---
title: "Lessons in Offensive AI That We're Applying to the Firewall"
description: "Five lessons from building AI attackers, and the defensive decisions they shaped in Voidhawk."
url: https://voidhawk.ai/blog/offensive-ai-lessons-firewall
category: Blog
publishedAt: 2026-08-11
author: Voidhawk
authorRole: Team
tags: offensive-ai, ai-penetration-testing, reasoning-firewall
---

# Lessons in Offensive AI That We're Applying to the Firewall

## The Two Layers at Your Edge, and What They Actually Ask

Almost every production edge runs some version of the same pair.

A **WAF** classifies payloads, comparing requests against known-bad patterns. Machine-generated evasion goes through it. Language models paired with reinforcement learning [bypass ModSecurity](https://isj.vn/index.php/journal_STIS/article/view/1128) on SQL injection above 80 percent of the time and SafeLine on remote code execution at 97.8 percent, and parsing-inconsistency research [reports evasion](https://arxiv.org/pdf/2512.23610) as high as 79 percent across AWS, Azure, Cloudflare, and ModSecurity.

Replacing rules with machine learning is not the fix. In [adversarial testing](https://arxiv.org/html/2605.11188), LLM-driven generators bypassed ML-based WAFs at 92.49 and 80.48 percent while managing under 6 percent against rule-based engines. Any classifier hands the attacker a scoring function to optimize against, and a neural one is smoother to optimize than a regex.

**Bot management** classifies identity, scoring whether a visitor is human or machine from TLS and JA4 fingerprints, IP reputation, device properties, and behavioral telemetry. We defeat it routinely. Our agents bypass modern WAFs, solve CAPTCHAs, and fool current bot protection as ordinary practice in customer penetration tests, and we say so as practitioners rather than as marketers. Cloudflare concedes the same point in its [Precursor launch](https://blog.cloudflare.com/introducing-precursor/): bots execute JavaScript, run full browser environments, and pass individual CAPTCHAs without raising suspicion. [Thales reports](https://cpl.thalesgroup.com/blog/application-security/bad-bots-in-the-agentic-age) adversaries operating through real browsers with valid fingerprints, residential proxies, and human-like interaction.

The deeper problem is that the question is expiring. Machine traffic crossed 50 percent of Cloudflare's network in May 2026, about 18 months ahead of its CEO's own forecast, and sits near 57 percent of web requests. Cloudflare's CFO told analysts on the Q2 2026 earnings call that extrapolating current growth puts non-human traffic at up to 1,000 times human traffic within five years. Take the ratio as a projection, but the trend is measured: automated traffic [grew eight times faster than human traffic](https://www.humansecurity.com/learn/resources/2026-state-of-ai-traffic-cyberthreat-benchmarks/) in 2025, and much of it is legitimate agents transacting for real customers. A binary verdict on automation [no longer maps to anything useful](https://cside.com/blog/bot-detection-software).

Cloudflare's own answer, Precursor, moves from single checkpoints to continuous session-wide behavioral analysis. That is the correct fix to the unit of analysis, and it is the direction we agree with. It still asks whether the visitor is human, which is the part that expires.

One layer asks what this request looks like. The other asks what this client is. Neither asks what it is trying to do. Five lessons from the offensive side explain why that gap is the whole problem, and what closing it requires.

## Lesson 1: A Static Ruleset Becomes the Attacker's Training Data

Point a reasoning agent at a fixed defense and the defense teaches it. Every block, error, and rejection is a labeled data point. Our agents map the boundary of what is permitted by watching what gets refused, then approach that boundary from a direction the rules never anticipated. The defense does not stop them. It hands them a free training set.

**The design decision:** Voidhawk evaluates intent rather than matching patterns, assessed across a whole session instead of one request at a time. You cannot pattern-match your way out of an adversary whose advantage is generating patterns you have not catalogued.

## Lesson 2: Clean Blocks Hand Attackers a Free Map of Your Defenses

Because we build the attackers, we know exactly which artifacts they harvest: distinctive status codes, timing deltas, response-length differentials, and above all the crisp, informative denial. A clean block is unambiguous feedback. It tells an agent precisely where the wall is so it can route around it. The tidier your denials, the faster your defense gets mapped.

The defenses that gave our agents real trouble were never the ones that blocked decisively. They were the ones that behaved ambiguously and wasted time. Uncertainty is expensive for a reasoning system: it burns inference budget and corrupts the model the attacker is building of you.

**The design decision:** Voidhawk practices signal discipline. It is deliberately parsimonious about what it emits, because we know what a prober is looking for. Beyond that it slows, shapes, and deceives, so reconnaissance produces a map that is expensive to build and wrong when finished. Cheap reconnaissance is what makes adaptive adversaries economically viable, and raising its cost is a defensive lever the industry has barely touched.

## Lesson 3: Attackers Live in Traffic That Looks Individually Normal

Reasoning attackers are least visible when they are most dangerous. Our agents win by staying in the gray band: individually plausible requests, sequences that are benign one step at a time, inputs sitting just inside normal. That is exactly where a defense tuned for clear-cut bad behavior looks away, and where a defense that resolves doubt by allowing traffic has inverted the burden of proof in the attacker's favor.

**The design decision:** In Voidhawk, ambiguity escalates and never passes. Traffic the fast path cannot confidently clear moves up a ladder of progressively deeper analysis, reaching model-grade reasoning about the session only at the top. Most traffic never leaves the fast path, which is the point: reasoning is reserved for the sessions that need it. What makes the judgment accurate is that the baseline is yours, learned from your application's real structure and traffic rather than a generic profile.

## Lesson 4: Offense Runs Unconstrained While Defense Runs Behind Guardrails

The Hugging Face incident put a number on something we see constantly. During the response, defenders' own AI tooling refused risky actions while the attacking agent operated under no policy limits at all. That asymmetry is the current default, and it hands the attacker an edge before the engagement starts.

The naive fix is to strip the guardrails off defensive tooling. That is a mistake. You should not have to choose between capability and safety on the defending side.

**The design decision:** Voidhawk runs defensive reasoning at line rate inside bounds we actually want. Response severity is bounded, escalation is structured, and the system degrades safely rather than failing open. The answer to the asymmetry is not an unconstrained defense but a fast one that is safe by construction.

## Lesson 5: Only a Real Attack Proves a Defense Works

Defensive claims untested by a capable attacker are hope. We have watched confident defenses fold the moment a reasoning agent applied pressure they had never actually faced.

**The design decision:** Our offensive practice is Voidhawk's verifier of record. Every capability has to survive our own attack agents against falsifiable criteria before it counts as done. The team building the attackers is the team building the firewall.

That standard applies to performance too, because the second question every technical evaluator asks after "does it work" is "what does it cost me in latency." We treat that as a pass-or-fail criterion rather than a footnote.

## Not SaaS, and Why That Is a Latency Decision

Engineers resist putting a WAF in front of a service for one reason above all others, and it is not skepticism about security. It is latency. In high-throughput systems, single-digit millisecond regressions cascade into user-visible degradation, and vendors answering "single-digit milliseconds" give you nothing to plan capacity against. A team benchmarking AWS WAF on an ALB [reported](https://communities.stackinsight.net/community/cyber-aws-shield-waf/has-anyone-quantified-the-latency-added-by-aws-waf-on-an-alb/) roughly 8ms added at p99 on average, spiking to 25ms under high TPS. Tail latency breaks systems; averages hide the breakage.

SaaS edge security compounds it structurally. Your traffic leaves your infrastructure, crosses a vendor's proxy network, and comes back. For authenticated application traffic, which is not cacheable, that hop is pure additive cost, and it comes with DNS delegation and someone else's failure domain.

Voidhawk is not SaaS. It runs as a Kubernetes ingress controller in your own cluster, on the path traffic already takes, with no hairpin to a vendor edge.

We will not pretend there is no tension here. A defense that escalates ambiguous sessions to deeper reasoning is doing more work than one that matches a pattern and moves on. Two things make that tradeoff manageable: heuristics clear the overwhelming majority of traffic on a fast path so escalation stays rare, and running in-cluster means whatever that escalation costs goes to analysis instead of network round trips. The rest is testing, which is why latency at p99 is a criterion we hold ourselves to in the same way we hold defensive capability to surviving our own attack agents.

## What This Replaces

| | WAF | Bot Management | Voidhawk |
|---|---|---|---|
| Core question | Does this match known-bad? | Is this a human or a machine? | What is this client trying to do? |
| Unit of analysis | One request | One visitor identity | The whole session |
| Adapts to your app | Managed rulesets, hand-tuned | Generic behavioral models | Learns your app's own baseline |
| Novel payloads | Missed until a signature exists | Out of scope | Assessed by intent, no signature needed |
| Legitimate AI agents | Out of scope | Blocked or allowed as a binary | Judged on what they are doing |
| On ambiguity | Pass or block by score | Pass or block by score | Escalate to deeper analysis |
| Attacker feedback | Clean, informative blocks | Clean, informative blocks | Signal discipline plus deception |
| Layer 7 attacks | Yes | No | Yes, in the same pass |
| Deployment | Appliance or SaaS edge | SaaS edge plus client-side JS | Your cluster, no vendor hop |

Voidhawk covers conventional Layer 7 attacks alongside reasoning-adversary defense, so it does not require a WAF underneath it.

## Where This Leaves Voidhawk

Evaluate intent, because static rulesets are training data. Withhold signal and charge for reconnaissance, because clean blocks are a free map. Escalate ambiguity, because that is where attackers live. Reason at machine speed inside bounds, because offense is otherwise always faster. Verify against your own attackers, because nothing else is honest.

For the threat this counters, see [The Proliferation of Frontier-Class AI Attacks](/blog/frontier-class-ai-attacks). For the full argument, see [Why the World Needs Voidhawk](/blog/why-the-world-needs-voidhawk).

Voidhawk is in active R&D and we are recruiting design partners now. The launch variant deploys as a Kubernetes ingress controller, and you do not need to be under attack to participate: [ZioSec](https://ziosec.com) brings the adversary. [Reach us here](/contact?intent=design-partner).

## Frequently Asked Questions

### What is offensive AI?

Offensive AI is the use of AI agents to carry out cyberattacks, including discovering vulnerabilities, chaining exploits, and moving through target systems, work that once required skilled human operators. [ZioSec](https://ziosec.com) builds offensive AI agents for continuous penetration testing against production-grade targets.

### Why is an offensive security company building a defensive firewall?

Building the attackers showed us exactly how reasoning adversaries defeat conventional defenses, and that knowledge translates directly into design. Every decision in Voidhawk traces to a pattern we observed on offense, and our offensive agents serve as the firewall's verifier of record: nothing ships until it survives them.

### Why do WAFs fail against AI-driven attacks?

A WAF classifies individual requests against known-bad patterns, and machine-generated evasion defeats that reliably. Published research reports language-model-driven payload generators bypassing ModSecurity on SQL injection above 80 percent of the time and SafeLine on remote code execution at 97.8 percent. Replacing rules with machine learning does not solve it: the same research bypassed ML-based WAFs at over 90 percent, because any classifier gives an attacker a scoring function to optimize against.

### Why is bot management not enough against AI attackers?

Bot management asks whether a visitor is human or machine. Capable adversaries already pass that test: ZioSec's offensive agents bypass modern WAFs, solve CAPTCHAs, and fool current bot protection as routine practice, and Cloudflare's own Precursor documentation acknowledges that bots execute JavaScript, run full browser environments, and pass individual CAPTCHAs without raising suspicion. The question is also expiring. Machine traffic crossed 50 percent of Cloudflare's network in May 2026 and much of it is legitimate agents acting for real customers, so a binary allow-or-block verdict on automation cuts off revenue or admits abuse. What a client is doing stays meaningful when what it is no longer distinguishes anything.

### Is Voidhawk SaaS, and what does it do to latency?

Voidhawk is not SaaS. It deploys as a Kubernetes ingress controller inside your own cluster, which removes the additive round trip that SaaS edge security imposes when traffic leaves your infrastructure and comes back. Within that model, heuristics clear the overwhelming majority of traffic on a fast path and escalation to heavier analysis stays rare by design. Latency at p99, not average, is a pass-or-fail criterion in testing and a measured part of design partner validation.

### Does Voidhawk replace my WAF?

That is the design intent. Voidhawk handles conventional Layer 7 attacks in the same pass as its reasoning analysis, so it is built to be deployed without a separate WAF underneath it rather than as an additional layer on top of one.