--- title: We tested our own WAF with frontier AI models. Here’s... description: Cloudflare built an adaptive AI-driven testing system that uses frontier LLMs acting as attackers to probe its own WAF, mutating known exploits based on... canonical: https://daily.dev/posts/we-tested-our-own-waf-with-frontier-ai-models-here-s-what-we-found-raq4jzc74 twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: We tested our own WAF with frontier AI models. Here’s what we found | daily.dev og:description: Cloudflare built an adaptive AI-driven testing system that uses frontier LLMs acting as attackers to probe its own WAF, mutating known exploits based on... og:url: https://daily.dev/posts/we-tested-our-own-waf-with-frontier-ai-models-here-s-what-we-found-raq4jzc74 og:image: https://api.daily.dev/og/posts/rAQ4JzC74.png og:image:alt: We tested our own WAF with frontier AI models. Here’s what we found og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # We tested our own WAF with frontier AI models. Here’s what we found **[Cloudflare](https://daily.dev/sources/cloudflare)** · 12 min read · 0 upvotes · 0 comments ## Summary Cloudflare built an adaptive AI-driven testing system that uses frontier LLMs acting as attackers to probe its own WAF, mutating known exploits based on real-time HTTP responses. Testing against an authorized staging environment across six attack categories (XSS, SQLi, CMDi, SSRF, LFI, Log4j) over 1,107 attempts, the WAF blocked the vast majority, but 49 findings (mostly CMDi and SSRF) surfaced detection gaps. Notably, a trailing-dot representation of a cloud metadata IP address bypassed the WAF in one SSRF scenario. These findings led to three new or improved Managed Ruleset detections, including 'SSRF - Obfuscated Host' and 'SSRF - Cloud.' Key lessons: more attempts within a single scenario didn't improve coverage as much as varying attack categories and input placement, and human review remained essential to validate every AI-generated finding before it became an actionable fix. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### What new SSRF detections did Cloudflare add to its WAF Managed Ruleset after AI-driven testing? Cloudflare added a new 'SSRF - Obfuscated Host' detection and improved the existing 'SSRF - Cloud' and 'SSRF - Restricted Protocol' rules. These changes shipped in the Managed Ruleset changelog entries dated July 21 and August 4, and came directly from findings where requests encoded internal cloud metadata addresses in non-standard numeric forms like octal or trailing-dot notation. _Teams hardening SSRF defenses can follow WAF ruleset changes like these on daily.dev._ ### Can a trailing dot in an IP address like 169.254.169.254. bypass a web application firewall? Yes, in one documented test, representing the cloud metadata address 169.254.169.254 with a trailing dot caused Cloudflare's WAF to return a redirect instead of a block, while the same request without the trailing dot was blocked. This became a specific finding investigated for detection gaps, though it was not proof the origin application actually fetched the metadata. _Developers auditing SSRF payload variations can track these edge cases via daily.dev._ ### How effective was Cloudflare's WAF against AI-generated attack payloads across different attack categories? Out of 1,107 recorded mutation attempts across 45 scenarios and six attack categories, 558 requests were blocked and only 49 were confirmed as WAF-relevant findings after human triage, with 48 of those belonging to command injection (CMDi) and SSRF categories. XSS, LFI, SQLi, and Log4j had near full blocking coverage. _Security teams evaluating WAF resilience against AI-driven attacks can follow this research on daily.dev._ ## Similar posts on daily.dev - [Mastering OWASP Detection: Enterprise Rules for AWS, Akamai, F5, and Cloudflare](https://daily.dev/posts/mastering-owasp-detection-enterprise-rules-for-aws-akamai-f5-and-cloudflare-hw98wl5qz) · Coralogix · 0 upvotes · 0 comments - [Defend against frontier cyber models: Cloudflare's architecture as customer zero](https://daily.dev/posts/defend-against-frontier-cyber-models-cloudflare-s-architecture-as-customer-zero-z94egziei) · Cloudflare · 0 upvotes · 0 comments - [The Attack Surface of Cloud-Based Generative AI Applications is Evolving](https://daily.dev/posts/the-attack-surface-of-cloud-based-generative-ai-applications-is-evolving-tzdyoksk3) · Security Boulevard · 2 upvotes · 0 comments - [Adaptive application security for the AI era: how Cloudflare connects code, traffic, and intelligence to stop attacks](https://daily.dev/posts/adaptive-application-security-for-the-ai-era-how-cloudflare-connects-code-traffic-and-intelligenc-kx989bjhi) · Cloudflare · 1 upvotes · 0 comments - [Salt Security Launches Industry-First AWS WAF Managed Ruleset for AI Agents and API Protection](https://daily.dev/posts/salt-security-launches-industry-first-aws-waf-managed-ruleset-for-ai-agents-and-api-protection-sorvsnk0b) · IT Security Guru · 0 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#cloudflare](https://daily.dev/tags/cloudflare), [#appsec](https://daily.dev/tags/appsec) [View this post on daily.dev](https://daily.dev/posts/we-tested-our-own-waf-with-frontier-ai-models-here-s-what-we-found-raq4jzc74) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"We tested our own WAF with frontier AI models. Here’s what we found","url":"https://daily.dev/posts/we-tested-our-own-waf-with-frontier-ai-models-here-s-what-we-found-raq4jzc74","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/we-tested-our-own-waf-with-frontier-ai-models-here-s-what-we-found-raq4jzc74"},"datePublished":"2026-09-29T13:06:41.850Z","dateModified":"2026-09-29T13:07:46.518Z","description":"Cloudflare built an adaptive AI-driven testing system that uses frontier LLMs acting as attackers to probe its own WAF, mutating known exploits based on...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/e8defd81c954055bbdbb52606fa5e1f2?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/e8defd81c954055bbdbb52606fa5e1f2?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Cloudflare","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Cloudflare","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/38522e1d11354cd6b7af66f9d4316735","url":"https://daily.dev/sources/cloudflare"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/we-tested-our-own-waf-with-frontier-ai-models-here-s-what-we-found-raq4jzc74","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,cloudflare,appsec","timeRequired":"PT12M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Cloudflare","item":"https://daily.dev/sources/cloudflare"},{"@type":"ListItem","position":3,"name":"We tested our own WAF with frontier AI models. Here’s what we found"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/we-tested-our-own-waf-with-frontier-ai-models-here-s-what-we-found-raq4jzc74#faq","mainEntity":[{"@type":"Question","name":"What new SSRF detections did Cloudflare add to its WAF Managed Ruleset after AI-driven testing?","acceptedAnswer":{"@type":"Answer","text":"Cloudflare added a new 'SSRF - Obfuscated Host' detection and improved the existing 'SSRF - Cloud' and 'SSRF - Restricted Protocol' rules. These changes shipped in the Managed Ruleset changelog entries dated July 21 and August 4, and came directly from findings where requests encoded internal cloud metadata addresses in non-standard numeric forms like octal or trailing-dot notation. Teams hardening SSRF defenses can follow WAF ruleset changes like these on daily.dev."}},{"@type":"Question","name":"Can a trailing dot in an IP address like 169.254.169.254. bypass a web application firewall?","acceptedAnswer":{"@type":"Answer","text":"Yes, in one documented test, representing the cloud metadata address 169.254.169.254 with a trailing dot caused Cloudflare's WAF to return a redirect instead of a block, while the same request without the trailing dot was blocked. This became a specific finding investigated for detection gaps, though it was not proof the origin application actually fetched the metadata. Developers auditing SSRF payload variations can track these edge cases via daily.dev."}},{"@type":"Question","name":"How effective was Cloudflare's WAF against AI-generated attack payloads across different attack categories?","acceptedAnswer":{"@type":"Answer","text":"Out of 1,107 recorded mutation attempts across 45 scenarios and six attack categories, 558 requests were blocked and only 49 were confirmed as WAF-relevant findings after human triage, with 48 of those belonging to command injection (CMDi) and SSRF categories. XSS, LFI, SQLi, and Log4j had near full blocking coverage. Security teams evaluating WAF resilience against AI-driven attacks can follow this research on daily.dev."}}]} ```