Cloudflare said daily requests from AI penetration-testing and exploitation tools have grown 30x since October 1, a week before the open-source tool ARTEX was pulled. Since the October 8 takedown, it said, that traffic has grown more than tenfold.
The figures come from Cloudflare's own network, and the company gave no absolute request counts. ARTEX is an agentic system, meaning software that directs AI models to carry out hacking steps on their own. Its creator, who goes by Autumn-27, removed it on October 8 and wrote, in Chinese, that malicious use ran counter to its intent. Cloudflare counts over 12,000 repositories since then, several hundred of them unique forks descended from the original, plus hundreds of other orchestration frameworks. In the three days before its post, it saw more than 50 framework families scan its customers, from thousands of IP addresses. As of November 12, ARTEX and its forks made up over 60% of known orchestrators.
These tools map a target into a graph, then run parallel agents that probe, test and attack it. Cloudflare's other top four are LuaN1aoAgent, Decepticon, Cairn and PentestGPT-Agent.
The more concrete finding is about credentials. Cloudflare's Cloudforce One team worked several incidents over eight weeks in which attackers got into a hyperscaler (a large cloud provider) environment, then moved into the customer's Cloudflare account. The common cause was static, non-expiring tokens in CI/CD pipelines, the automated systems that build and deploy code. In one case, an account-level API token had no IP restrictions or rate limits. Cloudflare saw Worker scripts named artex-*, more than 69 requests per minute, and 400 database dump requests in an hour.
Cloudflare calls the takedown a likely cause of a "hydra effect", where removal spawned copies. The timing fits, but the source offers no way to separate it from a trend already underway. Defensive tools have long been abused this way: Cobalt Strike, a commercial red-team product, became a staple of criminal intrusions. Cloudflare's six-pillar advice leans on products it sells, yet the token problem needs no vendor. Short-lived, IP-restricted credentials would have blunted the incidents it described.
Whether defenders can rotate old tokens faster than agents can find them is the open question.