--- title: Cloudflare Uses an AI Harness to Probe and Harden Its WAF description: Cloudflare built an AI testing harness that places frontier models inside a controlled loop to probe its Web Application Firewall, using previously blocked... canonical: https://daily.dev/posts/cloudflare-uses-an-ai-harness-to-probe-and-harden-its-waf-j0xyvlgxl twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Cloudflare Uses an AI Harness to Probe and Harden Its WAF | daily.dev og:description: Cloudflare built an AI testing harness that places frontier models inside a controlled loop to probe its Web Application Firewall, using previously blocked... og:url: https://daily.dev/posts/cloudflare-uses-an-ai-harness-to-probe-and-harden-its-waf-j0xyvlgxl og:image: https://api.daily.dev/og/posts/J0xyvLGxL.png og:image:alt: Cloudflare Uses an AI Harness to Probe and Harden Its WAF og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Cloudflare Uses an AI Harness to Probe and Harden Its WAF **[InfoQ](https://daily.dev/sources/infoq)** · 3 min read · 1 upvotes · 0 comments ## Summary Cloudflare built an AI testing harness that places frontier models inside a controlled loop to probe its Web Application Firewall, using previously blocked attacks as starting points for generating new variations. Across 45 scenarios, the system produced 1,107 mutation attempts, with 558 blocked and 49 findings surviving human triage, 48 of which involved command injection or SSRF. The work led to three Managed Ruleset changes: two new SSRF detections and an improvement to an existing SSRF rule. A Python harness constrained execution, maintained state, and enforced limits while separate model calls proposed and reviewed mutations, keeping humans as the final validation step. Similar discovery-and-validation harness patterns are used by Google Mandiant's Agentic Vulnerability Discovery Harness, OpenAI's Codex Security, and Google's PageBreak project. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### How did Cloudflare use AI models to find weaknesses in its Web Application Firewall? Cloudflare placed frontier AI models inside a Python-controlled harness that took previously blocked attack payloads and generated new variations by changing encoding, placement, or delivery. One model call proposed mutations while another reviewed responses, with no access to WAF rules or source code. Across 45 scenarios this produced 1,107 attempts, 558 blocked requests, and 49 findings after human triage. _Teams building agentic security tooling can follow ongoing harness-based testing approaches on daily.dev._ ### What new WAF rules did Cloudflare add as a result of adversarial AI testing? Cloudflare's Managed Ruleset gained two new detections, SSRF - Obfuscated Host and SSRF - Restricted Protocol, plus an improvement to the existing SSRF - Cloud rule. These changes came from 49 findings surviving human triage out of 1,107 AI-generated attack mutation attempts, 48 of which involved command injection or server-side request forgery. _Security engineers tracking WAF rule changes and SSRF defenses can follow updates like these on daily.dev._ ### What is an SSRF obfuscation technique that bypassed a WAF but didn't confirm a real vulnerability? Switching a cloud metadata address from a decimal representation to a trailing-dot representation caused a request to receive a redirect instead of a WAF block, after the decimal form had been blocked. Cloudflare treated this as a case for further investigation rather than confirmed proof of exploitation, since human reviewers still had to verify the request reached the target and remained malicious. _Developers hardening SSRF defenses can keep up with findings like this through daily.dev._ ## Similar posts on daily.dev - [We tested our own WAF with frontier AI models. Here’s what we found](https://daily.dev/posts/we-tested-our-own-waf-with-frontier-ai-models-here-s-what-we-found-raq4jzc74) · Cloudflare · 0 upvotes · 0 comments - [The AI harness is the new attack surface](https://daily.dev/posts/the-ai-harness-is-the-new-attack-surface-mrdtydrbt) · CSO Online · 0 upvotes · 0 comments - [Adaptive application security for the AI era: how Cloudflare connects code, traffic, and intelligence to stop attacks](https://daily.dev/posts/adaptive-application-security-for-the-ai-era-how-cloudflare-connects-code-traffic-and-intelligenc-kx989bjhi) · Cloudflare · 1 upvotes · 0 comments - [Harness Extends AI Security Reach Now Spans Entire DevOps Workflow](https://daily.dev/posts/harness-extends-ai-security-reach-now-spans-entire-devops-workflow-dndldkpbf) · DevOps.com · 0 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#ai-agents](https://daily.dev/tags/ai-agents), [#cloudflare](https://daily.dev/tags/cloudflare), [#appsec](https://daily.dev/tags/appsec) [View this post on daily.dev](https://daily.dev/posts/cloudflare-uses-an-ai-harness-to-probe-and-harden-its-waf-j0xyvlgxl) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Cloudflare Uses an AI Harness to Probe and Harden Its WAF","url":"https://daily.dev/posts/cloudflare-uses-an-ai-harness-to-probe-and-harden-its-waf-j0xyvlgxl","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/cloudflare-uses-an-ai-harness-to-probe-and-harden-its-waf-j0xyvlgxl"},"datePublished":"2026-10-07T07:28:10.536Z","dateModified":"2026-10-07T07:28:36.974Z","description":"Cloudflare built an AI testing harness that places frontier models inside a controlled loop to probe its Web Application Firewall, using previously blocked...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/15a79e9334f42e33e221a47309c79cdb?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/15a79e9334f42e33e221a47309c79cdb?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"InfoQ","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"InfoQ","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/afc3bced3e1e4b188dd9127017a60e0c","url":"https://daily.dev/sources/infoq"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/cloudflare-uses-an-ai-harness-to-probe-and-harden-its-waf-j0xyvlgxl","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":1},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,ai-agents,cloudflare,appsec","timeRequired":"PT3M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"InfoQ","item":"https://daily.dev/sources/infoq"},{"@type":"ListItem","position":3,"name":"Cloudflare Uses an AI Harness to Probe and Harden Its WAF"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/cloudflare-uses-an-ai-harness-to-probe-and-harden-its-waf-j0xyvlgxl#faq","mainEntity":[{"@type":"Question","name":"How did Cloudflare use AI models to find weaknesses in its Web Application Firewall?","acceptedAnswer":{"@type":"Answer","text":"Cloudflare placed frontier AI models inside a Python-controlled harness that took previously blocked attack payloads and generated new variations by changing encoding, placement, or delivery. One model call proposed mutations while another reviewed responses, with no access to WAF rules or source code. Across 45 scenarios this produced 1,107 attempts, 558 blocked requests, and 49 findings after human triage. Teams building agentic security tooling can follow ongoing harness-based testing approaches on daily.dev."}},{"@type":"Question","name":"What new WAF rules did Cloudflare add as a result of adversarial AI testing?","acceptedAnswer":{"@type":"Answer","text":"Cloudflare's Managed Ruleset gained two new detections, SSRF - Obfuscated Host and SSRF - Restricted Protocol, plus an improvement to the existing SSRF - Cloud rule. These changes came from 49 findings surviving human triage out of 1,107 AI-generated attack mutation attempts, 48 of which involved command injection or server-side request forgery. Security engineers tracking WAF rule changes and SSRF defenses can follow updates like these on daily.dev."}},{"@type":"Question","name":"What is an SSRF obfuscation technique that bypassed a WAF but didn't confirm a real vulnerability?","acceptedAnswer":{"@type":"Answer","text":"Switching a cloud metadata address from a decimal representation to a trailing-dot representation caused a request to receive a redirect instead of a WAF block, after the decimal form had been blocked. Cloudflare treated this as a case for further investigation rather than confirmed proof of exploitation, since human reviewers still had to verify the request reached the target and remained malicious. Developers hardening SSRF defenses can keep up with findings like this through daily.dev."}}]} ```