Cloudflare hardens its WAF after AI-driven stress tests

The tests turned up a small set of actionable flaws, prompting new detections and a rule update in Cloudflare’s Managed Ruleset.

Cloudflare used frontier AI models inside a controlled harness to stress-test its Web Application Firewall, and the exercise led to three updates in its Managed Ruleset. The run covered 45 scenarios and 1,107 mutation attempts, with human review narrowing the output to 49 findings; 48 of those involved command injection or server-side request forgery. The models worked without access to Cloudflare’s WAF rules, source code, or internal security signals, while a Python harness handled request replay, scenario state, limits, and response collection. Cloudflare says the work added two new detections, SSRF - Obfuscated Host and SSRF - Restricted Protocol, plus an improvement to the existing SSRF - Cloud rule.