launched Muse, a personal AI assistant, announced by CEO Mark Zuckerberg himself, and the market read edge infrastructure that carries agent traffic as an incidental beneficiary. Before that, on September 3, Cloudflare announced a vulnerability discovery and remediation service inside Managed Defense built on OpenAI's Daybreak models (including GPT-5.6 Cyber), currently in early access. The stock gave back part of the move over the following two sessions, closing at $306.53 on September 11, for a market capitalisation of roughly $109.1B and a cumulative 2026 market-cap gain of 57.98% (third-party market-cap series, as of September 11).
Our core view: the business acceleration is hard. Q2 revenue of $696.1M (+36% year over year, an acceleration from +33.5% in Q1), dollar-based net retention (DBNR) of 120% (+6 percentage points year over year) and 4,698 large customers (+27%) all come from verifiable company disclosure. But neither catalyst behind September's rally carries a price tag. The OpenAI partnership discloses no financial terms; Muse is Meta's own product, and there is no disclosed basis for how much money Cloudflare collects from it. The market is paying for an option on being the "agentic internet toll booth," and the next reconciliation window for that option is the Q3 print on October 29.
What Q2 Was Really Worth: Acceleration, Retention and Breadth Moving Together
The Q2 FY26 results released after the close on August 6 (fiscal quarter ended 2026-06-30) are worth taking apart line by line. Revenue was $696.1M, +36% year over year, an acceleration of roughly 2.4 percentage points from Q1's $639.8M (+33.5%); first-half revenue totalled $1,335.8M, +34.7% year over year. Within the geographic mix, US growth ran at +40.7%, faster than the total, and the US share of revenue rose to 51% (10-Q basis), with AI-related demand concentrating in large US enterprises.
Retention was the most underrated reading of the quarter. DBNR came in at 120%, up 2 percentage points sequentially and 6 points year over year; the eight-quarter series runs 110/111/111/114/119/120/118/120 (company investor presentation), a steady climb off the late-2024 trough. For a company billing largely on usage, faster expansion within the installed base arrived at the same time as new-customer growth: more than 80,000 net new paying customers in the quarter, with total paying customers +74% year over year; large customers with more than $100K in annualised revenue reached 4,698 (+27%), a net addition of 986 over twelve months, and management said net additions set records in every cohort from $100K up through $5M-plus. On the developer side, the platform has surpassed 7.4M cumulative developers, with nearly 2M net adds in the quarter — more than the 1.5M added across all of 2025.
One piece of management language belongs in the record on its own: on the call, the CEO said that for the first time in the company's history, more than 50% of traffic on the network came from non-human, agentic sources. The statement carries no revenue implication — billing model and conversion rate sit between traffic share and dollars collected — but it is the closest thing to a data anchor the "machine-to-machine internet" narrative currently has. We consider directional validation complete: three hard metrics corroborate one another and are difficult to inflate. Magnitude delivery is a separate matter, and we return to it below.
There is also a tension buried in the guidance. Q3 guidance of $736.0-737.0M implies roughly +30-32% year-over-year growth against the prior-year base, below Q2's actual +36%; meanwhile Q2's actual landed about 4.7% above the pre-print consensus (roughly $665M, MarketBeat/tickerleague aggregate), and the Q3 guide itself sits above the roughly $721M analysts expected before the print. Conservative guidance is standard practice for software companies, but that implied deceleration line is itself the first reference point for reading the October print: landing inside the range only counts as meeting the bar; landing above it again, with growth holding the 35% line, is what it takes to reach the post-September price.
September's Twin Catalysts: Both Real, Neither with a Dollar Figure
Rank the two catalysts by evidentiary grade. The September 3 OpenAI partnership is Cloudflare's own product launch: a vulnerability discovery and remediation service inside Managed Defense that uses OpenAI's Daybreak models to analyse customer-authorised code repositories and, combined with real-time network-wide traffic intelligence, generates firewall rules and code patches. The product is verifiable, but the announcement attaches no financial terms; revenue contribution starts from zero with no disclosed basis. The September 8 Meta Muse event is entirely third-party: Muse is Meta's consumer-facing personal agent, executing tasks on the user's behalf in an isolated environment. Cloudflare's existing links to Meta are the deployment of Llama models on the Workers AI platform beginning in 2025, plus the company's recently launched Wallet product for agent transactions. Whether — and at what scale — Muse uses Cloudflare infrastructure has not been disclosed by either party.
The commercial mechanism needs to be read in two layers. The passive layer is traffic pass-through: agent-initiated requests traverse Cloudflare's network and the company charges for traffic and security services. Benefit here is certain but unit pricing is transparent, competitors are substitutable, and the ceiling is toll-booth logic. The active layer is the Workers developer platform: edge inference, R2 object storage, vector search and AI Gateway forming a full stack, plus the recently launched Wallet for agent transactions, aimed at getting developers to actively run their agents on Cloudflare at a unit value far above a toll. Nearly 2M net new developers in a single quarter is the progress bar for the active layer, and September's OpenAI security service and the Muse association both sit on that same line of extension. But the active layer still has no standalone revenue disclosure, and the revenue split between the two layers cannot be verified externally.
Put differently, the 10.51% single-day re-rating on September 9 bought an inference — that once agent traffic scales, Cloudflare is most likely somewhere on the billing path — not any contract with a price on it. We lean toward thinking the inference is directionally sound; the 50% non-human traffic share and 986 net new large customers support it. But the gap between inference and disclosure means this rally has raised the bar the Q3 print has to clear: a report that merely meets the bar supports August's price, not September's.
The AI-First Reorganisation: A Hard Commitment at the Org Layer, a Cost at the GAAP Layer
On May 7 the company announced a restructuring plan, described in the 10-Q as intended to "accelerate the evolution toward an agentic AI-first operating model." First-half restructuring charges totalled $150.7M (severance and employee benefits of $121.3M, stock-based compensation of $27.9M and other items), with $98.6M paid in cash in Q2. That spending pushed the Q2 GAAP operating loss out to $205.7M (29.6% of revenue, against a $67.3M loss, or 13.1%, in the prior-year quarter). Excluding one-time items, non-GAAP operating income was $96.1M at a 13.8% margin, broadly flat against 14.1% a year earlier. Free cash flow was $56.4M, +69% year over year, and $140.5M for the first half at a 10.5% margin.
We read the restructuring as a positive signal at the strategy layer: cutting headcount and rebuilding the organisation is a costly, hard commitment, which is not the same evidentiary grade as "AI-first" marketing language. But the disclosure gap has to be recorded alongside it. Workers AI and the entire AI product line still have no standalone revenue disclosure; the agentic language in the 10-Q is concentrated in risk factors and restructuring notes, and the source material contains no AI revenue figure, so we make no estimate here. On the cost side the signal has already appeared: Q2 cost of revenue was $196.5M, +52.7% year over year, faster than revenue growth; GAAP gross margin was 71.8%, down roughly 310 basis points year over year (the company's non-GAAP gross margin was 73.1%, its first sequential improvement in eight quarters). The two gross-margin measures point in different directions — "AI infrastructure spending raising the cost base" versus "stabilisation at the margin" — and both are set out here as they stand.
The Bear Case: Valuation, Dilution, Convertibles, and the Hyperscalers
Start with the valuation arithmetic. Against a September 11 market capitalisation of $109.1B and TTM revenue of $2.51B, PS (TTM) is roughly 43x; third-party forward PE is roughly 207x. That set of multiples sits at the very top of high-growth infrastructure software, and what it implies is not merely that 36% growth persists, but that the agentic option progressively converts into disclosed figures. If Q3 revenue comes in below the $736.0M low end of guidance, or DBNR falls out of the 118-120 band, these multiples have no cushion.
Dilution and the balance sheet need honest bookkeeping. Q2 stock-based compensation was $163.3M, 23.5% of revenue; the company runs no buyback, and the share count rose roughly 1.1% net in the first half. Convertible notes total roughly $3,270M, of which the current portion of $1,293.3M matures within 2026; cash and equivalents on the books stand at $1,663.8M, sufficient coverage, but ammunition for buybacks or sizeable M&A is limited until settlement is complete. There is one offsetting forward signal: current deferred revenue of $812.2M, +18.7% versus year-end 2025, with bookings running ahead of recognition.
Capital intensity caps free cash flow in the near term. First-half purchases of property and equipment were $115.2M, plus $20.2M of capitalised internal-use software, with operating cash flow at 21% of revenue (25% in the prior-year period). An edge network and GPU nodes are heavy assets requiring continuous spending, a cash-conversion structure entirely different from asset-light subscription software; the 10.5% H1 FCF margin should be read against that backdrop rather than benchmarked directly against the 20%-plus of mature SaaS. The geographic revenue mix cuts both ways as well: with the US at 51% of revenue and growing +40.7%, the benefit is concentrated in US enterprise AI budgets, which means the exposure is concentrated in the same budget cycle when it swings back.
The first page of the competitive bear case is the big three clouds. AWS, Azure and GCP are simultaneously competitors in edge and inference workloads and the landlords of the entire agent ecosystem; if the hyperscalers decide to bundle edge inference away, Cloudflare's option premium comes under direct pressure. This is not a first-order variable inside the October adjudication window — hyperscaler edge build-outs move in years — but it should move to the front of the list as the holding period extends. One data gap is self-reported: beginning in 2026 the company no longer lists total paying customers among key business metrics in the 10-Q (per the 10-Q), and the 80,000 net adds and +74% figures cited above come from earnings-call commentary; if the two sources stop being available together in future quarters, continuity will deteriorate.
Verification Calendar
| Date | Event | What to read |
|---|---|---|
| October 29 | Q3 FY26 results | Total revenue against the $736.0M low end of guidance; non-GAAP operating income against the $129.0-130.0M range; whether DBNR holds 118-120; pace of net new large customers; sequential direction of gross margin |
| Same event | AI revenue disclosure | Whether Workers AI or agentic-related revenue is given a dollar-level disclosure for the first time (the confirming switch); whether the 50% non-human traffic share is updated |
| Within 2026 | Convertible note settlement | Progress on settling the $1,293.3M current portion and the change in cash balances (with the balance sheet at each print) |
| Ongoing | Muse and the OpenAI partnership | Whether official channels on either side produce a verifiable announcement carrying financial terms or usage metrics; with only product blogs and no disclosed basis, the option stays unpriced |
To close: Q2's acceleration (+36%), retention (120% DBNR) and breadth (large customers +27%, nearly 2M net new developers in the quarter) form three hard metrics moving in the same direction, and directional validation is complete. September's 10.51% single-day re-rating, by contrast, rests on two catalysts with no price tags, and roughly 43x PS (TTM) raises the bar for magnitude delivery further. That gap gets adjudicated by the Q3 print on October 29: the $736.0M low end, the DBNR band, and whether AI revenue is quantified for the first time — read in that order.
The next observation point is that print. If Meta or Cloudflare provides a verifiable basis for Muse's infrastructure arrangements in the interim, the pricing foundation of the option changes materially and warrants an immediate re-read; if the narrative merely warms up without a disclosed basis landing, save the patience for the print. Whether magnitude gets delivered is settled by the readings on October 29.
This note represents the research views of Lunartulip Lab, based on analysis of publicly available information. It does not constitute investment advice. Markets carry risk; decisions must be made independently.