Cloudflare Modern Security Model: Defending Against LLM Pentest Orchestrators

Cloudflare says agentic penetration orchestrators have gone from a single major framework to dozens of families scanning its customers in days—and that daily attack volume from those tools rose roughly 30× since October 1, 2026. In a November 13 post, Cloudforce One argues legacy perimeter models cannot keep pace with volumetric, parallel LLM agents, and it publishes a Modern Security Model with six defensive pillars. ARTEX and its forks still drive more than 60% of the traffic Cloudflare attributes to this class of tooling, even after the original repository came down on October 8.

If your team runs Claude Code, Codex, or MCP-heavy workflows, the post matters twice: as edge defense guidance for anything you expose to the internet, and as a reminder that CI/CD and API tokens—the same secrets agents copy during refactors—are what attackers chain into artex-* automation once they slip out.

TL;DR

Scale after the ARTEX takedown

Cloudflare's opening data points set the stakes:

• Three days, 50+ families attempting scans against Cloudflare customers globally, with thousands of source IPs still climbing.
• ARTEX removal on October 8 correlated with a hydra effect: 12,000+ repositories, hundreds of unique forks with upstream lineage, and hundreds of new frameworks in the following weeks.
• Daily requests from a tracked subset of AI pentest orchestrators grew more than 10× after October 8 and more than 30× since October 1.

Image: Cloudflare

That aligns with independent exposure counts—1,600+ internet-facing ARTEX consoles, Check Point's 1,800+ instances, and the FBI's November 13 FLASH noting continued fork proliferation (FBI ARTEX breakdown).

What is an LLM penetration orchestrator?

Cloudflare defines these frameworks as systems that run the Cyber Kill Chain at scale by connecting MCP tools, traditional pentest utilities, and parallel planner/worker agents that map environments onto graphs—ARTEX's model matches Unit 42's behavioral descriptions. Operators can steer objectives, but fully autonomous modes represent a doctrinal shift: human skill stops being the bottleneck, parallelism replaces single-threaded operators, and small misconfigurations get found through relentless iteration.

The post's comparison table highlights five star-heavy projects:

Cairn is the row coding-agent users should notice: it is not hypothetical abuse of your IDE—it is a published architecture for aiming the same harnesses you authorize at targets. Defenders already track Cairn in autonomous attack reporting (CAIRN STA-1238 coverage). Separate authorized red-team Cairn use from stolen API keys that let criminals approximate the same speed with ARTEX forks.

Cloudflare also stresses MCP composition: orchestrators snap together existing tools in novel ways, echoing why MCP supply-chain hygiene and skill scanning matter for your agents even when the attacker framework runs elsewhere.

What changed in the last six weeks (Cloudflare telemetry)

Cloudflare pairs its qualitative model with charts that are worth saving in your threat-intel folder even if you are not a Cloudflare customer. The vendor says unique IPs running any tracked AI pentest orchestrator climbed steadily through October, with a steep acceleration after October 8—the day Autumn-27 removed the upstream ARTEX repository. A second chart breaks out tool share by family over the last three complete days before publication; ARTEX and forks still clear 60%, with LuaN1aoAgent, Decepticon, Cairn, and PentestGPT-Agent splitting the remainder.

That matters for capacity planning: volumetric controls you sized for human-driven scanners may be undersized for dozens of independent agents retrying every failed path. It also explains why pure IOC blocking fails—when hundreds of frameworks share Playwright, curl, and Python HTTP clients, the same user-agent block list cannot distinguish Microsoft's published ARTEX tool defaults from legitimate CI traffic without tight correlation.

Fork proliferation is not abstract. Cloudflare counts 204 public repositories with their own code changes in a fork tree visualization, grouped by type and sized by stars—separate from the 12,000+ broader repository count that includes mirrors and renamed uploads. Defenders auditing "did we ever pull ARTEX into CI for testing?" should search dependency graphs and container base images, not only GitHub stars on the original org.

Identity-chained exploitation

Beyond scanning noise, Cloudforce One describes post-compromise chaining:

• Attackers reused static, non-expiring CI/CD tokens without IP allow lists, granting broad cross-environment access across hyperscaler estates.
• LLM frameworks increased the odds those tokens lateral into SaaS control planes—including customer Cloudflare accounts after initial access via a third-party cloud.

In one investigation, operators with a compromised account-level Cloudflare API token created numerous Worker scripts named artex-*, artex-pgrecon-*, artex-pgw-*, and artex-do-*, each mapped to behaviors. Cloudflare observed 69+ requests per minute across customer infrastructure, ~400 database dump requests in an hour, persistence attempts, and third-party session token validation. The activity was partly operator-guided, but the speed illustrates why Datadog's CloudTrail hunting and AntiFox AWS chains focus on credentials, not framework binaries.

The Modern Security Model (six pillars)

Cloudflare translates the problem into an estate metaphor—each pillar is a control class, not a product checkbox:

Image: Cloudflare

1. Fortify the front gate — WAF plus rate limits and volumetric filtering before traffic reaches origin (answers scanner floods).
2. Security station in the foyer — Anomaly detection on paths and request rates; block heap-dump and traversal tricks agents iterate quickly.
3. Identify phony visitors — Bot defense and challenge flows; agentic scanners rarely match human cadence.
4. Remove the back door — Identity-gated access and micro-segmentation so admin panels are not discoverable from the public internet.
5. Inspect deliveries — OpenAPI schema validation, mTLS, and default-deny rulesets on APIs agents abuse for IDOR and upload flaws.
6. Neighborhood watch — Threat intelligence feeds to refresh watchlists when new orchestrator infrastructure appears.

The post argues defense-in-depth DMZ thinking fails when agents parallelize validation across the kill chain—you need containment-first architecture because users and pipelines keep losing long-lived keys.

How Beam handles this

Beam overlaps only on the developer machine slice: it heuristically scans skills and MCP configs, watches PreToolUse hooks on Claude Code and Codex for risky command patterns, and redacts secrets before local event storage. That can catch an engineer pasting a Cloudflare API token into a prompt or a skill that shells out to exfiltration tooling.

Beam does not terminate Cloudflare Workers, absorb WAF logs, or enforce Zero Trust access at the edge. It is not a substitute for Cloudflare's controls or for rotating the CI/CD tokens Cloudforce One blames in its root-cause narrative. Treat Beam as local observability while the Modern Security Model covers internet-facing blast radius.

For teams also running Cloudflare's own security-audit skill, keep the skill's OS sandbox requirement—offensive orchestration research belongs in isolated environments, not production laptops.

Translating each pillar for application owners

Cloudflare's estate metaphor is marketing-friendly, but each pillar maps to tickets your platform team can open this quarter:

Fortify the front gate — Move rate limiting and bot scores in front of origin, not only on the origin web server. Agentic scanners generate sustained 4xx/5xx feedback loops; if your origin pays per request, you are funding the attacker's learning loop. Pair with geographic or ASN-based policies only as a temporary brake—operators already rotate residential proxies per Check Point console research.

Security station in the foyer — Encode rules against path normalization tricks (//admin//, doubled slashes) and diagnostic endpoints that return stack traces. Cloudflare explicitly calls out agents attempting to haul heap dumps through the front door—mirror that with disabled actuator routes on Spring apps and locked-down ASP.NET debug pages.

Identify phony visitors — Challenge flows should trigger on cadence, not only IP reputation. Agentic tools often present coherent browser fingerprints while behaving non-human in timing—exactly the pattern Unit 42's think-then-act table documented on victims.

Remove the back door — If an admin UI has ever been internet-reachable "temporarily," assume crawlers indexed it. Identity-gated access means no socket listening on the public internet for that path, not merely a strong password.

Inspect deliveries — OpenAPI validation is the API equivalent of schema-checked deserialization. Agents probing IDOR and mass-assignment bugs generate high volumes of 422 responses that change shape within seconds—alert on that self-correction loop, not only on success.

Neighborhood watch — Subscribe to ISAC or vendor intel that tracks new orchestrator releases, not only CVEs. The FBI's November 13 ARTEX FLASH is an example of government packaging you can feed into SIEM reference sets.

What this means if you run AI coding agents

1. Treat pipeline tokens like runtime secrets — Cloudflare's IR case hinged on unscoped API tokens living in automation. Agents that search CI YAML or .env files can surface those values to logs; store them in scoped secret managers and rotate after any repo leak.
2. Watch Cairn-class glue — Any internal automation that dispatches Codex or Claude Code against live URLs needs the same authorization and scope controls you would demand of ARTEX in an enemy's hands.
3. Pair edge controls with behavior hunts — Blocking artex-pentest/1.0 user agents fails open when operators randomize strings (Microsoft guidance); combine WAF rate limits with Entra, CloudTrail, and Cloudflare audit logs for burst enumeration.

Practical hygiene commands on the workstation side:

# Find Cloudflare or hyperscaler tokens in tracked files before an agent refactors them
rg -n 'CF_API|CLOUDFLARE_API|AKIA[0-9A-Z]{16}' apps infra .github

# Confirm Claude/Codex hooks still log tool access to sensitive paths (Beam collector)
# See Beam docs on workspace policy: observe vs enforce on credential file reads.

Frequently asked questions

See the front matter FAQ for framework list details, the ARTEX takedown timeline, Cloudflare's IR anecdote, user-agent limitations, and the coding-agent angle. Cloudflare positions the Modern Security Model as vendor services plus architecture; smaller teams should prioritize inventory, token lifetime, and API default-deny even if they do not buy every Cloudflare module.

Related reading

• FBI FLASH on ARTEX TTPs and IOCs
• Google and Mandiant: agentic framework defenses
• Wiz: agentic attack fingerprints
• GitGuardian: 45+ agentic pentest frameworks on Shodan
• Cloudflare security-audit skill safety
• Cloudflare Kitesurf open source: agent browser and CDP on Workers
• Beam: how it works and local-first posture

Vendor reporting on the same week from Microsoft on ARTEX in financial sector attacks and Check Point on operator consoles reinforces Cloudflare's volume narrative from different vantage points.

Cloudflare product names, telemetry figures, and incident details above come from Cloudflare's November 13, 2026 blog post unless otherwise linked. Re-check the primary post before designing blocking rules or token policies.