Cloudflare reports 30x surge in autonomous LLM penetration-testing frameworks

Cloudflare says the population of LLM-driven penetration-testing and orchestration frameworks has exploded in roughly a month, and that defenders are struggling to keep up with the volume of autonomously guided attacks. In a blog post published November 13, the company reports that more than 50 framework families attempted to scan its customers in the past three days alone, and the number of IP addresses running such tools has reached the thousands and keeps growing daily.

From one framework to an ecosystem

According to Cloudflare, ARTEX — an open-source agentic system that automates offensive security workflows — was until recently the only framework of its kind. Its creator, Autumn-27, removed it on October 8, stating that malicious use of the tool contradicted its original purpose.

The takedown appears to have backfired. Cloudflare now counts more than 12,000 related repositories, several hundred forks carrying code lineage from the original project, and hundreds of additional agentic orchestration frameworks built since the removal.

The traffic numbers track that growth: daily requests from AI pentesting and exploitation tools are up 30x since October 1 and more than tenfold since the takedown. As of November 12, ARTEX and its forks represented over 60% of the AI pentesting orchestrators Cloudflare can identify. The company attributes the steep acceleration in unique tool instances around October 8 to a hydra effect, in which deleting the original repository multiplied its descendants.

What these tools actually do

Cloudflare describes these orchestrators as harnesses that drive AI agents through stages of the traditional Cyber Kill Chain at scale. They can plug into the Model Context Protocol, chain conventional standalone pentesting tools together in new ways, and in some cases take operator direction on which task to pursue. ARTEX and its forks map targets and environments onto a graph, letting multiple independent agents enumerate, verify, prototype and attack in parallel, constrained by inference speed rather than human effort. In Cloudflare's assessment, this turns compromise into a task agents handle well: iterative, incremental progress toward a goal.

Cloudflare is tracking more than 50 AI LLM agents in this category. The five most prominent — ARTEX and its forks, LuaN1aoAgent, Decepticon, Cairn and PentestGPT-Agent — each have more than 1,000 GitHub stars and run fully autonomously. Their designs differ: LuaN1aoAgent coordinates supervisor, planner and executor agents over three linked graphs and ships built-in SSH and Chisel tunneling with reconnection behavior; Decepticon dispatches specialist sub-agents from a Kali container running as root and includes Active Directory and cloud pivoting skills; Cairn delegates work to existing AI harnesses such as Codex and Claude Code.

The autonomy itself is the doctrinal shift, Cloudflare argues. The full observe-orient-decide-act loop runs without a human, parallel agents move faster than single operators, one person can target multiple organizations simultaneously, and relentless systematic testing of exposed services reliably surfaces small configuration mistakes.

Chained credentials in real incidents

Over the past eight weeks, Cloudflare's Cloudforce One team has handled multiple incident response cases involving ARTEX and ARTEX-derived frameworks. A recurring root cause: static, non-expiring tokens embedded in CI/CD pipelines that grant broad access across an organization's hyperscaler infrastructure. In several incidents, attackers used that initial foothold in a hyperscaler environment to pivot directly into the victim's Cloudflare environment.

In one case, ARTEX obtained a compromised account-level API token previously used for CI/CD that had no IP restrictions or rate limiting, with evidence pointing to a third-party hyperscaler as the likely origin of the compromise. Cloudflare's broader conclusion is that LLM frameworks substantially raise the odds that a stolen API key gets leveraged laterally to take over other tenant environments.

Cloudflare's recommended response

Cloudflare urges every organization to adopt what it calls the Modern Security Model, built on six pillars:

• A web application firewall with advanced rules such as rate limits
• Anomaly detection on all customer-facing web applications
• Bot defense to filter illegitimate visitors
• Identity-gated access for all high-risk external and internal web applications
• Validated schemas and explicit security controls on inputs
• Threat intelligence for visibility into ongoing attacks

Why it matters

The story reframes a familiar security problem. Offensive tooling has been automatable before, but Cloudflare's data suggests that autonomy, parallelism and open distribution have removed the two frictions defenders implicitly relied on: attacker skill and attacker attention. A single operator can now aim dozens of autonomous agents at many organizations at once, and those agents will methodically find the misconfiguration or over-scoped token a human might have missed. That makes unglamorous fundamentals — WAF rules, bot management, identity gating, and above all retiring static, non-expiring CI/TD credentials with broad scopes — the difference between a contained incident and cross-tenant compromise. The ARTEX takedown carries its own lesson: removing popular open-source tooling can accelerate rather than suppress its spread.