The Pulse

Cloudflare sees over 50 AI pentesting tool families scan customers

Cloudflare says more than 50 families of AI-driven penetration-testing tools scanned its customers over three days. It also describes incidents in which attackers used exposed credentials alongside the tools to move between environments.

AI.info Team · · fact-checked · against 1 source ↓ · Published 13 Nov 2026

More than 50 families of AI-driven penetration-testing tools attempted to scan Cloudflare customers worldwide over three days, the company says, as it warns that the frameworks can also be used in attacks. In a November 13 post, Cloudflare said the number of IP addresses it had seen running the tools had reached the thousands and was rising daily.

Daily requests of AI penetration-testing and exploitation tools had grown 30-fold since October 1, according to the company. It also described incidents in which attackers combined exposed credentials with the frameworks to move between environments.

A growing collection of tools

ARTEX, an open-source system for automating offensive security workflows, was taken down by its creator, Autumn-27, on October 8. Since then, Cloudflare says, the ecosystem has grown to more than 12,000 repositories, including several hundred unique forks with lineage from the original repository, alongside hundreds of other similar frameworks.

As of November 12, ARTEX and its forks accounted for more than 60% of currently known AI penetration-testing orchestrators, the company said. Traffic from the selected tools had grown more than tenfold since the original repository was removed.

The company listed ARTEX and four other tools—LuaN1aoAgent, Decepticon, Cairn and PentestGPT-Agent—as its top five orchestrators, each described as fully autonomous and with 1,000 or more GitHub stars. Their architectures differ: some use a planner or supervisor with other agents, while Cairn dispatches work to existing AI harnesses.

How the agents work

Cloudflare describes the frameworks as systems that can coordinate AI agents through stages of a security assessment, connect existing testing tools and map environments. ARTEX and its forks represent assets and findings in graphs, allowing multiple agents to work in parallel on tasks such as enumeration and verification.

Some frameworks can also receive directions from an operator about the task to perform. In Cloudflare's assessment, parallel agents can test exposed services and configurations systematically while allowing an operator to target multiple organizations at once.

Credentials in incident investigations

Cloudflare's Cloudforce One team said it had been called into multiple incident-response investigations involving ARTEX and related frameworks over the preceding eight weeks. In those cases, the team observed attackers gaining access to a hyperscaler environment and then moving into a customer's Cloudflare environment.

Investigators found that attackers had compromised static, non-expiring tokens used in CI/CD pipelines, which granted broad access across the organizations' hyperscaler infrastructure. The team also observed exposed credentials being used alongside the AI-based frameworks.

In one investigation, ARTEX gained access to a compromised account-level API token previously used for CI/CD that had no IP restrictions or rate limiting, Cloudflare said. Available evidence indicated that the compromise most likely originated through a third-party hyperscaler.

The company observed new Worker scripts being created and activity exceeding 69 requests per minute across multiple parts of the customer's Cloudflare infrastructure. It also saw 400 database dump requests in an hour, attempts to establish persistence and attempts to validate session tokens for other third-party applications.

The company believes a human operator lightly guided much of that activity. It presented the case as an example of the speed and breadth the tools can reach after a compromise, rather than as a description of every use of the frameworks.

Proposed defenses

Cloudflare recommends a security model with six components: a web application firewall with advanced rules, anomaly detection, bot defenses, identity-gated access for high-risk applications, validated schemas and explicit security controls, and threat intelligence. The company also recommends security keys and hardware-based FIDO keys in its discussion of application defenses.