Vercel has added natural-language generation for WAF custom rules and, in a separate same-day release, a new vercel firewall command set for managing those policies from the CLI.

What changed

According to Vercel's changelog and firewall docs, developers can now describe a rule in plain English while creating or editing a custom rule in the dashboard, then review the generated conditions and action before saving it. The docs show example prompts for tasks like rate limiting /api, blocking requests for suspicious file paths, or challenging requests from command-line user agents.

Vercel also launched direct firewall management in the CLI. The new commands cover custom rules, IP blocks, system bypasses, attack mode, and mitigation controls. The CLI docs also show AI-assisted rule generation through commands such as vercel firewall rules add --ai, with rule changes staged as drafts until they are published.

Why it matters

This is a practical infrastructure update, not a new security model. Teams still need to review what the generated rule will actually do, especially before switching from log mode to blocking or rate limiting. But the release lowers the friction between “we should protect this route” and shipping a real firewall policy.

For developers running AI endpoints, agent backends, or rapidly changing app surfaces, that shorter loop could make security controls easier to keep in sync with production changes.