Cloudflare sits on enough traffic to see agentic pentests graduate from GitHub curiosity to daily background radiation. In a November 13, 2026 post, the company says 50+ LLM-driven penetration frameworks scanned its customers in 72 hours, ARTEX and forks exceeded 60% of attributed unique attacker IPs, and daily request volume from tracked tools rose more than 30× since October 1. The upstream ARTEX author removed the original repository on October 8, yet Cloudflare describes a hydra effect: forks accelerated instead of slowing abuse.
This article explains Cloudflare's telemetry, the Modern Security Model six pillars, the CI/CD token incident Cloudforce One investigated, and how API builders should prioritize fixes if you do not use Cloudflare at all.
TL;DR #
| Question | Answer (source: Cloudflare Nov 13, 2026) |
|---|---|
| How fast did traffic grow? | 30×+ daily requests from tracked AI pentest tools sinceOct 1 ;10×+ afterOct 8 takedown | | Who leads the pack? | ARTEX + forks > 60% of orchestrator IPs (Nov 12 snapshot) | | How many tools? | 50+ families; table highlightsLuaN1aoAgent ,Decepticon ,Cairn ,PentestGPT-Agent | | What changed doctrinally? | Agents run full OODA loops in parallel; humans set goals, not each exploit step | | What does Cloudflare recommend? | Six pillars : WAF, anomaly detection, bot defense, identity gating, schema validation, threat intel | | Real incident lesson? | Long-lived CI/CD tokens without IP limits enabled mass Worker creation and DB dump attempts |
Agents that act on your behalf need rules. See how explainx helps secure your agents →
Why Cloudflare's numbers matter to API teams #
You do not need a pentest contract to get scanned anymore. Orchestrators like ARTEX accept a natural-language objective, build a graph of assets and findings, and spawn parallel agents that call real tools through MCP integrations. Cloudflare's post stresses three shifts:
- Human skill stops being the bottleneck — agents iterate exploit paths at inference speed.
- Parallelism — many agents chase the same goal concurrently, unlike single-threaded human red teams.
- Scale per operator — one actor can run campaigns across many orgs simultaneously.
That matches what Check Point Research saw from exposed operator consoles: after the initial prompt, humans mostly watched progress bars while agents worked.
If your product exposes admin panels, webhooks, backup APIs, or CI/CD integrations, you are in scope regardless of industry.
Traffic and fork explosion
Cloudflare published charts for:
- Daily request volume from a selected set of AI pentest orchestrators
- Unique attacker IPs per day
- Unique tool instances over time
- IP share breakdown for the last three complete days before publication
The authors attribute the post-October 8 acceleration to publicity and fork proliferation — 12,000+ repositories and hundreds of unique forks with lineage from the original ARTEX project, plus entirely new frameworks spun up in weeks.
Cloudflare chart of daily requests from AI-driven pentest orchestrators including ARTEX growth
Image: Cloudflare
Top five orchestrators in Cloudflare's table #
Cloudflare's comparison table (November 13) is worth copying into your threat-modeling doc because it shows architecture diversity — defenders cannot tune one rule and forget.
| Framework | Planning style | Execution environment | Post-exploitation notes |
|---|---|---|---|
| ARTEX (and forks) | Planner + parallel agents | Host or container with network/root; installs tools freely | No built-in post-ex; operator-driven |
| LuaN1aoAgent | Supervisor + planner + executors | Container; can install packages | Built-in SSH/Chisel tunneling |
| Decepticon | Orchestrator dispatching specialists | Kali container as root | Active Directory and cloud pivot skills |
| Cairn | Dispatcher to harnesses (Codex, Claude Code, Pi) | Kali root or host | Prompt guidance + Kali tools |
| PentestGPT-Agent | Supervisor + executor | Host | Requires operator for post-ex |
Cairn is especially relevant for builders because it chains commodity coding agents into offensive graphs — the same agents your company may already deploy for internal automation. Governance on internal harnesses is now inseparable from edge defense; see loop engineering for coding agents.
The Modern Security Model: six pillars #
Cloudflare frames legacy "defense in depth" as insufficient when attackers validate each kill-chain step inside the orchestrator. Their replacement is six layers, explained with a home security metaphor:
Fortify the front gate (WAF + rate limits)
Stop volumetric probes and application abuse at the perimeter. Cloudflare ties this to L3/L4 floods and application floods alike. For agentic scanners, rate limits are economic weapons: agents burn tokens and wall-clock time when responses are slow or tarpitted — the same strategy Microsoft recommended with honeypots and fake wins.
Security station in the foyer (anomaly detection)
Detect path tricks (//admin//debug), burst knocks (hundreds of requests per few seconds), and oversized payloads meant to exfiltrate heap dumps. Agents excel at noisy edge cases humans skip; anomaly rules catch mechanical cadence.
Identify phony visitors (bot defense)
Headless automation does not behave like human browsers. Bot management and challenges filter recon scrapers before they touch authenticated routes.
Remove the back door (identity-gated access)
Admin panels and diagnostic endpoints should not be reachable anonymously from the internet. Zero Trust and micro-segmentation brick up cellar doors so there is no lock to pick from the sidewalk — only gated paths to specific rooms.
Inspect deliveries (schema validation + default deny)
OpenAPI validation, mutual TLS on sensitive routes, and explicit deny-all footer rules on positive security models. Agents send malformed payloads to probe parsers; schema enforcement rejects them at the porch.
Neighborhood watch (threat intelligence)
Feed global attacker infrastructure into local blocklists. Cloudflare positions this as early warning when syndicates spin up fresh command nodes — complementing reported FBI FLASH messaging on ARTEX the same day.
Cloudflare Modern Security Model diagram for defending against AI pentest orchestrators like ARTEX
Image: Cloudflare
Identity-chained exploitation: the Cloudflare incident #
The most actionable section is not the charts — it is Cloudforce One's case study.
Cloudflare says attackers obtained a compromised account-level API token used for CI/CD, with no IP restrictions and no rate limiting, likely originating from a third-party hyperscaler compromise. They then created numerous Worker scripts with names such as artex-*, artex-pgrecon-*, and similar prefixes tied to behaviors.
Observed activity included:
- 69+ requests per minute across multiple Cloudflare subsystems
- 400 database dump requests in one hour
- Persistence attempts and validation of third-party session tokens
Cloudflare believes a human lightly guided the campaign, but the speed and breadth still exceed manual red-team norms. That story rhymes with ConnectWise to Microsoft 365 chains: steal integration credentials, let agents pivot.
What builders should change after reading this
| Control | Why agents exploit the gap |
|---|---|
| Short-lived CI/CD tokens | Stolen static tokens become lateral keys |
| IP allowlists on automation creds | Cloudflare highlights missing IP bounds |
| Per-token rate limits | Slows dump and enumeration loops |
| Separate blast-radius accounts | Limits Worker or function sprawl |
| Audit logging on integration users | Detects permission changes agents make |
If you issue API keys to customers, assume attackers will feed them into Cairn-style dispatchers that wrap Claude Code or Codex — monitor for inhuman request regularity on those keys.
How Cloudflare's view fits other November reporting #
The same week:
- **[CERT-EU](https://cert.europa.eu/blog/from-penetration-testing-to-cyber-threat-beware-of-artex?ref=explainx)** published ATT&CK-mapped guidance on ARTEX misuse against EU institutions.
- **Microsoft** tracked**[Storm-3358](https://explainx.ai/blog/microsoft-storm-3358-cambodia-artex-financial-sector-november-2026)** in finance.
- Salesforce's public blog described ARTEX-style automation against customer orgs via compromised application credentials in November 2026 coverage — same tool class, different vertical from finance-focused Storm-3358.
Cloudflare adds edge-scale volume metrics other reports lack — useful when management asks whether agents are still "experimental."
How to protect yourself #
Operational checklist distilled from Cloudflare plus CERT-EU:
-
Emergency patch internet-facing apps; agents find stale SSRF and upload bugs first.
-
MFA everywhere on cloud control planes and admin SSO.
-
WAF rate limits on auth, search, and export endpoints.
-
Remove public admin UIs ; put them behind identity-aware proxy paths.
-
Hunt
artexprefixes in serverless deploy logs if your platform allows user-defined script names. -
Threat intel feeds on known ARTEX operator hosts fromCensys reporting . Teams building defensive agents should read AgentBeam's ARTEX hunting notes alongside Cloudflare's pillars — runtime blocks for dangerous tool calls complement edge rules.
What changes if you are not on Cloudflare #
You can still map the six pillars to your stack:
| Cloudflare pillar | Non-Cloudflare equivalent |
|---|---|
| WAF + rate limits | AWS WAF, Fastly, Akamai, or reverse-proxy rules on nginx |
| Anomaly detection | App-layer RASP or custom SIEM rules on path entropy |
| Bot defense | CAPTCHA, Turnstile competitors, or device fingerprint vendors |
| Identity-gated access | Okta, Cloudflare Access equivalents, VPN with device posture |
| Schema validation | OpenAPI gateways, API management policies |
| Threat intel | ISAC feeds, commercial TI, MISP communities |
The incident story — long-lived automation tokens with cloud-wide scope — is vendor-neutral. Whether scripts deploy as Cloudflare Workers, Lambda functions, or Kubernetes jobs, the fix is short TTL, scoped IAM, and break-glass auditing.
What developers are asking #
Do I need to block MCP endpoints? Not blindly. Block unauthenticated tool gateways on the public internet; keep internal MCP behind SSO and network policy. ARTEX abuses MCP to wire scanners together; your dev MCP server should never be reachable without auth.
Will rate limits break legitimate CI? Tune exemptions per token, not per IP alone. Cloudflare's case shows attackers reused CI credentials; legitimate pipelines should use separate tokens with commit-scoped permissions and concurrency caps.
Is ARTEX illegal to download? Forks are public; unauthorized use against third parties is what law enforcement targets. Authorized red teams should use contract-scoped harnesses with logging, not random forks with default credentials.
Related reading #
Cloudflare product names and telemetry descriptions reflect its November 13, 2026 blog post. Fork counts and IP shares change daily — re-check the source before executive reporting.