Cloudflare says AI pentest traffic grew 30 times in six weeks

A human running a penetration test probes one endpoint at a time. An AI orchestration framework runs the whole kill chain in parallel. The tool is free.

Cloudflare published its report on 13 November 2026. The post names ARTEX as the open-source agentic framework behind the trend. The post counts traffic. It lists what defenders have seen. It names six controls Cloudflare says shift the economics back.

What ARTEX is

ARTEX is an open-source Python framework. It uses LLMs to orchestrate the Cyber Kill Chain stages: reconnaissance, discovery, exploitation and exfiltration. It maps a target environment into a graph. That lets several agents work on different parts of the attack at once. Cloudflare's post calls it "the first widely adopted agentic penetration testing system".

What Cloudflare has seen

Daily requests from AI pentest and exploitation tools have grown 30 times since 1 October, Cloudflare says. In three days the company tracked more than 50 framework families scanning its customers. The IPs behind them run into the thousands. ARTEX itself has been forked more than 12,000 times since its takedown. Hundreds of similar frameworks have been published since 8 October.

One attack, in detail

Cloudflare describes a compromise where a company's CI/CD token had no IP restrictions and no rate limit. Once the token leaked, an AI attacker reached 69 requests per minute across many endpoints. The same key sent 400 database dump requests in a single hour. The company's logs show the pattern. Cloudflare uses it as the shape every team should expect.

The six controls

Cloudflare's "Modern Security Model" lists six things it says cut this traffic back. A Web Application Firewall with rate limits. Anomaly detection on endpoints that return bulk data. Bot detection in front of login and search. Identity-gated access with micro-segmentation on internal services. API schema validation with mutual TLS on machine-to-machine calls. A threat intelligence feed. These are the company's products. Read the list as a shopping guide from Cloudflare itself.

What this means

The number, 30 times since 1 October, is Cloudflare's own. It is based on its own traffic. The figure will differ at a different vendor. The direction of change is more useful than the exact figure. An open API with no rate limit, no bot detection and a wide credential is a soft target. A new class of attacker can now hit it at scale. The remedies are in the ordinary playbook. Scope tokens to an IP range. Cap request rates per key. Alert on any endpoint that starts returning rows in bulk.

Three cheap checks to do this week, with or without Cloudflare's products. Look for a token or API key in the repository or in a CI log. Test what happens when one key runs a thousand requests. Confirm that a bulk-export endpoint writes an alert rather than a row.

Source

Adapting to AI penetration testing orchestrators: The Modern Security Model, Cloudflare.