AntiFox: when pentesting AI turns against the cloud

A penetration testing tool turned into a weapon

The security industry has spent months celebrating the arrival of AI agents in pentesting: tools capable of chaining reconnaissance, exploitation and privilege escalation without an analyst having to write every step. The latest alert from The Hacker News casts a shadow over that enthusiasm: AntiFox, an emerging agentic pentesting platform, has been linked to real campaigns in which Amazon Web Services (AWS) credentials were stolen and lateral movement occurred within compromised environments.

The key detail the report provides is that, in several of the observed intrusions, the Alibaba Cloud systems hosting AntiFox's interfaces appeared linked to confirmed malicious activity. In other words, this is not a theoretical tool or a lab experiment: there is concrete cloud infrastructure supporting attacks against production.

What lies behind the pattern: agents that do not distinguish between testing and attacking

The report does not detail the full modus operandi, so we should avoid filling gaps with assumptions. What we can read between the lines, and what fits with what we already see in the market, is a worrying pattern: AI pentesting platforms that, by design, need credentials with broad permissions in order to "test" a cloud's security. If those credentials fall into the wrong hands, or if the platform itself is deployed without isolation, the result is a perfect shortcut to production secrets.

AWS credential theft is not a minor incident. With valid access keys, an attacker can read buckets, launch instances, query parameters or access services the organization assumed were protected because they were "inside" its account. The subsequent lateral movement makes the problem worse: from a compromised account, the attacker jumps to other accounts, to on-premise systems connected via VPN, or to CI/CD pipelines with more permissions than necessary.

AI does not change the rules of the game: it accelerates them. A misconfigured or poorly protected agent is an employee with master keys and no supervision.

Why this matters to an SME

It is tempting to think that AntiFox and the AWS intrusions are a matter for large corporations. They are not. More and more SMEs in Seville and Andalusia have their ERP, their store or their backup in the public cloud, and more and more IT teams are trying AI-assisted security tools because they promise to do more with less. The risk appears on three very specific fronts:

• Test credentials with too much power. An IAM user created to "test" that ends up with administrator permissions is a time bomb. If it leaks, the attacker does not need to exploit anything: they walk in with a key.
• Third-party tools without isolation. Pentesting platforms, scanners or AI agents deployed in the same account and network as production multiply the impact of any failure.
• Zero visibility into what the agent does. If nobody reviews which API calls the tool makes, or which resources it touches, there is no way to detect anomalous use until it is too late.

This is not an isolated case of security tools turned into a vector. We already saw it with the Qlik Sense flaw and reverse shells, and it will happen again with any product that combines internet exposure and elevated permissions.

What we recommend at ForgeNEX

We are not asking anyone to stop using AI to test their security. We are asking them to do it with the same rigor they would apply to a production access. These are the measures we would apply in an SME or a small IT team:

1. Separate accounts and environments. Security tests should run in a different AWS account, with its own network and its own limits. Never in the account where the customer database lives.
2. Minimum and temporary permissions. Read-only credentials where possible, with short expiry and automatic rotation. No static keys with administrator permissions stored in a repository.
3. Audit the agent. Enable CloudTrail, log API calls and review what the tool does. If you cannot explain which permissions it used yesterday, you should not have it connected today.
4. Review the supply chain. Before adopting an AI pentesting platform, check who is behind it, where it hosts its infrastructure and what guarantees it gives regarding the handling of your credentials.
5. Response plan. If an AWS key is compromised, do you know how to revoke it, rotate the rest and review access in under an hour? If the answer is no, that is the first project.

The conversation about AI agent security is already in the market: CrowdStrike has made its move by acquiring Fiddler and Dreadnode, and vendors are starting to treat agents as identities that must be governed. AntiFox is a reminder that this governance is not optional: either you put it in place, or the attacker will put it in place at your expense.

Source: The Hacker News. Analysis and adaptation: ForgeNEX.