Cloudflare reports AI attack tools chaining stolen credentials across environments

Cloudflare says AI penetration-testing and exploitation tools are chaining stolen credentials to move across customer environments. The company reports that daily requests from these tools have grown by 30x since October 1, with over 50 framework families attempting to scan its customers globally in the last three days. Its incident responders found attackers compromising static, non-expiring tokens in CI/CD pipelines that granted broad access across environments. In one investigation, ARTEX used a compromised account-level API token, generating 400 database dump requests in an hour and attempting persistence. Cloudflare believes much of that incident's activity was lightly guided by a human operator.