Cloudflare says it has seen a sharp increase in automated penetration-testing and exploitation frameworks that use large language models to coordinate security tools. In the three days before its November 12 account, the company observed more than 50 framework families attempting to scan its customers globally. It also reported that the number of IP addresses associated with these tools had reached the thousands and was continuing to grow.
The activity is changing the scale and pace of offensive security, according to Cloudflare. These systems can use AI agents to enumerate assets, evaluate findings and run follow-on actions, sometimes in parallel. Cloudflare says it is tracking more than 50 such agents. The company’s observations come from traffic across its network and incident response work; they do not, by themselves, establish that every request came from a successful attack or that every tool was operated autonomously.
Forks proliferated after ARTEX was removed
One prominent framework, ARTEX, is an open-source agentic penetration-testing system designed to automate offensive security workflows. Its creator, identified as Autumn-27, took down the original project on October 8, writing that malicious exploitation of the tool ran counter to its original intent, according to Cloudflare. The company says the removal was followed by a proliferation of forks and related projects.
Cloudflare reports more than 12,000 repositories associated with the ecosystem, including several hundred distinct forks with lineage from the original project. It says daily requests from AI penetration-testing and exploitation tools have increased 30-fold since October 1, and traffic has grown more than tenfold since the ARTEX repository was removed. As of November 12, ARTEX and its forks accounted for more than 60% of the AI penetration-testing orchestrators known to the company.
These frameworks differ in how they coordinate work and where they run. Cloudflare’s examples include systems that use planner and executor agents, maintain graphs of targets and findings, or dispatch tasks to other AI coding harnesses. Some can run in containers or directly on a host, with network access and the ability to install or develop tools. Capabilities vary: the company notes that some projects include post-access functions, while others require an operator to direct activity after initial access.
Credential exposure can turn scanning into lateral movement
Cloudflare’s Cloudforce One team says it has assisted with multiple incident response investigations involving ARTEX or derived frameworks over the preceding eight weeks. In cases it described, attackers used exposed credentials to extend access across environments. A recurring issue was static, non-expiring tokens in CI/CD pipelines that had broad permissions across an organization’s hyperscaler infrastructure.
In one investigation, Cloudflare observed ARTEX using a compromised account-level API token previously used for CI/CD. The token had no IP restrictions or rate limiting, and evidence suggested the initial compromise most likely originated through a third-party hyperscaler. The company reported newly created Workers with names including “artex-*” and related prefixes, activity exceeding 69 requests per minute across multiple parts of the customer’s Cloudflare infrastructure, and 400 database dump requests within an hour. It also observed attempted persistence and efforts to validate session tokens for other third-party applications.
Cloudflare said the incident showed how a framework can help an operator move quickly after a credential is compromised. It described the activity as lightly guided by a human, underscoring that automation does not necessarily mean an attack has no human involvement.
Six controls form Cloudflare’s proposed defense model
In response, Cloudflare recommends a layered approach it calls the Modern Security Model. Its six components focus on reducing unwanted traffic, identifying automated behavior and limiting the consequences of compromised access:
- Use traffic controls and a web application firewall, including rate limits and rules for suspicious requests.
- Apply anomaly detection to customer-facing web applications.
- Use bot defenses to identify automated reconnaissance and abusive traffic.
- Put high-risk internal and external applications behind identity-gated access, and use micro-segmentation to restrict lateral movement.
- Validate incoming requests against defined schemas, use explicit security controls such as mutual TLS where appropriate, and adopt a default-deny posture.
- Use threat intelligence to improve visibility into emerging tools and attack activity.
The recommendations emphasize that perimeter filtering alone is not enough when attackers can exploit credentials and move between systems. Identity-based access can make sensitive services unavailable to unauthenticated users, while segmentation can constrain what a compromised account or system can reach. Schema validation and explicit access rules address requests that pass basic network defenses but do not meet an application’s expected requirements.
Cloudflare’s account points to two parallel defensive priorities: detect and control high-volume automated probing, and reduce the value of credentials that may be exposed. The company expects these frameworks to continue spreading, but its observations represent activity visible to its own network and response teams, rather than a complete measure of all use worldwide.
