Cloudflare says a new wave of AI-driven penetration testing orchestrators is changing the threat landscape faster than many defenders can adapt. In a new post, the company argues that open-source, LLM-based offensive frameworks are scaling attacks, chaining stolen credentials, and forcing organizations to move beyond older security assumptions.
The rise of AI penetration testing orchestrators
According to Cloudflare, the number of LLM penetration testing and orchestration frameworks has surged over the past month. A few weeks ago, the company says ARTEX — an open source agentic penetration testing system that automates offensive security workflows — was the only framework of its kind it had seen. In the last three days alone, Cloudflare says it observed more than 50 framework families attempting to scan its customers globally.
The company says the number of IP addresses running these frameworks has climbed into the thousands and continues to rise daily. It also says daily requests from AI penetration testing and exploitation tools have grown 30x since October 1, underscoring how quickly the ecosystem is expanding.
Why ARTEX drew attention
Cloudflare says ARTEX was taken down by its creator Autumn-27 on October 8, who wrote in Chinese that “The malicious exploitation of this tool runs entirely counter to its original intent.” But rather than slowing the trend, the removal appears to have accelerated fragmentation. Cloudflare says the month since has produced more than 12,000 repositories, including several hundred unique forks with lineage from the original project.
The company describes this as a “hydra effect,” where taking down one repository leads to many more copies and variants. It says hundreds of similar agentic orchestration frameworks have appeared since October 8, making attribution and tracking harder for defenders.
How these tools work
Cloudflare characterizes these systems as autonomous offensive harnesses that can orchestrate AI agents through stages of the traditional cyber kill chain. They can use existing Model Context Protocol, or MCP, integrations, and connect standalone pentesting tools in new ways. Some also let an operator specify the task, while the framework handles the execution.
In Cloudflare’s description, ARTEX and its forks build graphs of targets, leads, and findings so multiple agents can enumerate, verify, prototype, and attack in parallel. The company says this reduces compromises into a kind of hill-climbing problem that agents can repeatedly test and refine at the speed of inference.
What Cloudflare is seeing in the wild
Cloudflare says ARTEX and its forks now account for more than 60% of currently known AI penetration testing orchestrators. It says traffic from these tools has grown more than tenfold since the original ARTEX repository was removed, and more than 30x since October 1.
The company also says it has handled several incident response cases involving ARTEX and ARTEX-derived frameworks over the last eight weeks. In those cases, Cloudflare says attackers used exposed credentials to move from one environment to another, including pivots from a hyperscaler environment into a customer’s Cloudflare environment.
Credential hygiene becomes a bigger problem
Cloudflare says a repeated root cause was static, non-expiring tokens running inside CI/CD pipelines, with broad access across infrastructure. It warns that LLM-based frameworks increase the chances that an API key stolen in one place can be used laterally to reach other tenant environments.
In one incident, the company says it observed an account-level API token that had previously been used for CI/CD and had no IP restrictions or rate limiting. Cloudflare says the compromise likely originated through a third-party hyperscaler.
Signs of automation after compromise
Cloudflare says it saw new Worker scripts created with names such as artex-*, artex-pgrecon-*, artex-pgw-*, and artex-do-*. The company says these names lined up with different behaviors and actions, often with an alphanumeric suffix.
It also reports activity above 69 requests per minute across multiple parts of the infrastructure, plus 400 database dump requests in an hour. Cloudflare says it saw attempted persistence mechanisms and efforts to validate session tokens for other third-party applications. While it believes much of the activity was lightly guided by a human operator, it says the episode shows the speed and breadth these frameworks can deliver after a foothold is established.
Cloudflare’s Modern Security Model
To counter AI-based pentesting frameworks, Cloudflare recommends what it calls the Modern Security Model, built around six pillars. The company argues that older defense-in-depth approaches are not enough when attacks can be validated and chained by autonomous systems.
- Fortify the front gate: Use a Web Application Firewall with advanced rules such as rate limits.
- Security station in the foyer: Add anomaly detection to customer-facing web applications.
- Identify phony visitors: Deploy Bot Defense.
- Remove the back door: Use identity-gated access for high-risk external and internal apps.
- Inspect deliveries: Enforce validated schemas and explicit security controls.
- Neighborhood watch: Use threat intelligence to gain visibility into attacks.
Containment over exposure
Cloudflare says the modern model should make legacy systems harder to reach directly from the internet and reduce opportunities for lateral movement. It also recommends micro-segmentation to limit what an attacker can reach if credentials are compromised.
For incoming application traffic, the company emphasizes schema validation, mutual TLS, and a default-deny posture. For external behavior, it points to bot mitigation and anomaly detection as ways to identify automated activity before it touches sensitive systems.
Why the shift matters now
The larger issue, in Cloudflare’s view, is not simply that attackers have more tools. It is that AI orchestration makes offensive workflows faster, more parallel, and more persistent than traditional manual attacks. That speed lets threat actors validate each stage of an intrusion and immediately feed the result into the next one.
Cloudflare says this effectively compresses the cyber kill chain and “vaporizes legacy cyber security models” unless organizations adapt. Its message is that defenders need controls designed for autonomous, high-volume, and credential-aware attacks, not just isolated intrusion attempts.
Source: Original report
Was this helpful?
Explore more: Application Audit & Review More Cybersecurity Tech News
Last Modified: November 14, 2026 at 10:33 pm
2 views
