Cloudflare says ARTEX takedown sparked surge in AI pentest forks

Cloudflare said November 13 that the October 8 takedown of ARTEX triggered a surge in forks and modified versions across the infrastructure it tracks.

Cloudforce One, the incident response team, investigated multiple incidents involving ARTEX and ARTEX-derived large language model exploitation frameworks over the last eight weeks. To gain broad access across hyperscaler infrastructure, attackers compromised static, non-expiring tokens inside the automated systems that build and deliver code. Poor credential hygiene allowed attackers to move across cloud environments. Cloudflare warns that large language model frameworks make it more likely that attackers will use a client’s API key sideways to take over other tenant environments.

In one case, the tool reached a compromised account-level API token used for CI/CD pipelines that lacked IP restrictions and rate limiting. Evidence indicated the compromise probably started through a third-party hyperscaler. Cloudflare traced initial access to an external cloud provider. The tool generated many Worker scripts with names such as artex-, artex-pgrecon-, artex-pgw-, and artex-do-, often followed by alphanumeric identifiers, and the names corresponded to distinct behaviors inside the customer environment.

The activity exceeded 69 requests per minute across multiple parts of Cloudflare infrastructure and included 400 database dump requests each hour. Cloudflare measured the volume and speed of ARTEX post-compromise actions. Its analysts saw attempts to maintain persistence and to validate session tokens for third-party applications. The company assesses that most activity received light human guidance yet still shows the speed and breadth ARTEX can achieve after a compromise, as even partially human-guided ARTEX demonstrated rapid, wide-ranging intrusion capabilities.

According to Cloudflare, traffic from ARTEX and its forks increased by more than ten times after October 8 and by more than 30 times after October 1 as the company tracked the growth of AI penetration testing traffic following the removal of the original repository. By November 12, ARTEX and its forks made up more than 60% of the known AI penetration testing orchestrators that Cloudflare tracks. Cloudflare measures market share of AI pentest orchestrators across its customer base. Daily requests for AI penetration testing and exploitation tools grew 30 times since October 1 as Cloudflare measured request volume for AI pentest tools over time.

After creator Autumn-27 removed ARTEX on October 8, more than 12,000 repositories and several hundred unique forks descended from the original repository have appeared. Cloudflare says hundreds of comparable agentic orchestration tools appeared after October 8. Cloudflare is following more than 50 autonomous large language model agent families, each with 1k+ GitHub stars and fully autonomous, which the company monitors as the most widely adopted autonomous large language model penetration testing tools. Autumn-27 addressed the misuse directly: “The malicious exploitation of this tool runs entirely counter to its original intent,” they wrote in Chinese.

Within a three-day span, over 50 framework families tried to scan Cloudflare customers around the world. Cloudflare observed a sudden increase in scanning activity from AI penetration testing frameworks across its customer base. Thousands of IP addresses ran the frameworks and the count rose daily. Cloudflare saw the infrastructure hosting these tools expand continuously and anticipates ongoing growth in AI penetration testing tooling, expecting these frameworks to keep spreading and saying every organization should prepare for this threat.

Threat actors use large language models to check each stage of the classic attack lifecycle before passing it to the next stage. Attackers can confirm each attack phase before proceeding. Cloudflare assesses that this orchestration has no match and makes older security models obsolete. Defenders struggle to keep up with the volume of autonomously guided attacks as autonomous large language model penetration testing frameworks change cyber defense.

ARTEX maps assets and environments on a graph so multiple independent parallel agents can enumerate, verify, prototype, and attack at inference speed. Graph-based mapping allows coordinated agent activity across target environments. These tools turn compromises into hill-climbable problems that AI agents handle well. A harness handles every observe-orient-decide-act step by observing, orienting, deciding, and acting on its own, so human skill is no longer the limiting factor.

Using multiple parallel agents toward one shared goal marks a major change from relying on single operators or AI-augmented teams. Multiple agents operating together increase offensive throughput. One operator can target multiple organizations at the same time, greatly expanding blast radius, and autonomous frameworks let individuals scale attacks across many victims. Autonomous frameworks test exposed services and their configurations methodically, which makes small errors simple to find, and relentless testing exploits minor misconfigurations at scale.

Open-source penetration testing frameworks can direct AI agents through the stages of the classic attack lifecycle at scale, meaning AI agents automate each phase of the classic attack lifecycle. Tools such as ARTEX connect quickly to Model Context Protocol, a standard for linking AI models to tools, and combine traditional standalone penetration testing tools in new ways, so MCP integration lets ARTEX combine existing security tools into novel workflows. Some frameworks let operators direct the kind of task to carry out, meaning operators can specify objectives for autonomous agents.

These tools map and enumerate environments from within and outside a network, so AI pentest tools perform reconnaissance from internal and external vantage points. Cloudflare recommends a Modern Security Model built on six pillars: web application firewall rate limits, anomaly detection, Bot Defense, Identity-Gated Access, schema and mutual TLS (mTLS) validation, and threat intelligence. The six pillars cover perimeter traffic, automated agent detection, hidden administration, network isolation, API validation, and shared watchlists.

Cloudflare advises using a web application firewall that filters traffic, applies rate limits and anomaly detection, and blocks application exploitation as the first pillar focuses on perimeter traffic control. Bot Defense spots automated agents and headless browsers by looking for unnatural cadence and synthetic micro-behaviors, which separates machine visitors from human users. Identity-Gated Access keeps internal admin panels and gateways hidden from outsiders and admits only verified users and devices to specific systems, which removes external visibility of sensitive endpoints under Zero Trust access.

Micro-segmentation stops compromised credentials from moving sideways into production, test, and development systems, and network segmentation keeps breaches within limited zones. Every incoming API request must pass OpenAPI schema validation, an API description standard, and show validated mTLS certificates, a mutual TLS certificate-based method, or it is rejected at the boundary under a default-deny posture, so API traffic is inspected and denied unless it matches explicit rules. Threat Intelligence gives organizations visibility into attacks so they can update watchlists and recalibrate sensors before an actor reaches their network, since shared intelligence helps defenders block emerging attacker infrastructure early.

Cloudflare says older devices and on-premises hardware need an identity-gated approach so attackers cannot reach them on the internet, since older devices should be logically isolated from public exposure. Micro-segmentation tries to slow sideways movement and make it noisier inside a containment-first architecture, and containment matters most when credentials are frequently lost or stolen. Cloudflare offers Cloudforce One incident response and Solutions Engineering help to organizations facing active incidents or putting the Modern Security Model in place. Cloudflare provides direct support for incidents and architecture deployment.