Cloudflare says more than 50 AI penetration-testing framework families attempted to scan its customers in the preceding three days. Its November 13 research also reports a more than thirtyfold rise in attributed daily requests since October 1.
Those figures describe observed traffic, not successful compromises. Tool counts and request volumes cannot establish how many organizations were breached.
The stronger warning comes from incident investigations. Cloudflare says attackers used compromised, non-expiring CI/CD tokens to move between cloud environments. In one case involving ARTEX, investigators saw multiple newly created Worker scripts and 400 database-dump requests within an hour. Requests do not prove that every attempted extraction succeeded.
For defenders, the useful question is how much authority one exposed credential carries. Reviewing token scope, expiration and cross-environment permissions provides a concrete starting point. Detection should correlate credential use with subsequent administrative actions, rather than treating every automated probe as evidence of an intrusion.
Image: Cloudflare.
