Intel / blog

We tested our own WAF with frontier AI models. Here’s what we found

Source: blog.cloudflare.com
Date: Published Sep 29, 2026

From the Daily Brief

The method is black-box and reusable. Cloudflare's tester begins with a known exploit, sends it, reads only the HTTP response, and has frontier models vary the encoding and delivery until a variant gets through or the attempts run out. Promising leads go to human reviewers rather than being treated as confirmed bypasses.

The design mirrors how an AI-assisted attacker would probe a defense: no source access, just rapid iteration against observed responses. Any team running its own WAF rules can adopt the same loop to red-team them before an attacker does.

Cloudflare paired the post with Threat Signals, agentic skills that summarize threat reports, extract indicators of compromise and tag them into a private dataset, and it opened its Threat Events Platform to every account for free. The common thread is using models to turn unstructured security material into something a WAF can act on.

Read the 2026-09-30 Brief →

Context

Cloudflare used AI to vary known attack requests, then relied on engineers to decide which apparent firewall bypasses mattered. Its test report describes 1,107 attempts against one authorized staging environment. After removing malformed, benign, duplicate and out-of-scope observations, engineers were left with 49 findings for investigation, 48 involving command injection or server-side request forgery. These were leads about the web application firewall, not proof that an application had been exploited. Replaying and validating the findings contributed to new and updated detections. The useful result was a set of reproducible gaps for remediation, rather than a success rate calculated from every model-generated attempt.

Key takeaways · AI-distilled

The loop makes two model calls per step: a proposal call suggests the next payload variation and a review call reads the response status, selected headers and body. Neither sees rule expressions, rule IDs or attack score details.
Models never send requests themselves: Python code checks the target hostname against an , disables redirects, logs each attempt and enforces the attempt limit, and treats response text as untrusted input.
Of 1,107 attempts across 45 scenarios, 558 were blocked and 49 findings survived human review, 48 of them in command injection and SSRF. Cloudflare says XSS, LFI, SQLi and Log4j had near full coverage.
One SSRF lead came from writing a cloud metadata IP with a trailing dot, which drew a redirect instead of a block. Findings led to new SSRF - Obfuscated Host and SSRF - Restricted Protocol detections and an improved SSRF - Cloud rule.
Cloudflare found longer runs gave diminishing returns: scenarios repeated ideas near the 25-attempt limit, so coverage came from more starting requests, categories and input locations. Two versions of one model family varied but hit the same issues.

Terms in this piece · Glossary

LLM — A large language model — the neural network behind tools like Claude and ChatGPT, trained on huge amounts of text to predict what comes next.
tool permissions — The rules governing which tools an agent may call and which need confirmation — the boundary between a mistake and an incident.

Read the source blog.cloudflare.com