Unsafe Topic Detection Categories Refreshed: Have You Checked Your AI Security for Apps Rules?
Hi, Shii-chan here! Another AI Security for Apps update that calls for a quick review!
Cloudflare Changelog
developers.cloudflare.com
What was announced?
Cloudflare's Changelog announced an update to unsafe topic detection in AI Security for Apps.
The categories used to judge whether an incoming prompt touches unsafe topics have been updated, so the values available in the WAF field cf.llm.prompt.unsafe_topic_categories have changed.
The story so far
Before, you could specify the old category values in this field and use WAF rules to act on prompts containing specific unsafe topics.
With this update the category list changed, and some values were removed or renamed.
What changes
Here is how existing rules behave:
- Existing WAF custom rules remain valid
- Rules that reference a removed or renamed category will no longer match that category
Even if a rule is still there, the category you intended may no longer be detected, so keep an eye on this!
If you use this field, update your expressions to the currently supported values.
Dive Deep
What the announcement tells us:
- The affected field is
cf.llm.prompt.unsafe_topic_categories - The requested action is to review rules using this field and update their expressions to current values
- Category descriptions and configuration guidance are in the Unsafe topics page of the docs
The notice itself doesn't list which category names were added or removed. For the exact differences, check the docs list.
By the way, the PII detection categories in the same AI Security for Apps were updated on September 1, 2026, and they call for the same kind of review.
Wrap-up
- The unsafe topic detection categories were updated
- The values for
cf.llm.prompt.unsafe_topic_categorieschanged - Existing rules stay valid, but removed or renamed categories no longer match
- Update rules that use this field to the current values
If you run LLM-powered apps behind the WAF, this is one to check!
