50+ AI Penetration-Testing Frameworks Now Scan Cloudflare Customers: What Broke, and the Six Controls That Matter
Cloudflare reports 50+ LLM pentest orchestrator families scanning its customers, thousands of IPs, and 30x request growth since October 1. What changed, and the six controls that matter.
On October 8, the creator of ARTEX — an open-source agentic penetration testing framework — took the original repository down, saying its malicious exploitation ran counter to the tool’s intent. It did not work the way takedowns usually work. Cloudflare now reports that in just the last three days, more than 50 distinct LLM penetration-testing and orchestration framework families have attempted to scan its customers globally, with the number of IP addresses running these frameworks grown into the thousands and still increasing daily (Cloudflare Blog).
The takedown caused a hydra effect
The volume numbers are stark. Daily requests of AI pentesting and exploitation tools have grown more than 30x since October 1 and more than tenfold since the ARTEX repository was removed. There are now over 12,000 repositories in this ecosystem, with several hundred unique forks carrying lineage from the original ARTEX repo. Cloudflare attributes the steep acceleration in unique instances around October 8 to a hydra effect: removing the original, plus the widespread reporting around it, seeded a wave of fragmented forks.
As of November 12, ARTEX and its forks still make up over 60% of known AI penetration testing orchestrators. Cloudflare is tracking 50+ LLM agents total, and its published table shows the top five — ARTEX forks, LuaN1aoAgent, Decepticon, Cairn and PentestGPT-Agent — each with 1,000+ GitHub stars and full autonomy. These frameworks chain MCP servers and traditional pentesting tools into parallel agent fleets that map targets onto graphs, then enumerate, verify, prototype and attack at inference speed.
| Framework | Planning model | Execution environment |
|---|---|---|
| ARTEX (and forks) | Planner and parallel agents | On host or container with network/root access |
| LuaN1aoAgent | Supervisor, planner and generic executors | Container with network/user access; built-in SSH and Chisel tunneling |
| Decepticon | Orchestrator dispatching specialist sub-agents | Kali container running as root |
| Cairn | Dispatcher feeding existing AI harnesses (Codex, Claude Code, Pi) | Kali container with root, or directly on host |
| PentestGPT-Agent | Supervisor plus one generic executor | On host |
Why does this matter to anyone running internet-facing services? Because the constraint that used to limit attackers — human skill and hours — is gone. A single operator can now run autonomous agents against multiple organizations at once, every step of the kill chain validated before the next stage fires, and small configuration mistakes get found systematically rather than by luck.
The supply side: hundreds of exposed operator panels
The upstream story is equally concrete. TechCrunch reported on Nov. 6 that Censys identified more than 800 distinct Artex deployments accessible from the public web without any password (TechCrunch). Microsoft has described Artex as AI agents that can conduct cyberattacks “from reconnaissance through data exfiltration with little needed human interaction,” and the tool has been linked to the ConnectWise compromise and attacks on the Korean finance industry. Some of those exposed panels were not attacker infrastructure at all — they were authorized testers who misconfigured their own harness. That is the same pattern we flagged after exposed Cairn dashboards drove a 1,200-site campaign for about $5,000: agent harnesses are themselves attack surface.
Identity chaining is the new post-exploitation pattern
Cloudforce One’s incident response findings are the part operators should internalize. In multiple investigations over the past eight weeks, attackers gained initial access to a hyperscaler environment and pivoted directly into the customer’s Cloudflare environment. The root cause repeated: static, non-expiring tokens running inside CI/CD pipelines, with broad cross-environment access and — in the documented ARTEX case — no IP restrictions and no rate limiting.
Once inside, ARTEX created large numbers of new Worker scripts with names like artex-*, artex-pgrecon-*, artex-pgw-* and artex-do-*, each name correlating to a distinct behavior. The team observed activity exceeding 69 requests per minute across multiple parts of the infrastructure and 400 database dump requests in an hour, plus attempted persistence and session-token validation against other third-party applications. Much of this was lightly guided by a human operator — the framework supplied speed and breadth.
This is exactly the failure mode we describe when we say to treat every agent as a privileged user: an agent holding a static, broadly scoped credential turns one leaked token into lateral movement across tenants at machine speed.
What Cloudflare recommends — and what it maps to in your stack
Cloudflare packages its guidance as a six-pillar “Modern Security Model” (diagrammed above):
- Fortify the front gate — a WAF with advanced rules, including rate limits.
- Security station in the foyer — anomaly detection on all customer-facing web applications.
- Identify phony visitors — bot defense and challenges against mechanical request cadence.
- Remove the back door — identity-gated access (Zero Trust) for high-risk external and internal apps, plus micro-segmentation to stop lateral movement.
- Inspect deliveries — OpenAPI schema validation, mTLS, and a default-deny rule at the bottom of every ruleset.
- Neighborhood watch — threat intelligence for visibility into new frameworks and campaigns.
Read against the incident details, the list collapses into three urgent checks. First, inventory every static, long-lived token in CI/CD and replace it with short-lived, IP-restricted, rate-limited credentials — that was the single repeated root cause in Cloudflare’s investigations. Second, put rate limits and anomaly detection on authentication and admin endpoints, because autonomous frameworks probe exposed services and configurations relentlessly. Third, verify that internal diagnostics (/actuator-style endpoints, admin panels) are invisible from the internet, not merely locked — the same instinct behind our slopsquatting package-install gate for Claude Code and Codex, which assumes the supply your agent reaches may be hostile.
There is a defensive mirror image too. Cloudflare’s own Managed Defense harness shows the pattern defenders are converging on: deterministic reconnaissance before any model call, specialist agents instead of one general-purpose agent, and application code that validates every citation an agent makes against a versioned evidence package (Cloudflare Blog). Offense got parallel, graph-based and fast; defense that is a single agent reasoning over a flattened prompt will not keep up.
The practical takeaway for teams running coding agents and CI: your build infrastructure is now a target for other people’s agents. Gate package installs, rotate static tokens, and assume the scanner at your door is running a 1k-star autonomous framework rather than a script kiddie’s curl loop.
Sources: Cloudflare Blog — Adapting to AI penetration testing orchestrators, TechCrunch — Hundreds of Artex AI hacking tools found publicly exposed, Cloudflare Blog — Agentic security operations
