Unsafe content detection
I see the immediate benefit of Cloudflare’s integration of Llama Guard 3-8b into its Firewall for AI. This tool uses Workers AI to evaluate prompts and responses across 13 categories including hate, violence, sexual content, and criminal planning. The system uses an asynchronous architecture where Cloudflare Workers make parallel, non-blocking requests to different detection modules. This design keeps latency low because the system enforces a 2-second threshold before it falls back to any detections already completed. Since the Firewall for AI remains model-agnostic, it works with any third-party model like Gemini or OpenAI. This security layer addresses risks like prompt injection and PII disclosure. I observe that this is significant because AI bots accounted for 4.2% of all HTML requests in 2025, and user-action crawling increased 15-fold. Llama Guard 3 uses zero-shot and few-shot classification to decide if text is safe or unsafe. It avoids the pitfalls of simple keyword blocklists. This method allows the model to understand context and word order, which prevents attackers from bypassing security using linguistic nuances.
Unified billing and log limits
The AI Gateway provides a centralized proxy for managing LLM traffic. I find the new 2026 Unified Billing feature useful for consolidating costs, even though Cloudflare applies a 5% fee to all credits purchased through this system. You pay the same per-token rates as you would directly with a provider. For those of you managing high-volume production workloads, you must account for the fact that the Workers Paid plan only includes 1,000,000 logs per month before you face additional, unexpected storage limits. If you need to stream logs to an external S3 bucket via Logpush, Cloudflare charges $0.05 per million records after the first 10 million per month.
| Plan | Log storage limit |
|---|---|
| Workers Free | 100,000 logs total |
| Workers Paid | 10,000,000 logs per gateway |
The AI Gateway handles 350 requests per second on only 1 vCPU. Because the Workers Paid plan costs $5 monthly, it includes 10 million requests and 30 million CPU-milliseconds of execution. Beyond these specific limits, you pay $0.30 per additional million requests and $0.02 per additional million CPU-milliseconds. The free tier provides 100,000 requests per day but imposes a 50ms CPU time limit per request. Unlike AWS Lambda, which uses containers, Cloudflare Workers use V8 isolates to eliminate cold start delays. I find the log retention limits frustrating because Cloudflare stops storing data once you hit the monthly cap, which forces manual deletion or expensive upgrades. The gateway also allows you to route traffic between applications and foundation model providers like Anthropic and Hugging Face.
The edge advantage over AWS
Cloudflare wins on latency because its 330 data centers place compute closer to users than centralized AWS regions. The platform provides sub-50ms global latency for many applications. I recommend the Cloudflare AI stack for teams that need low-latency edge inference without the headache of managing GPU clusters. I find the D1 database reliability disappointing because queries often hang for seconds or even weeks on the internal network layer. This lack of stability forces developers to use Durable Objects to ensure data consistency. Does the lack of database transactions make it impossible to build certain production-grade AI agents? Cloudflare’s 330 locations help reduce latency compared to AWS, which many enterprises use to manage complex workloads. Cloudflare’s WAF earns an overall rating of 4.5/5, and I find it more intuitive than Imperva or Radware. While AWS offers deep flexibility, its pay-as-you-go system can lead to unexpected costs if companies do not monitor usage closely. I find the Cloudflare model more predictable for companies wanting to avoid the cost spikes seen with AWS CloudFront when traffic shifts unexpectedly.
