[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"branding":3,"analytics":7,"article-ai-pentest-tool-traffic-up-30x-since-october-1-cloudflare-says":10,"sections":41},{"siteName":4,"siteTagline":5,"publisherName":4,"contactEmail":6},"The Revision","Tech news, decoded.","editor@therevision.news",{"gaMeasurementId":8,"adsenseClientId":9},"G-ZW2MV82GYR","ca-pub-8533917693782264",{"article":11},{"id":12,"slug":13,"title":14,"dek":15,"body_md":16,"tags_json":17,"published_at":18,"created_at":19,"updated_at":20,"status":21,"review_note":22,"review_notes":23,"image_url":22,"persona_id":22,"persona_name":22,"section":30,"tags":31,"sources":36,"feedback":40,"feedback_at":22,"cost_usd":40,"total_tokens":40},13091,"ai-pentest-tool-traffic-up-30x-since-october-1-cloudflare-says","AI Pentest Tool Traffic Up 30x Since October 1, Cloudflare Says","Cloudflare says AI hacking frameworks multiplied after ARTEX came down, and stolen CI\u002FCD tokens were the entry point in the incidents it investigated.","Cloudflare said daily requests from AI penetration-testing and exploitation tools have grown 30x since October 1, a week before the open-source tool ARTEX was pulled. Since the October 8 takedown, it said, that traffic has grown more than tenfold.\n\nThe figures come from Cloudflare's own network, and the company gave no absolute request counts. ARTEX is an agentic system, meaning software that directs AI models to carry out hacking steps on their own. Its creator, who goes by Autumn-27, removed it on October 8 and wrote, in Chinese, that malicious use ran counter to its intent. Cloudflare counts over 12,000 repositories since then, several hundred of them unique forks descended from the original, plus hundreds of other orchestration frameworks. In the three days before its post, it saw more than 50 framework families scan its customers, from thousands of IP addresses. As of November 12, ARTEX and its forks made up over 60% of known orchestrators.\n\nThese tools map a target into a graph, then run parallel agents that probe, test and attack it. Cloudflare's other top four are LuaN1aoAgent, Decepticon, Cairn and PentestGPT-Agent.\n\nThe more concrete finding is about credentials. Cloudflare's Cloudforce One team worked several incidents over eight weeks in which attackers got into a hyperscaler (a large cloud provider) environment, then moved into the customer's Cloudflare account. The common cause was static, non-expiring tokens in CI\u002FCD pipelines, the automated systems that build and deploy code. In one case, an account-level API token had no IP restrictions or rate limits. Cloudflare saw Worker scripts named artex-*, more than 69 requests per minute, and 400 database dump requests in an hour.\n\nCloudflare calls the takedown a likely cause of a \"hydra effect\", where removal spawned copies. The timing fits, but the source offers no way to separate it from a trend already underway. Defensive tools have long been abused this way: Cobalt Strike, a commercial red-team product, became a staple of criminal intrusions. Cloudflare's six-pillar advice leans on products it sells, yet the token problem needs no vendor. Short-lived, IP-restricted credentials would have blunted the incidents it described.\n\nWhether defenders can rotate old tokens faster than agents can find them is the open question.","[\"ai-security\",\"penetration-testing\",\"cloudflare\",\"ci-cd\"]","2026-11-13T19:26:07.000Z","2026-11-14T06:59:33.299Z","2026-11-14T07:00:26.773Z","published",null,[24],{"id":25,"reviewer":26,"round":27,"reason":28,"status":29},"editor-r1","editor",1,"The headline says tool traffic surged 30x 'after ARTEX was pulled', but the source says 30x is measured from October 1, a week before the October 8 takedown, and growth since the takedown is 'more than tenfold'; fix the headline and the body's opening framing to use the correct baselines, name Cloudflare in the body, narrow the dek so stolen CI\u002FCD tokens are described as the entry point in the incidents Cloudflare investigated rather than for attackers generally, and soften or support the claim ","resolved","security",[32,33,34,35],"ai-security","penetration-testing","cloudflare","ci-cd",[37],{"name":38,"url":39},"Cloudflare Blog","https:\u002F\u002Fblog.cloudflare.com\u002Fadapting-to-ai-penetration-testing-orchestrators\u002F",0,{"sections":42},[43,48,51,56,61,66,70,75,80,85,90,94,99,104],{"name":44,"slug":45,"count":46,"latest_published_at":47},"AI","ai",7159,"2026-11-13T23:00:00.000Z",{"name":49,"slug":30,"count":50,"latest_published_at":18},"Security",1138,{"name":52,"slug":53,"count":54,"latest_published_at":55},"Deals","deals",666,"2026-11-14T10:00:00.000Z",{"name":57,"slug":58,"count":59,"latest_published_at":60},"Policy","policy",625,"2026-11-13T22:46:47.000Z",{"name":62,"slug":63,"count":64,"latest_published_at":65},"Consumer Tech","consumer-tech",377,"2026-11-13T21:00:00.000Z",{"name":67,"slug":68,"count":69,"latest_published_at":65},"Hardware","hardware",341,{"name":71,"slug":72,"count":73,"latest_published_at":74},"Science","science",233,"2026-11-13T14:29:15.000Z",{"name":76,"slug":77,"count":78,"latest_published_at":79},"Software","software",177,"2026-11-14T08:54:55.000Z",{"name":81,"slug":82,"count":83,"latest_published_at":84},"Startups","startups",162,"2026-11-13T17:32:35.000Z",{"name":86,"slug":87,"count":88,"latest_published_at":89},"Dev Tools","dev-tools",127,"2026-11-11T19:00:44.000Z",{"name":91,"slug":92,"count":88,"latest_published_at":93},"General","general","2026-11-14T07:26:44.000Z",{"name":95,"slug":96,"count":97,"latest_published_at":98},"Gaming","gaming",111,"2026-11-14T08:00:00.000Z",{"name":100,"slug":101,"count":102,"latest_published_at":103},"Reviews","reviews",38,"2026-10-20T12:00:00.000Z",{"name":105,"slug":106,"count":107,"latest_published_at":108},"How-To","how-to",8,"2026-10-05T09:00:00.000Z"]