- Published on
Cloudflare Uses an AI Harness to Probe and Harden Its WAF
- Authors
- Name
- DeepHorus
Cloudflare has placed frontier AI models inside a controlled testing harness to probe its Web Application Firewall (WAF), using previously blocked attacks as starting points for generating and refining new variations. Across 45 scenarios, the system produced 1,107 mutation attempts and yielded 49 findings after human triage. Those results ultimately contributed to three changes in Cloudflare's Managed Ruleset.
The experiment began with attack payloads the WAF had already blocked. Instead of replaying fixed test cases, model calls proposed changes to encoding, placement, or delivery based on responses from earlier attempts. Crucially, the models had no access to Cloudflare's WAF rules, source code, or internal security signals, making the test effectively black-box from their perspective.
A Python harness handled what Cloudflare did not want to delegate to models. It constructed and replayed HTTP requests, maintained scenario state, enforced limits, and collected responses. One model call proposed the next mutation while another reviewed the resulting response, allowing adaptation without giving models direct control over execution.
An SSRF test illustrated the feedback loop. A tester repeatedly altered the representation of a cloud metadata address, trying decimal, octal, and other forms. After a decimal-form request was blocked, the model switched to a trailing-dot representation, which returned a redirect rather than a WAF block. Cloudflare preserved that result for investigation rather than treating it as a successful attack.
Of the 1,107 attempts, 607 produced the post-triage set: 558 requests blocked by the WAF and 49 findings relevant for remediation. Forty-eight of the 49 involved command injection or server-side request forgery. Human reviewers verified reachability, maliciousness, and reproducibility before cases moved forward.
The work yielded two new detections - SSRF - Obfuscated Host and SSRF - Restricted Protocol - plus an improvement to the existing SSRF - Cloud rule. Similar harness patterns appear at Google Mandiant, OpenAI's Codex Security, and Google's PageBreak, all of which validate AI-generated findings before human review.
Across these systems, the common thread is the harness: constraining execution, preserving state, validating findings, and converting probabilistic exploration into evidence existing security workflows can use.
