We tested our own WAF with frontier AI models. Here’s what we found

This post details the development and application of an AI-driven WAF testing system. The system uses LLMs to iterate on known exploits across six attack categories (XSS, SQLi, CMDi, SSRF, LFI, Log4j) in a dynamic application security testing approach. It generated 1,107 attempts, resulting in 49 WAF-relevant findings after human review, primarily in CMDi and SSRF. These findings led to the creation of four sets of candidate rules to harden the WAF, demonstrating the effectiveness of AI in identifying novel attack vectors and improving security posture.