WAF - Updated PII detection for AI Security for Apps
- Announced
- Tags
- WAF
- Severity
- info, set by
reef/rss-rule-v1 - Source
- https://developers.cloudflare.com/changelog/post/2026-09-01-ai-security-for-apps-pii-detection/
<p>AI Security for Apps now supports an updated set of categories for detecting personally identifiable information (PII) in incoming prompts.</p> <p>The values available in <a href="https://developers.cloudflare.com/ruleset-engine/rules-language/fields/reference/cf.llm.prompt.pii_categories/"><code>cf.llm.prompt.pii_categories</code></a> have changed. Existing WAF custom rules remain valid, but rules that reference a removed or renamed category will no longer match that category. Review any rules that use this field and update their expressions to use the currently supported values.</p> <p>For the complete category list and configuration guidance, refer to <a href="https://developers.cloudflare.com/waf/detections/ai-security-for-apps/pii-detection/">PII detection</a>.</p>
The text above is the source's. reef added the severity, the dates it could read from the text, and the endpoints and scopes named in code.