Cloudflare 用前沿 AI 模型测试自家 WAF
原标题：We tested our own WAF with frontier AI models. Here’s what we found
AI 摘要
Cloudflare 使用前沿 AI 模型构建自适应 WAF 测试器，让 LLM 扮演黑客角色，在无源码和规则可见性的条件下迭代变异攻击载荷。测试针对授权客户预发布环境，覆盖 XSS、SQLi、CMDi、SSRF、路径遍历/LFI、Log4j 六类攻击，共记录 1,107 次尝试，绝大多数被 Cloudflare WAF 拦截。未被拦截的请求被用于创建新检测规则，以加固所有客户的安全防护。
正文节选
“Is your WAF ready for frontier AI models?” We keep hearing this question from our customers, so we decided to find out. When it comes to exploiting applications, what LLMs are really good at is iterating and mutating attack payloads faster than any human hacker could do. LLMs can use real-time responses to iterate and change their techniques by, for example, testing different encodings, sending the payload in a different part of the HTTP request, or moving to the next vulnerability to test. Eve