Researchers have uncovered a campaign in which an AI-driven penetration testing tool named AntiFox was exploited to compromise Amazon Web Services (AWS) credentials and move laterally within victim environments. Evidence shows that attackers accessed AWS production secrets by chaining exploitation methods together using AntiFox.
What Is AntiFox?
AntiFox is an autonomous penetration testing platform released on GitHub. It operates via a multi-agent system that includes a planner, main agent, and worker agents. Its workflow tracks a typical pentest engagement: reconnoitering the environment, mapping attack surfaces, executing exploits, capturing findings, and producing detailed reports. Unlike traditional tools that often conclude at reconnaissance, AntiFox emphasizes transforming discoveries into actionable exploits and evidence.
How It’s Been Misused
Cybersecurity firm Arctic Wolf Labs has observed actors using AntiFox — often hosted on Alibaba Cloud interfaces — to break into internet-facing web assets and leverage them into AWS environments. In some cases, attackers gained access to IIS-hosted web applications, deployed ASPX web shells via the w3wp.exe process, and used operating system commands to discover configuration files, connection strings, and database credentials. Attackers proceeded to read application logs, explore error directories, and even attempt internal database connections with credentials pulled from application backends.
In other instances, valid AWS credentials—obtained through unknown methods—were used to call APIs across multiple services including IAM, S3, Lambda, Secrets Manager, KMS, EC2, RDS, ECS, EKS, Redshift, Athena, Glue, API Gateway, CloudWatch, CloudFormation, and Amazon Bedrock. While many calls were denied, several succeeded. In particular, some attackers retrieved production secrets from AWS Secrets Manager and accessed objects in S3.
Broader Context: AI Agents in Attacks
This misuse of AntiFox is part of a wider trend where AI-powered penetration testing tools like ARTEX are being weaponized. These tools allow fewer human operators to orchestrate complex attack chains at machine speed. Examples include verified campaigns where AI agents scan for misconfigurations, steal API keys, and use them to fuel further attacks. Many of these systems are open-source agentic frameworks built to integrate AI models into loops that perform reconnaissance, exploitation, and post-compromise persistence.
Reports indicate dozens of exposed ARTEX consoles globally, some leaking databases. Other frameworks—across categories such as network kill chains, web and API testing, command-and-control (C2)-integrated systems, and research prototypes—are increasingly accessible, making advanced attack tactics available to less skilled actors.
The AntiFox platform itself, as of the latest data, has been forked over 250 times and has nearly 500 stars on GitHub, reflecting growing interest in agentic pentesting tools.
Implications and What to Watch
The rise of agentic AI pentesting platforms like AntiFox raises serious risks for cloud security. Tools that automate discovery and exploitation compress the timeline for attackers, enabling rapid progression from breach to data exfiltration. The ability to misuse AI agents to access secrets in production environments heightens the urgency for defenders to harden web apps, validate IAM credentials, restrict privilege, and monitor anomalous API usage.
Organizations should review their asset exposure, ensure web-facing services are patched and locked down, rotate credentials stored in code or configuration files, and enforce least-privilege access policies. Detection tools and continuous monitoring become critical when attacks can be automated at scale.
This development shows how dual-use tools can be repurposed by threat actors. As AI continues to empower both defenders and adversaries, vigilance, safeguards, and rapid response mechanisms will mark the difference between exposure and resilience.
