AI Security for Apps is now generally available

Cloudflare’s AI Security for Apps is now generally available to help organizations discover, detect, and mitigate threats targeting AI-powered applications. The service protects AI endpoints through Cloudflare’s reverse proxy and integrates AI-specific signals with existing WAF controls. New GA features include free endpoint discovery for all customers, custom topic detection, and custom prompt extraction capabilities.

Why AI Applications Create a New Attack Surface

• Traditional applications follow predictable workflows, while AI applications accept natural-language input and produce probabilistic outputs.
• Attackers can exploit models through:
  • Prompt injection
  • Sensitive information disclosure
  • PII exposure
  • Toxic or off-policy content
  • Unbounded resource consumption
• Risks become more serious when AI agents can call tools to issue refunds, change accounts, apply discounts, or access customer data.
• Organizations may struggle to maintain consistent safeguards as teams rapidly adopt new models and providers.

AI Endpoint Discovery

• AI Security for Apps automatically identifies LLM-powered endpoints across web properties, regardless of hosting location or model provider.
• Discovery analyzes endpoint behavior rather than relying only on paths such as /chat/completions, since AI may also power search, valuation, and recommendation features.
• Discovered endpoints appear under Security → Web Assets with the cf-llm label.
• Discovery is now free for Cloudflare Free, Pro, and Business customers:
  • Free-plan discovery begins when users open the Discovery page.
  • Paid plans receive recurring background discovery.
• Sufficient valid traffic is required to confidently identify AI-powered endpoints.

Always-On AI Threat Detection

• Prompts sent to discovered AI endpoints are evaluated by multiple detection modules.
• Built-in protections cover:
  • Prompt injection
  • PII exposure and extraction
  • Sensitive or toxic topics
• Detection results are attached as metadata and can be used in custom WAF rules.
• Cloudflare intends to use its global network data to identify emerging attack patterns across millions of sites.

Custom Topics and Prompt Extraction

• Custom topics allow organizations to define their own sensitive categories, such as securities, patient data, or competitor products.
• Each prompt and response receives a relevance score that can be logged, blocked, or handled through custom policies.
• Custom prompt extraction identifies where prompts are located in request bodies, supporting formats such as:
  • $.messages[*].content
  • $.requests[*].params.messages[*].content
  • $.property_description
• Standard formats from providers including OpenAI, Anthropic, Google Gemini, Mistral, Cohere, xAI, and DeepSeek are supported.
• Unknown payload formats use a default-secure approach that scans the full request body, which may create false positives.
• Cloudflare plans to support user-defined JSONPath expressions and automated prompt learning to improve accuracy.

WAF-Based Mitigation

• Organizations can block, log, or customize responses to detected threats using the existing Cloudflare WAF rule builder.
• AI-specific signals can be combined with broader request data, including IP reputation, browser fingerprints, bot activity, and attack history.
• This lets security teams distinguish isolated suspicious prompts from attacks associated with broader malicious behavior.

Expanding Partnerships

• IBM has selected Cloudflare to provide AI security for its cloud customers.
• Cloudflare and Wiz are partnering to provide mutual customers with a unified view of AI security posture.
• The service is being extended through Cloudflare’s broader security ecosystem.

Organizations adopting AI agents should first inventory their AI endpoints, then apply detection and WAF policies tailored to their data, users, and business risks. Cloudflare’s unified approach is designed to provide a practical fail-safe as AI deployments expand.