AI Weekly Malaysia

Cloudflare launched Application Profiles, a positive-security feature that periodically learns the expected structure and format of an app's HTTP requests, then runs an always-on validation layer that flags requests deviating from that learned profile. It extends the Schema Learning and Schema Validation it already offered for APIs to web applications, and is in closed beta for invited Enterprise customers without API Security (existing API Security customers already have access). Cloudflare frames the driver as LLM-enabled attackers who can generate malicious payloads and mutate tactics based on WAF feedback, arguing that 'patch faster' is not sustainable.

Why: The concrete design idea is portable even if you never get the beta: allowlisting a field's format (Cloudflare's example is a search field that only accepts alphanumeric strings) kills a whole class of injection attacks without waiting on a patch. If you're on a non-Enterprise Cloudflare plan or another WAF, you can't switch this on, so the actionable move is per-field input schema validation in your own app — and if you're an Enterprise customer without API Security, request the invited beta. Treat the 'LLMs let anyone attack with one prompt' framing as vendor positioning, not a measured finding.