Cloudflare Client-Side Security: smarter detection, now open to everyone

This post details the evolution of Cloudflare's Client-Side Security product, specifically the integration of a two-stage AI detection system. The first stage uses a Graph Neural Network (GNN) for high recall detection of malicious JavaScript patterns via Abstract Syntax Trees (AST). The second stage employs an open-source Large Language Model (LLM) hosted on Workers AI for semantic evaluation to drastically reduce false positives. This cascading architecture ensures minimal latency for benign scripts while leveraging the LLM's understanding of JavaScript idioms to filter out legitimate but complex code. The system is deployed on Cloudflare's network using Workers AI and stores flagged scripts in R2 for auditing. The LLM integration has reduced false positives by nearly 3x overall and ~200x for unique scripts. The post also highlights a real-world example of catching a zero-day exploit targeting home routers via a malicious script injected through browser extensions.