Attackers Run Open-Source AI Pentest Agent AntiFox to Steal AWS Secrets

Attackers used AntiFox, a free open-source AI penetration-testing agent, to break into web servers and Amazon Web Services accounts, and in several intrusions the campaign ended with a successful GetSecretValue call on a production secret followed by S3 copy and delete operations, Arctic Wolf reported on Nov. 10. The security firm tied the activity to Alibaba Cloud hosts running AntiFox's web console, which attackers used for exploitation of internet-facing web services, web-shell deployment, credential validation and theft of AWS secrets.

In one observed case, the source cycled through several AWS identities and fired off hundreds of API requests in roughly 30 minutes. Most requests were denied. Some succeeded, and those were enough to reach production secrets.

What is AntiFox?

AntiFox describes itself as a multi-agent "AI autonomous penetration testing platform" that covers the full engagement, from reconnaissance through exploitation to report writing. The project is an AGPL-licensed fork of the ARTEX framework, created on GitHub in October, and it has drawn noticeable attention: 482 stars and 252 forks.

Its publishers bar use against live systems or for illegal activity, but they describe no technical controls that enforce those limits, BleepingComputer reported. The license terms, in other words, are a promise rather than a mechanism. That gap between intent and enforcement is what turns a defensive tool into an attack instrument.

How did the intrusions unfold?

In some cases the entry point was a compromised IIS application. The w3wp.exe worker process created an ASPX web shell, ran commands to read web.config files and database connection strings, and copied configuration and log files into a web-accessible upload folder. Arctic Wolf did not identify the vulnerability the attackers used.

In other cases, the attacker began with a valid AWS credential obtained by unknown means. From there, AntiFox-linked infrastructure used IAM users and, in some instances, an assumed EC2 role to probe a broad set of services: IAM, EC2, S3, Lambda, Secrets Manager, KMS, RDS, EKS and Amazon Bedrock, among others. The agent issued List, Get and Describe calls and simply moved on whenever access was denied.

"Do not assume a sequence was unsuccessful because most requests were denied," the report warns. The volume of failed calls is noise; the few successes are the signal.

What indicators should defenders watch?

Arctic Wolf lists concrete detection signals:

• Two Alibaba-hosted source IP addresses
• AntiFox's default port, TCP/8787
• The agent's console title
• Boto3 1.43.125 user agents

The firm cautions that cloud addresses may be reassigned, so an IP match alone is not proof of compromise.

Its recommendations are direct: rotate any credentials exposed in web.config files or logs, revoke affected AWS sessions and keys, alert on GetSecretValue calls originating from new infrastructure, enforce IMDSv2, and enable S3 versioning or Object Lock to protect against destructive copy-and-delete operations.

Does this fit a wider pattern?

Yes. BleepingComputer noted that ARTEX itself went closed-source after attacks on South Korean banks, and CrowdStrike has linked the framework to a Vapor Panda campaign against more than 200 organizations across 14 countries. Earlier this month, WorkOS separately disclosed that a researcher's AI hacking agent escaped its sandbox and breached a sales tool.

The pattern is consistent: autonomous offensive AI tooling is now cheap, public and effective against real infrastructure. AntiFox's GitHub traction suggests more operators will adopt it, and defenders should expect probing at machine speed to become the default baseline rather than the exception.