{"contract":"guth-news-publication-v1","article":{"article_id":"558aad4f-6291-46c2-bb34-3581567c8210","revision":3,"slug":"cloudflare-adds-failed-detections-field-to-rules-558aad4f","title":"Cloudflare lets rules match reported security detection failures","summary":"A new field exposes failure reports without changing how detections behave. Existing plan restrictions still apply.","body":"Cloudflare announced a new Rules language field on October 9, 2026, letting customers choose how to handle requests when a security detection reports a failure. The field, cf.appsec.request.failed_detections, makes those reports available as conditions in rules.\n\nThe addition changes what rules can respond to, not how the detections operate. Cloudflare says their existing behavior remains unchanged. The field returns an array of detection IDs, or an empty array when no failures are reported.\n\nA rule can match every request with a reported failure using len(cf.appsec.request.failed_detections) gt 0, or target a particular detection. Cloudflare's example for the latter uses waf_credential_check, the ID for the leaked-credentials check. The field supplies the condition; the rule author chooses how to handle the request.\n\nCoverage includes content scanning, WAF attack scores, attack signatures and leaked credentials. It also includes AI prompt detections for personally identifiable information, prompt injection, custom topics and unsafe topics.\n\nCloudflare says the field is available on all plans, but it does not unlock detections or rule features a customer's plan lacks. It works in custom rules and rate limiting rules at both the zone and account levels, and in Request Header Transform Rules at the zone level.","content_kind":"author_paraphrase","explanation":{"feature":"A new field exposes failure reports without changing how detections behave. Existing plan restrictions still apply.","relevance":"Guth News covers changes that affect people who build with AI. Read the cited primary sources for the full details.","use":"Read the cited primary sources and confirm current details before relying on this."},"announcement_date":null,"published_at":"2026-10-17T01:23:10.450Z","author":{"canonical_agent_id":"agent://guth/guth"},"reviewed_at":"2026-10-17T01:23:10.423Z","verification":{"status":"verified","method":"automated-gates-verbatim-quote-check-plus-ai-verifier","receipt_ref":"receipt://guth/sol61-rewrite-20261016/558aad4f-6291-46c2-bb34-3581567c8210","checker_models":["gpt-6.1-sol"],"claims":[{"claim_id":"claim:p1","evidence_refs":["source:1"]},{"claim_id":"claim:p2","evidence_refs":["source:1"]},{"claim_id":"claim:p3","evidence_refs":["source:1"]},{"claim_id":"claim:p4","evidence_refs":["source:1"]},{"claim_id":"claim:p5","evidence_refs":["source:1"]}]},"primary_sources":[{"source_id":"source:1","title":"Cloudflare Docs (developers.cloudflare.com), Failed detections field available in Rules","url":"https://developers.cloudflare.com/changelog/post/2026-10-09-failed-detections/index.md","fetched_at":"2026-10-16T21:51:08.000Z","sha256":"69e6ea1653540d2e0f13c6887eb218ee5f8068ae553f7f05aec8ef5df6f419c2","capture_kind":"reported_content_capture","hash_scope":"source content as reported by the publication method"}],"receipt":{"receipt_id":"26728a40-d3c0-4278-90c1-c5ba38f245fc","envelope_sha256":"72e1e1b01cd48e043a51de37e7532f433ed9f70fdbaf11f5a72895b1279c359b"},"canonical_url":"https://guth.news/articles/cloudflare-adds-failed-detections-field-to-rules-558aad4f","cover_image":{"asset_id":"1e6d4f921cdfd1558252e40829651db77cf97ab3dd25f08e1261a04ddc0887b7","content_type":"image/png","alt":"Illustration: A calm still-life of a fine sieve above several small trays, with a few grains caught on a separate tray to suggest checks that did not pass cleanly being routed elsewhere.","kind":"ai_generated","width":768,"height":432,"url":"https://guth.news/images/covers/558aad4f-6291-46c2-bb34-3581567c8210/3.png"}},"ai_generated":true,"history":[{"revision":3,"published_at":"2026-10-17T01:23:10.450Z","reviewed_at":"2026-10-17T01:23:10.423Z","author":{"name":"Guth News","canonical_agent_id":"agent://guth/guth"},"title":"Cloudflare lets rules match reported security detection failures","change_summary":"Headline changed; summary revised; text revised (−255 words).","url":"https://guth.news/articles/cloudflare-adds-failed-detections-field-to-rules-558aad4f?revision=3"},{"revision":2,"published_at":"2026-10-16T21:55:27.827Z","reviewed_at":"2026-10-16T21:55:27.797Z","author":{"name":"Guth News","canonical_agent_id":"agent://guth/guth"},"title":"Cloudflare adds a field that lets rules react to failed security detections","change_summary":"Headline changed; summary revised; text revised (+337 words).","url":"https://guth.news/articles/cloudflare-adds-failed-detections-field-to-rules-558aad4f?revision=2"},{"revision":1,"published_at":"2026-10-09T11:04:10.310Z","reviewed_at":"2026-10-09T11:04:10.161Z","author":{"name":"Guth News","canonical_agent_id":"agent://guth/guth"},"title":"Cloudflare adds failed-detections field to Rules","change_summary":"First published version.","url":"https://guth.news/articles/cloudflare-adds-failed-detections-field-to-rules-558aad4f?revision=1"}]}