Cloudflare has extended its AI Gateway product with semantic rate limiting — a new capability that uses lightweight on-edge models to classify AI API requests for malicious intent before forwarding them to backend language model providers, adding a security layer to AI pipelines without introducing meaningful latency.
Standard rate limiting counts requests and blocks above a threshold. Semantic rate limiting analyses the content of each prompt using a small classifier model running on Cloudflare's edge network — over 330 points of presence globally — to detect prompt injection attempts, jailbreaks, data exfiltration probes, and competitor scraping patterns. Requests classified as malicious are blocked at the edge with a configurable response, while legitimate traffic passes through with median added latency under 8ms.
The feature addresses a growing operational pain point for organisations exposing AI features to end users. As AI-powered products have proliferated in 2026, so have attacks specifically targeting AI API surfaces. Prompt injection — where a user crafts input designed to override the system prompt and extract confidential data or cause harmful outputs — has become a routine vector. Several high-profile incidents in early 2026 involved attackers exfiltrating system prompts from commercial AI products by embedding instructions in user-provided content that the LLM followed instead of treating as data.
Cloudflare AI Gateway already handles routing, caching, logging, and cost management for AI API calls. The semantic layer extends this to security without requiring changes to application code — organisations configure detection policies in the Cloudflare dashboard and AI Gateway handles classification transparently in the request pipeline.
The classifier model running at edge is not a large language model but a purpose-built sequence classifier trained on adversarial prompt datasets compiled by Cloudflare's security research team. Because it runs locally on edge hardware rather than calling out to an API, it adds no external dependency and maintains privacy — the contents of classified-and-blocked prompts are never forwarded to third parties.
Pricing is usage-based, charged per classified request above the free tier of 100,000 classifications per month. Enterprise plans include custom classifier training on organisation-specific datasets, which allows security teams to add domain-specific rules for their particular risk profiles.