Cloudflare Warns of 30-Fold Surge in Automated AI Cyberattacks

Automated security testing tools powered by large language models have grown rapidly over the past several weeks. Cloudflare reports that daily requests from artificial intelligence penetration testing and exploitation tools have increased 30-fold since October 1. Over 50 different framework families have attempted to scan Cloudflare clients globally, with thousands of IP addresses running these automated systems.

The Spread of Agentic Frameworks

The sudden surge began after the open-source offensive security tool ARTEX was taken down by its creator on October 8 due to malicious misuse. The removal triggered a hydra effect. Developers created thousands of forks and altered versions, yielding more than 12,000 repositories related to the original code. Hundreds of similar agentic orchestration frameworks have emerged since the shutdown.

These modern frameworks coordinate software agents to run attack stages at the speed of model inference. By deploying multiple parallel agents, a single user can target several organizations simultaneously. The tools automatically map networks, analyze target environments, and run exploit attempts without needing constant human guidance.

Compounded Security Risks

Attacker methods are becoming more advanced as these software frameworks evolve. Investigators at Cloudforce One have observed incidents where threat actors combined stolen login details with AI frameworks to navigate deeper into victim networks. In several cases, attackers stole static, non-expiring credentials from continuous integration pipelines, granting broad access across cloud environments.

Recommended Defenses

To defend against automated AI attacks, Cloudflare recommends a multi-layered security strategy:

• Use web application firewalls with rate-limiting rules.
• Deploy anomaly detection across all client-facing web applications.
• Use bot defense systems to identify automated traffic.
• Implement identity-gated access for sensitive internal and external software.
• Enforce strict schema validation and monitor threat intelligence feeds.