Cloudflare Uses an AI Harness to Probe and Harden Its WAF

Cloudflare has employed a controlled testing harness that incorporates frontier AI models to probe and strengthen its Web Application Firewall (WAF). The system was fed attack payloads that had previously been blocked by the WAF, and instead of merely replaying fixed test cases, the AI models proposed variations to the encoded, placed, or delivered requests based on previous responses.

The models were given no access to Cloudflare's WAF rules, source code, or internal security data, rendering the test effectively black-boxed from their perspective. A Python harness was responsible for the tasks that Cloudflare did not want to delegate to the AI models, including constructing and replaying HTTP requests, maintaining scenario state, enforcing limits, and collecting responses.

One scenario demonstrated how the feedback loop worked: the model generated multiple mutations of a cloud metadata address, eventually leading to a request blocked by the WAF. Subsequent attempts saw the model retain the same request shape but switch to a trailing-dot representation, resulting in a redirect instead of a WAF block.

Of the 1,107 mutation attempts recorded, 607 produced a post-triage result; 558 were blocked by the WAF and 49 findings were deemed relevant for further remediation work. The majority of these findings pertained to command injection or server-side request forgery (SSRF). Human reviewers then validated these findings, checking for factors like whether the requests had reached the target, remained malicious, were clearly unblocked, fell within the WAF's responsibility, and could be safely reproduced.

The AI harness led to three enhancements in Cloudflare's Managed Ruleset: two new detections (SSRF - Obfuscated Host and SSRF - Restricted Protocol) and an improvement to the existing SSRF - Cloud rule.