Category: AI Agent Security | Reading time: 3 min
Arctic Wolf Labs has linked several real intrusions to AntiFox, a free, open-source "autonomous penetration testing" platform on GitHub. Alibaba Cloud systems hosting AntiFox interfaces were tied to confirmed malicious actions against internet-facing web services and the AWS environments behind them. In at least one case the activity ended in a successful request for a production secret from AWS Secrets Manager.
What AntiFox is
AntiFox describes itself as an AI-driven pentesting platform built on ARTEX, the agentic framework already seen in attacks this month. A planner, worker and main agent run an engagement from reconnaissance through exploitation to a finished report. At the time of The Hacker News report, the project had been forked 251 times and starred 474 times.
What the agents did
In some intrusions, access started at a compromised Microsoft IIS web application. The IIS worker process created an ASPX web shell and then ran commands to find web.config files and backups, read application settings and database connection strings, test a production database login taken from the config, and copy configuration and log files into a web-accessible folder. Arctic Wolf has not identified the flaw used to get code execution.
In other intrusions, the attacker started with a valid AWS credential obtained by means not yet determined. Using valid IAM identities, the agents checked the credentials and enumerated dozens of services, including IAM, EC2, S3, Lambda, Secrets Manager, KMS, RDS, EKS, DynamoDB and Amazon Bedrock. Most of these calls returned AccessDenied. Some did not: one run progressed to a successful GetSecretValue against a production secret, and another used a valid identity for S3 discovery and object operations.
Why it matters for teams deploying agents
The agent did not need a new technique. It succeeded only where a stolen login had more permission than its job required, and it tried every door quickly. Arctic Wolf says frameworks like this make pentesting techniques more accessible to attackers and apply them with more speed and consistency. GitGuardian counts about 45 open-source agentic attack frameworks that wire a model into a loop that runs tools and acts on their output.
For defenders, the practical points are the ones the report implies: scope each credential to the actions it actually needs, watch for bursts of List, Get and Describe calls from unfamiliar hosting networks, and flag IIS worker processes spawning PowerShell. The same logic applies to an organization's own agents. A permission that is never checked per action is a permission an attacker's agent can use too.
Source: The Hacker News | BleepingComputer | SecurityBrief