https://apicourse.com/tags/api-security/ Recent content in Api Security on API Course Hugo en-us Wed, 07 Oct 2026 00:00:00 +0000 https://apicourse.com/cloudflare-used-ai-to-attack-its-own-waf-and-found-49-gaps-mostly-ssrf/ Wed, 07 Oct 2026 00:00:00 +0000 https://apicourse.com/cloudflare-used-ai-to-attack-its-own-waf-and-found-49-gaps-mostly-ssrf/ <p>Cloudflare just published the results of an experiment that every API developer should read, even if you&rsquo;ll never run a firewall. The company put frontier AI models inside a test harness and told them to get past its own Web Application Firewall.</p> <p>They found gaps. Not many, but the pattern of what got through is the real lesson.</p> <h2 id="what-cloudflare-did">What Cloudflare did</h2> <p>The test started with attack payloads the WAF already blocked. Instead of replaying a fixed list, the models looked at how each attempt was handled and proposed a tweak for the next one: different encoding, different placement in the request, different delivery. They had no access to the WAF rules or source code. Pure black box.</p>