Cloudflare adds failed-detections field to Rules

On October 9, 2026, Cloudflare made `cf.appsec.request.failed_detections` available in Rules, letting rules use reported security failures to shape request handling. The value is an array of detection IDs that can report failures from content scanning, WAF attack score, attack signature detection and leaked credentials detection. AI detection failures can also cover checks for personally identifiable information, prompt injection, custom topics and unsafe topics. Incorporating such failures does not change existing detection behavior, and the field returns `[]` when none are reported. It can be used in custom and rate limiting rules at zone and account levels, along with Request Header Transform Rules at zone level. Although available on all plans, use requires the plan to include the relevant detections and rule features.