- Cloudflare reports AI penetration-testing tools are spreading fast, with daily requests up 30x since October 1 and over 50 framework families scanning its customers.
- In the incidents Cloudflare investigated, attackers used static, non-expiring CI/CD tokens to move between environments, and these tools made that movement faster.
- Leaders should ask where long-lived tokens sit in build pipelines and whether any single credential reaches across environments.
The weak point is a key nobody retired
Cloudflare's latest research describes attack tools that run on their own. Yet the weak point it highlights is not a clever exploit. It is a credential nobody remembered to expire.
The lesson here is simple. When software does the attacking, small hygiene gaps stop being small. A token with no expiry and no limits works like a master key. Software can try it in many places at once.
What Cloudflare reports
Cloudflare says AI-driven penetration-testing frameworks have "exploded" over the past month. These tools direct AI agents to map and attack systems. In the last three days alone, Cloudflare saw over 50 framework families try to scan its customers. The number of IP addresses running them is in the thousands and still rising.
One tool, ARTEX, began as an open source system for automating offensive security work. Its creator, who goes by Autumn-27, took it down on October 8. The creator wrote that its malicious use "runs entirely counter to its original intent."
The takedown did not end it. Cloudflare counts more than 12,000 repositories now. Several hundred are unique forks of the original. As of November 12, Cloudflare puts ARTEX and its forks at over 60% of the AI orchestrators it tracks.
Traffic from these tools has grown more than tenfold since the takedown. Cloudflare says it is up 30x since October 1.
Cloudflare calls this a "hydra effect" and says the takedown "likely" caused it. That is Cloudflare's inference. It is not a proven cause.
How these tools work
Picture a team of junior testers who never tire. These tools turn a target into a graph of assets. Several independent agents then work at the same time. They find weaknesses, confirm them, build attacks and run them.
Cloudflare says the tools can plug into existing Model Context Protocol connections. That is a common way to give AI agents access to other software. The tools also link ordinary testing programs together in new ways.
Some run in containers with root access. Some have built-in skills for tunneling, Active Directory and cloud pivoting.
Each result feeds the next step. Cloudflare says this turns a break-in into a problem agents can "hill-climb". In plain terms, they improve a little at a time. Cloudflare adds that one operator can target several organisations at once.
The incident pattern: one token, many doors
Cloudflare's Cloudforce One team says it worked several incident investigations over eight weeks. All involved ARTEX or tools built from it.
In several cases, attackers first reached a hyperscaler environment. A hyperscaler is a large cloud provider. From there they moved straight into the customer's Cloudflare account.
Cloudflare says the root cause was the same each time. Attackers took static, non-expiring tokens from CI/CD pipelines. These are the automated systems that build and release software. The tokens gave broad access across environments.
Cloudflare describes one case in detail. The attacker got hold of an account-level API token that had been used for CI/CD. The token had no IP limits and no cap on request rates. Cloudflare says the break-in most likely started at a third-party hyperscaler.
The attacker then created many new Worker scripts. Their names began with "artex-". Cloudflare saw activity above 69 requests a minute. It also saw 400 database dump requests in a single hour.
Cloudflare believes a human operator guided much of this only lightly. So the speed came from the tooling, not from a large attacker team.
Read the advice with one fact in mind
Cloudflare recommends what it calls the Modern Security Model. It has six pillars. They include a web application firewall with rate limits, bot defense and identity-gated access to high-risk applications. They also include checks on incoming traffic and threat intelligence.
Cloudflare also backs micro-segmentation. This limits how far a stolen credential can travel. Cloudflare calls it highly effective against lateral movement.
Cloudflare sells products in most of these areas. The figures are its own observations from its own network. That does not make them wrong. It is context for any purchase decision.
The incident findings also point to a basic fix. Short-lived tokens, IP restrictions and narrow scopes address the failure Cloudflare says it found repeatedly.
What to ask your team
Ask where long-lived tokens sit in your build pipelines. Ask which ones never expire. Ask whether any single token reaches across production, test and development. Ask which API tokens have no IP restrictions or rate limits.
Ask how fast you would notice 400 database dump requests in an hour. Ask whether your cloud providers can tell you when a token of yours is used from somewhere new.
Cloudflare says these tools relentlessly test exposed services. The cheapest defence is to leave fewer doors open.
Produced by the WebPulse Newsroom with AI assistance from the original reporting credited below, and checked against that source by our editorial review. How we use AI.
Original reporting: Cloudflare.
