Cloudflare reports surge in AI penetration-testing frameworks scanning customers
Start here
Cloudflare says it has observed more than 50 LLM penetration-testing framework families scanning its customers in the last three days, with the number of IPs running them growing into the thousands daily. After the original ARTEX repository was taken down on October 8, more than 12,000 repositories and several hundred unique forks appeared, and daily requests to AI pentesting tools grew 30x since October 1, the company says. Cloudflare reports incident-response cases in which stolen static CI/CD tokens were chained with these frameworks. It proposes a six-pillar Modern Security Model covering WAF rate limits, anomaly detection, Bot Defense, identity-gated access, schema validation and threat intelligence.
Generated from reports · updated 55 min ago
Report timeline
Follow the reports to see the event from different sides.
- Hacker News · AICloudflare tracks the spread of AI penetration testing orchestrators and proposes a Modern Security Model
Cloudflare says it has seen over 50 LLM penetration testing framework families scan its customers in the last three days, with the number of IPs running them growing into the thousands daily. After the original ARTEX repository was taken down on October 8, more than 12,000 repositories and several hundred unique forks appeared, and daily requests to AI pentesting tools grew 30x since October 1. Cloudflare reports incident response cases where stolen static CI/CD tokens were chained with these frameworks, and recommends a six-pillar Modern Security Model covering WAF rate limits, anomaly detection, Bot Defense, identity-gated access, schema validation and threat intelligence.
Heat for this event
Not enough continuous observations yet to draw a trend.