Cloudflare announced the general availability of AI Security for Apps on March 11, 2026. The release highlights a problem many security teams still face: AI features can be embedded in search, support, recommendation and workflow systems without being labelled as chat applications. That makes it difficult to know where prompts enter an organisation, what data leaves it and which controls apply.
This guide turns the announcement into a repeatable review process. It is designed for teams that need to audit AI-powered web applications without treating a security product as a substitute for application access control, secure development or incident response. Cloudflare’s original announcement is the primary source for the capabilities described below.
1. Build an inventory before changing controls
Start with an inventory of every application that accepts natural-language input or sends data to a model. Include customer-facing tools, internal assistants, search features, recommendation engines and agent endpoints that can call other services. Record the endpoint, application owner, model provider, authentication method, data classification and whether the system can trigger an external action.
Cloudflare says its discovery capability identifies AI-powered endpoints by observing how they behave, rather than relying only on familiar paths such as /chat/completions. The company also notes that sufficient valid traffic is required. Treat discovery as a useful signal, not proof that the inventory is complete. Compare discovered endpoints with API gateways, application repositories, data-flow diagrams and provider bills.
For Cloudflare customers, discovered endpoints appear in Security → Web Assets with the cf-llm label, according to the announcement. Export or record the results, then assign an owner and review date to each endpoint.
2. Define the policy for each endpoint
Do not apply one generic rule to every AI feature. For each endpoint, answer four questions:
- What is the application allowed to receive?
- What information must never be returned?
- Which users, sessions or services may call it?
- Can an output initiate a privileged action?
Use synthetic identifiers when documenting sensitive-data tests. If an agent can issue refunds, change account settings or access customer records, keep the final authorization decision in deterministic server-side code. A prompt filter can add a security signal, but it should not be the only barrier protecting a high-impact action.
3. Begin with observation, not blocking
Cloudflare says AI Security for Apps can attach detection results as metadata and use them in custom WAF rules. Those rules can log, block or return a customised response. Start in logging mode on a staging route or a narrowly scoped production endpoint. This provides evidence about normal traffic, legitimate business topics and unexpected payload formats before users are interrupted.
Separate benign policy violations from likely attacks. A healthcare assistant may legitimately discuss medical terms while still needing to prevent exposure of patient records. A financial service may need to flag specific securities without blocking every conversation about markets. Document the business reason for each rule and the person authorised to approve an enforcement change.
4. Tune prompt extraction and detection
The announcement lists built-in detection for prompt injection, personally identifiable information exposure and toxic topics. It also introduces custom topics, which return a relevance score that can be used for logging, blocking or other handling decisions.
Validate where the actual prompt lives in each request. Cloudflare describes support for common provider formats and warns that an unrecognised structure may cause detection to inspect the entire request body. That default-secure behaviour can create false positives when fields such as a customer name sit beside the real prompt. During review, confirm that the detector sees the intended prompt and that unrelated fields are not being treated as model input.
Use harmless synthetic markers for testing. Do not paste real credentials, customer records or confidential source code into a test prompt. For every detector, record the expected outcome, observed outcome and reason for any difference.
5. Combine AI signals with request context
An AI-specific alert becomes more useful when it is evaluated alongside the rest of the request. Cloudflare describes combining prompt signals with WAF fields such as IP history, browser information and previous probing activity. Apply the same principle to your own policy design.
For example, a single unusual prompt from an authenticated employee may deserve review, while repeated injection attempts from an automated client that has also targeted the login page may justify immediate blocking or isolation. Keep rate limits, authentication checks, bot controls and ordinary application validation enabled. AI detection should add context to those controls rather than replace them.
6. Verify the control loop safely
Run a small, repeatable test set in staging or on a low-risk route. Include normal requests, requests containing synthetic sensitive markers, policy-restricted topics, malformed payloads and controlled prompt-injection scenarios. Confirm that the system logs the event, applies the intended WAF action and preserves useful information for investigation.
Also verify the application’s own behaviour. A request blocked at the edge should not be the only test of security. Check that the application rejects unauthorised tool calls, limits data returned to the user and fails safely when the model provider is unavailable. Measure false positives and missed detections over representative traffic before expanding enforcement.
7. Keep an audit trail
AI endpoints change quickly as developers add tools, switch providers or move prompts into new request fields. Re-run discovery after significant application changes, review detection results on a regular cadence and retain the reason for every policy adjustment. When an alert is escalated, preserve the request metadata needed to reconstruct what happened while minimising retention of sensitive prompt content.
Cloudflare’s announcement makes endpoint visibility and AI-specific signals more accessible, but the durable security outcome comes from the surrounding process: inventory, least privilege, staged enforcement, synthetic testing and accountable review. That workflow gives teams a practical way to use the new signals without assuming that an AI gateway can solve the entire application-security problem.