AI-Powered Penetration Testing Traffic Surges More Than 30x, Cloudflare Says, as Stolen Tokens Enable Internal Breaches

Cloudflare reported that traffic from AI penetration-testing tools has grown more than 30-fold since October 1. More than 12,000 ARTEX-related repositories now exist, and real-world breaches have been confirmed when the tools are combined with stolen CI/CD tokens.

Key points

• What happened: Cloudflare reported that requests from AI penetration-testing tools increased more than 30-fold between October 1 and November 12, with more than 50 tools and thousands of IP addresses observed
• Why it matters: Stolen CI/CD tokens were used in combination with ARTEX, and Cloudflare confirmed an incident in which numerous Worker scripts were created inside a Cloudflare environment through an API token without IP restrictions
• What to do: External defenses such as a WAF are not enough; organizations must reduce API-token privileges, set expiration dates, and separate credentials by environment

More than 30x the requests and over 50 tools

Cloudforce One, Cloudflare's threat research team, published a report on AI-driven penetration-testing tools on November 14 Japan time.

For a representative group of AI penetration-testing tools tracked by the team, daily request volume grew by more than 30x between October 1 and November 12. In the latest three-day period alone, more than 50 frameworks attempted to scan Cloudflare customers, originating from thousands of IP addresses.

However, the 30-fold figure does not mean that the total number of cyberattacks worldwide increased by 30 times. It is the growth rate in requests from a specific group of AI penetration-testing tools that Cloudflare tracks on its own network, and multiple tools may be used from the same IP address. The number of IP addresses, types of tools, scanning attempts, and actual breaches must be treated as separate metrics.

Figure omitted — see the original article

At the center of the surge is the AI penetration-testing tool ARTEX and its derivatives, which Joho no Todai has covered repeatedly in earlier reporting (in Japanese). As of November 12, ARTEX and its forks accounted for more than 60% of the tools Cloudflare was tracking.

Deletion fueled proliferation

ARTEX developer Autumn-27 deleted the public repository on October 8, saying that its misuse ran counter to the original purpose.

But repositories containing copied code and independently modified versions did not disappear. Cloudflare said there are more than 12,000 related repositories, including hundreds of public derivatives with their own code changes. In a lineage map of derivatives analyzed by Cloudflare, 204 public repositories contained independent code changes.

Cloudflare calls the phenomenon the hydra effect. Deleting the original repository, combined with widespread reporting of the deletion, instead drove a surge in forks and modified versions. In about five weeks after the deletion, requests from AI penetration-testing tools including ARTEX grew more than tenfold and then surpassed 30 times their previous level.

ARTEX-style tools use large language models (LLMs) to divide work among multiple AI agents. They continuously gather information about targets, enumerate services, check for vulnerabilities, and choose what to investigate next. Because Model Context Protocol (MCP) can connect existing security-testing tools, the AI does not need to write original attack code each time. It can combine existing tools for a given purpose and use information gathered along the way to make its next decision.

Representative tools cited by Cloudflare include LuaN1aoAgent, Decepticon, Cairn, and PentestGPT-Agent in addition to ARTEX. They share an approach in which multiple AI agents divide roles and manage goals and findings through graphs or task lists. Compared with a scanner that checks only a single vulnerability, they can more easily expand an investigation from one discovered weakness to another system or action.

Stolen tokens and ARTEX combined in a breach

The most important part of the report is a case Cloudforce One confirmed during a real incident response.

In multiple incidents handled by the team over the past eight weeks, non-expiring static access tokens used in CI/CD pipelines were compromised, giving attackers broad privileges across multiple cloud environments.

In one specific case, ARTEX used a compromised account-level API token originating from a third-party hyperscale cloud environment. The token had neither IP-address restrictions nor request limits.

The attacker created numerous new Worker scripts, programs that run in Cloudflare's serverless environment. They were given role-specific names including artex-, artex-pgrecon-, artex-pgw-*, and artex-do-*, with multiple functions operated in parallel.

Observed activity included more than 69 requests per minute and 400 database-dump requests in one hour. Cloudflare also observed attempts to establish persistence and verify whether session tokens could be used with other services. The figure of 400 refers to the number of dump requests, not to the successful acquisition of data from 400 databases.

Figure omitted — see the original article

Cloudforce One said much of the activity may have been guided to some extent by a human operator.

The attack was possible not only because of the AI agents' capabilities, but also because the compromised token remained valid for a long time, had broad privileges, and lacked source-IP restrictions. A WAF (web application firewall) can block external vulnerability probing, but API operations performed with legitimate credentials take place outside that boundary.

When CI/CD tokens have broad privileges across multiple production services, a development-environment compromise can become a path into production systems. Tools such as ARTEX can test this path faster than a person and across more services.

Protect both the perimeter and the inside

Cloudflare proposed six areas of defense: WAF and rate limiting, anomaly detection, bot protection, authenticated access controls, API schema validation, and threat intelligence. The company calls the recommended architecture its "Modern Security Model," organizing capabilities that were already available.

These areas correspond to Cloudflare's own products and therefore carry a commercial context. The underlying ideas, however, remain useful beyond the company's product portfolio.

For administrators of public systems, the practical priority is to design defenses on the assumption that attackers will combine multiple paths. Specifically, this means:

• Rate-limit large volumes of probing requests
• Validate input to reject unexpected API calls
• Require authentication for administrative interfaces
• Reduce API-token privileges to the minimum required
• Set token expiration dates and reissue tokens regularly
• Restrict the source IP addresses allowed to use tokens
• Separate credentials across development, testing, and production environments
• Maintain the ability to detect anomalous privilege use in access logs

The case shows that even if a WAF reduces external probing, a stolen privileged token can provide another route into the environment. Neither perimeter defenses nor designs that limit post-compromise privilege expansion are sufficient on their own.

AI changed the "speed and breadth"

AI-powered penetration testing is also used for legitimate security assessments that organizations authorize themselves. Not every automated scan observed by Cloudflare was necessarily illegal intrusion activity, and the use of a particular tool or IP address alone cannot establish malicious intent.

The change revealed here is not that AI has begun inventing unknown vulnerabilities automatically. It is that open-source toolkits are spreading the ability to use existing testing tools continuously, choose the next action based on findings, and examine multiple environments in a short time.

The harmful use of ARTEX has been confirmed across multiple environments over the past two months, including South Korean financial institutions (in Japanese), authentication attacks against Microsoft 365 tenants (in Japanese), an Azure Key Vault compromise (in Japanese), and financial institutions in Southeast Asia (in Japanese). Cloudflare's latest report adds quantitative evidence of the traffic surge and a new path involving chained credentials.

When the repository disappeared on October 8, ARTEX was supposed to be finished. The reality that 12,000 copies remain and more than 50 successors and modified versions have begun running demonstrates in numbers that "deletion" is not an effective remedy for open-source penetration-testing tools.

Originally published on Joho no Todai. The Japanese original is here.