AI Security for Apps hits general availability
Cloudflare has announced that AI Security for Apps, its tool for detecting and mitigating threats to AI-powered applications, is now generally available. The GA release introduces custom topic detection and makes AI endpoint discovery free for all Cloudflare customers, including those on Free, Pro, and Business plans.
The company also announced an expanded collaboration with IBM, which has selected Cloudflare to deliver AI security to its cloud customers, and a new partnership with Wiz to give mutual customers a unified view of their AI security posture.
Why AI apps need different protection
Traditional web applications operate on defined actions — check a balance, make a transfer — that can be secured with deterministic rules. AI-powered applications behave differently: they accept natural language and generate unpredictable responses. There is no fixed set of operations to allow or deny because the inputs and outputs are probabilistic.
This creates a new attack surface. Attackers can manipulate large language models to take unauthorized actions or leak sensitive data. Prompt injection, sensitive information disclosure, and unbounded consumption are among the risks cataloged in the OWASP Top 10 for LLM Applications.
The risk intensifies when AI applications operate as agents with access to tool calls such as processing refunds, modifying accounts, providing discounts, or accessing customer data. In those cases, a single malicious prompt becomes an immediate security incident.
"Most of Newfold Digital's teams are putting in their own Generative AI safeguards, but everybody is innovating so quickly that there are inevitably going to be some gaps eventually," says Rick Radinger, Principal Systems Architect at Newfold Digital, which operates Bluehost, HostGator, and Domain.com.
Discovery, detection, and mitigation
AI Security for Apps sits in front of AI-powered applications as part of Cloudflare's reverse proxy and addresses three tasks: discovering AI-powered apps across a web property, detecting malicious or off-policy behavior directed at those endpoints, and mitigating threats through the WAF rule builder.
Free endpoint discovery
Before protecting LLM-powered applications, security teams need to know where they are deployed. AI Security for Apps automatically identifies LLM-powered endpoints across web properties, regardless of hosting location or model provider. This capability is now free for every Cloudflare customer on Free, Pro, and Business plans.
The detection system identifies endpoints by analyzing behavior rather than matching common path patterns like /chat/completions, because many AI applications lack a chat interface entirely — think product search, property valuation tools, or recommendation engines. Sufficient valid traffic is required for confident identification.
Discovered AI-powered endpoints appear under Security → Web Assets, labeled as cf-llm. For Free plan customers, discovery is initiated when they first navigate to the Discovery page. Paid plan customers get automatic discovery in the background on a recurring basis.
Detection modules
Traffic to AI-powered endpoints runs through multiple detection modules for prompt injection, PII exposure, and sensitive or toxic topics. Results attach as metadata that can be used in custom WAF rules to enforce policies. Cloudflare also leverages its global network, which sees traffic from roughly 20% of the web, to identify new attack patterns across millions of sites before they reach your infrastructure.
Built-in detection covers prompt injections, PII extraction, and toxic topics. The new custom topics feature lets organizations define categories specific to their business — a financial services company might detect discussions of specific securities, a healthcare company might flag conversations touching patient data, and a retailer might track when customers ask about competitor products.
You specify the topic, and the product inspects the prompt and outputs a relevance score that can be used to log, block, or handle the request as needed.
Identifying the prompt in the request
Accurate detection requires finding the prompt within the request payload first. Prompts can appear anywhere in a request body, and LLM providers structure their APIs differently. OpenAI and most providers use $.messages[*].content for chat completions. Anthropic's batch API nests prompts inside $.requests[*].params.messages[*].content. A custom tool might use $.property_description.
Standard formats are supported for OpenAI, Anthropic, Google Gemini, Mistral, Cohere, xAI, DeepSeek, and others. When no known pattern matches, the product applies a default-secure posture and runs detection on the entire request body. That can introduce false positives when the payload contains sensitive fields that don't feed directly to the AI model — for instance, a $.customer_name field near the actual prompt might trigger PII detection unnecessarily.
Custom JSONPath expressions to specify exact prompt locations are planned to reduce false positives and improve detection accuracy. A prompt-learning capability that automatically adapts to application structure over time is also in development.
WAF rule integration
Once a threat is identified and scored, it can be blocked, logged, or met with custom responses through the same WAF rules engine used for the rest of application security. Combining AI-specific signals with the hundreds of other fields available in the WAF provides context that point solutions can't offer: a prompt injection attempt from an IP that's been probing a login page, using a browser fingerprint associated with prior attacks, and rotating through a botnet is far more dangerous than an isolated injection attempt.
This is exactly the kind of fail-safe Newfold Digital's Radinger is looking for. "We look forward to using it across all these projects to serve as a fail-safe," he says.
Ecosystem and availability
AI Security for Apps will be available through Cloudflare's growing ecosystem, including integration with IBM Cloud Internet Services (CIS), where end users can procure advanced application security solutions and manage them through their IBM Cloud account. The partnership with Wiz will connect AI Security for Apps with Wiz AI Security, giving mutual customers a unified view of their AI security posture — from model and agent discovery in the cloud to application-layer guardrails at the edge.
AI Security for Apps is available now for Enterprise customers. Those on Free, Pro, or Business plans can use AI endpoint discovery today by navigating to Security → Web Assets in the dashboard. Cloudflare plans to make all AI Security for Apps capabilities available to customers on all plans in the near future.
