Cloudflare Harnesses Frontier AI to Uncover WAF Weaknesses

Cloudflare has deployed frontier AI models inside a structured testing framework to systematically challenge its Web Application Firewall (WAF). Rather than running static test suites, the models iteratively generated and refined attack variations, discovering vulnerabilities that contributed to three improvements in Cloudflare's security ruleset.

How the Testing Framework Works#

The approach centers on a Python harness that manages the interaction between models and the target system. The harness constructs HTTP requests, maintains state across test scenarios, enforces execution limits, and collects responses—handling all the parts Cloudflare wanted to keep under direct control. This separation allowed the AI to explore attack mutations without direct access to WAF internals.

The workflow operates as a feedback loop: one model call proposes a mutation to an existing attack payload, a second model reviews the response, and the findings feed into the next attempt. By this design, models never accessed Cloudflare's WAF rules, source code, or internal security signals, making their exploration genuinely black-box.

Results from 45 Test Scenarios#

Across 45 scenarios, the system generated 1,107 mutation attempts. After human review filtered out invalid or unactionable findings, 49 issues remained worth investigating. The majority—48 of them—involved either command injection or Server-Side Request Forgery (SSRF) attacks.

One concrete example shows the method's value. In an SSRF test, the model repeatedly changed how it represented a cloud metadata address: trying decimal, octal, and other encodings. When a decimal form was blocked, the model switched to a trailing-dot representation in the next attempt, which bypassed the WAF block and triggered a redirect instead. Rather than counting this as a successful attack, Cloudflare preserved the result for deeper investigation.

Security Outcomes and Human Validation#

Human reviewers applied strict criteria to distinguish signal from noise: they verified that requests actually reached their target, remained genuinely malicious, clearly evaded WAF protection, fell within the firewall's scope, and could be safely reproduced. This final gate ensured only solid findings reached the ruleset engineering team.

The exercise yielded three concrete improvements to Cloudflare's Managed Ruleset: two new detection rules for obfuscated SSRF variants and an enhancement to the existing cloud-metadata rule.