Cloudflare: AI penetration-testing traffic up 30x as stolen CI/CD tokens enable real breaches

Cloudflare's threat research team, Cloudforce One, reported on November 14 that requests from AI-powered penetration-testing tools grew more than 30-fold between October 1 and November 12, and that it has confirmed real intrusions in which attackers combined those tools with stolen CI/CD tokens. In the most recent three-day window alone, more than 50 frameworks probed Cloudflare customers from thousands of IP addresses, according to the report as covered by Japanese outlet Joho no Todai.

A 30-fold rise, carefully measured

Cloudflare stresses that the 30x figure does not mean global attack volume multiplied. It measures growth in requests from a specific set of AI penetration-testing tools observed on Cloudflare's own network, multiple tools can run from a single IP address, and IP counts, tool counts, scan attempts and confirmed breaches are separate metrics.

The surge centers on a tool called ARTEX and its derivatives, which accounted for more than 60% of the tools Cloudflare tracked as of November 12. Other tools named in the report include LuaN1aoAgent, Decepticon, Cairn and PentestGPT-Agent. These systems use large language models to split work across multiple AI agents that gather target information, enumerate services, probe for vulnerabilities and choose what to examine next. Because the Model Context Protocol (MCP) can connect existing security-testing tools, an agent does not need to write new attack code — it can chain off-the-shelf tools and use each finding to plan its next step, pivoting from one weakness to other systems more easily than a single-vulnerability scanner.

Deletion fed the spread

ARTEX's developer, Autumn-27, deleted the public repository on October 8, saying the tool's misuse contradicted its original purpose. The removal had the opposite effect. Cloudflare now counts more than 12,000 related repositories, including hundreds of public derivatives, and its lineage analysis found 204 public repositories carrying independent code changes. Cloudflare calls this the "hydra effect": deleting the original, amplified by widespread coverage of the deletion, drove a wave of forks and modified copies. Within roughly five weeks, requests from these tools grew more than tenfold and then passed 30 times their earlier level.

Inside the confirmed breach

The report's most consequential section describes incidents Cloudforce One handled over the past eight weeks, in which non-expiring static access tokens used in CI/CD pipelines were compromised and gave attackers broad privileges across multiple cloud environments.

In one case, ARTEX operated with a compromised account-level API token that originated from a third-party hyperscale cloud, with no IP-address restrictions and no request limits. The attacker created numerous Worker scripts — programs running in Cloudflare's serverless environment — under role-specific names such as artex-, artex-pgrecon- and artex-pgw-*. Cloudflare observed more than 69 requests per minute and 400 database-dump requests within a single hour, though it notes the 400 counts dump requests, not successful extraction from 400 databases. The attackers also attempted to establish persistence and tested whether session tokens worked against other services. Cloudforce One believes a human operator likely guided much of the activity.

Defense on both sides of the perimeter

Cloudflare groups its recommendations into six areas — WAF and rate limiting, anomaly detection, bot protection, authenticated access controls, API schema validation and threat intelligence — under what it calls its "Modern Security Model." The report acknowledges this maps to Cloudflare's own products, but the underlying steps apply broadly: rate-limit probing traffic, validate input so unexpected API calls are rejected, require authentication for administrative interfaces, cut API-token privileges to the minimum, set token expiration dates and reissue tokens regularly, restrict which source IP addresses may use a token, separate credentials across development, testing and production, and watch access logs for anomalous privilege use.

The breach illustrates why: a WAF can block external vulnerability probing, but API operations performed with valid credentials happen inside that boundary. A long-lived, broadly privileged, unrestricted token turned a development-side compromise into access to production systems — and AI agents can explore that path across more services, and faster, than a person could.

Why it matters

The shift is not AI inventing unknown vulnerabilities. It is speed and breadth: open-source agent frameworks now let almost anyone chain existing testing tools continuously, decide next steps from findings, and sweep multiple environments in a short time. Cloudflare also notes these tools have legitimate, authorized uses in security assessment, so a tool name or IP address alone does not prove malicious intent. The confirmed incidents point to the real risk: AI agents combined with over-privileged, non-expiring credentials that sit outside perimeter defenses. Credential hygiene — least privilege, expiry, IP restrictions and environment separation — is now a frontline AI-era control rather than routine housekeeping.