We tested our own WAF with frontier AI models. Here’s what we found

Key points

• When it comes to exploiting applications, what LLMs are really good at is iterating and mutating attack payloads faster than any human hacker could do.1
• LLMs can use real-time responses to iterate and change their techniques by, for example, testing different encodings, sending the payload in a different part of the HTTP request, or moving to the next vulnerability to test.1
• For the project described in this blog post, we took a dynamic approach: making the LLM act as if it was a hacker to evaluate whether a WAF is doing its job.1
• We built a WAF tester that starts from known exploits and then iterates by changing how it is encoded or delivered, sends it again, and uses the response to choose the next variation.1

Sources (1)

• [1]We tested our own WAF with frontier AI models. Here’s what we found
  Cloudflare Blog: AI · Sep 29, 01:00 PM

  “Is your WAF ready for frontier AI models?” We keep hearing this question from our customers, so we decided to find out.

  When it comes to exploiting applications, what LLMs are really good at is iterating and mutating attack payloads faster than any human hacker could do.

Extractive summary: sentences quoted from the sources.