LLMs stretch the security model beyond deterministic apps
Cloudflare has announced Firewall for AI, a security layer designed to sit in front of Large Language Models (LLMs) and catch abuse before requests reach the model itself. The tool kit builds on Cloudflare's existing Web Application Firewall (WAF) product and adds a new validation layer, still in development, that inspects user prompts for exploit attempts.
LLMs introduce risks that traditional web application security tools are not built to handle. The core difference is that a traditional application is deterministic: endpoints define a fixed operation set (like GET /balance or POST /transfer), and security controls can be applied to those specific operations. LLMs are non-deterministic — inputs are natural language, and the same prompt can produce different outputs, making signature matching and access limitation far harder. Data governance is also fundamentally different, because training data is merged into the model itself rather than kept behind a well-separated data plane. That removes the ability to protect data by securing an application control plane alone.
The OWASP Top 10 for LLM applications provides a useful reference for the threat landscape. Some of those vulnerabilities, including Training Data Poisoning, Supply Chain Vulnerabilities, Insecure Plugin Design, and Excessive Agency, are best mitigated during the design, development, and training phases. Others — Prompt Injection, Model Denial of Service, and Sensitive Information Disclosure — can be addressed with a proxy security solution like Firewall for AI.
How much risk a model carries also depends on where it sits. Cloudflare identifies three deployment models:
- Internal LLMs: Corporate assets used by employees, such as an AI co-pilot trained on sales data or an internal knowledge base for engineers.
- Public LLMs: Widely available services trained on general knowledge, such as OpenAI's GPT or Anthropic's Claude. The data risk runs toward the user: anything sent into a public model is exposed to a system that anyone can query.
- Product LLMs: Self-hosted, customer-facing solutions like support chatbots. Here the threat is to the company's intellectual property if proprietary data leaked into training.
How Firewall for AI operates
Firewall for AI is designed to be deployed like a WAF inline in front of an application, with every API request carrying an LLM prompt scanned for known attack signatures. This works with models hosted on Workers AI or third-party infrastructure. It can also sit alongside Cloudflare AI Gateway, and the WAF control plane will manage configuration.
Because the firewall runs across Cloudflare's edge network, inspection happens close to the user, allowing attacks to be intercepted early rather than letting them reach the model origin.
Stopping resource exhaustion at the edge
Model Denial of Service is the LLM-specific version of a traditional DoS attack. Given the compute cost of running an LLM and the unpredictability of natural-language input, a flood of requests can degrade service quality or inflate operating costs. Rate limiting is the primary mitigation. Cloudflare customers proxying their model receive DDoS protection by default, and can layer Advanced Rate Limiting rules on top that restrict how many requests an individual IP address or API key can make during a session.
Catching sensitive data in either direction
WAF customers can currently use the Sensitive Data Detection (SDD) managed ruleset to identify certain personally identifiable information (PII) in model responses. The managed rules scan for financial data (such as credit card numbers) and secrets (API keys), and matches are surfaced in WAF Security Events. That helps model owners catch private data that was inadvertently disclosed in a response. Cloudflare has stated that custom fingerprints for SDD are on the roadmap.
There is a second, opposite use case: keeping sensitive data from being sent out to external model providers like OpenAI or Anthropic. For that, Cloudflare is expanding SDD to scan request prompts. The expanded rules will also integrate with AI Gateway, which keeps a prompt history and flags when PII was present. Output from SDD is planned to include obfuscation, which would edit recognized sensitive data out of a prompt before it is sent to the model. SDD on the request phase is currently in development.
Stopping abuse before it reaches the model
Prompt injection and other forms of model abuse target the model itself, not the infrastructure around it. A crafted prompt can trick an LLM into leaking sensitive data, generating harmful output, or making poor decisions by mimicking legitimate user behavior. A well-known example is embedding instructions inside a CV to manipulate an automated resume screener.
Customers using Cloudflare's AI Gateway frequently raise concerns about their applications generating toxic, offensive, or otherwise unreliable language. The reputational and user-facing risks of ungoverned model output are significant. For many, the solution is an additional security layer between the user and the model, trained to filter injection attempts and prompts falling into disallowed categories.
Scoring and tagging every prompt
Firewall for AI is designed to validate both prompts and responses. It runs a set of detections aimed at identifying prompt injection attempts and other abuses, such as requests that push a model beyond the boundaries set by its owner. Like existing WAF features, Firewall for AI will automatically look for prompts in HTTP requests, and customers can also create rules defining where in the JSON body a prompt resides.
Once enabled, the firewall analyzes each prompt and returns a score from 1 to 99 indicating the likelihood of a prompt injection, with 1 being the most likely. Each prompt also receives tags based on predefined categories. Customers can combine either signal with existing WAF signals — like bot score or attack score — to create rules that block a request before it reaches the model.
Tag-based rules let customers block prompts before they are sent to the model. For instance, a rule could block any prompt tagged as offensive, or one relating to religion, sexual content, or politics.
Availability and rollout
Enterprise customers with the Application Security Advanced offering can start using Advanced Rate Limiting and Sensitive Data Detection (in the response phase) today, both available in the WAF section of the Cloudflare dashboard. The prompt validation component of Firewall for AI is still in development; a beta will be released to all Workers AI users in the coming months. Interested users can join a waiting list to be notified when the feature launches.
With Firewall for AI, Cloudflare is positioning itself among the first security vendors to offer dedicated protections for AI applications. The tool gives customers control over the prompts and requests that reach their models, reducing the risk of abuse and data exfiltration.
