Cloudflare says more than 50 LLM pentest orchestrator families now scan its customers remotely, with daily tool requests up 30x since Oct 1 according to the company.
Autumn-27 pulled the plug.
The ARTEX creator, described by authors Blake Darché, Myles Sloan and Jacob Crisp with Cloudforce One as the team behind the post, wrote that malicious exploitation runs entirely counter to its original intent according to Cloudflare. The takedown did not hold, with Cloudflare counting more than 12,000 repositories and 204 public forks with their own code changes according to the company, plus thousands of IPs running the frameworks with volume still rising daily according to the company.
Cloudflare says the shift is doctrinal, not incremental. A harness now runs the full loop of observe, orient, decide and act without human skill as the limit according to the company, with parallel agents mapping assets into graphs and turning compromise into a hill climb.
The company prescribes what it calls the Modern Security Model. It starts with WAF plus rate limits at the front, anomaly detection on customer facing apps, bot defense, identity-gated access for high risk external and internal apps, validated schemas, and threat intelligence for visibility according to the company.
The forks tell a different story about intent. The BaaRai translation presents ARTEX as a Go monolithic backend with embedded Next.js frontend plus PostgreSQL per its GitHub page, while the jiwoochris artex-global edition defaults to English and switches to Korean, Chinese, Spanish and Japanese per its GitHub page. That edition says it is for authorized, defensive and detection use only per its GitHub page.
Cloudflare says some complex attacks now chain stolen customer credentials for lateral movement according to the company. The fork maintainers say defensive use only. Both claims use the same lineage.
Who decides which autonomous run was authorized when the code, the graph and the traffic all look the same?
