# Cloudflare reports AI attack tools chaining stolen credentials across environments

_Published Saturday, November 14, 2026 at 3:06 AM EST · Security, AI · Latest · Tier 2 — Notable_

![Cloudflare reports AI attack tools chaining stolen credentials across environments — Primary](https://blog.cloudflare.com/_emdash/api/media/file/01M7B3YCV0VN7GFCA6VK7EE9RR.png)

Cloudflare says AI penetration-testing and exploitation tools are chaining stolen credentials to move across customer environments. The company reports that daily requests from these tools have grown by 30x since October 1, with over 50 framework families attempting to scan its customers globally in the last three days.

Its incident responders found attackers compromising static, non-expiring tokens in CI/CD pipelines that granted broad access across environments. In one investigation, ARTEX used a compromised account-level API token, generating 400 database dump requests in an hour and attempting persistence. Cloudflare believes much of that incident's activity was lightly guided by a human operator.

## Sources

- [The Cloudflare Blog](https://blog.cloudflare.com/adapting-to-ai-penetration-testing-orchestrators/)

---
Canonical: https://techandbusiness.org/newswire/u4sVCOZPkX2keJ_zpOBEZe
Published: 2026-11-14T08:06:12.575Z
Story chronology: 2026-11-13T19:26:07.564Z
Retrieved: 2026-11-15T01:02:13.224Z
Publisher: Tech & Business (techandbusiness.org)