Cloudflare tracks the spread of AI penetration testing orchestrators and proposes a Modern Security Model

Cloudflare says it has seen over 50 LLM penetration testing framework families scan its customers in the last three days, with the number of IPs running them growing into the thousands daily. After the original ARTEX repository was taken down on October 8, more than 12,000 repositories and several hundred unique forks appeared, and daily requests to AI pentesting tools grew 30x since October 1. Cloudflare reports incident response cases where stolen static CI/CD tokens were chained with these frameworks, and recommends a six-pillar Modern Security Model covering WAF rate limits, anomaly detection, Bot Defense, identity-gated access, schema validation and threat intelligence.