Hackers run AntiFox AI agents in AWS credential-theft attacks

Attackers are using self-managed instances of AntiFox, an open-source agentic penetration testing platform, to attack web services and Amazon Web Services environments and steal credentials, according to a report published by BleepingComputer on 11 November 2026.

The instances are being hosted on Alibaba Cloud, the report says. Self-managed means the attackers run their own copies of the software on infrastructure they control, rather than using a hosted service operated by the project or a vendor. That removes any opportunity for an upstream provider to suspend an account or filter the activity.

Agentic penetration testing platforms are designed to let an AI agent carry out security testing steps on its own, chaining together reconnaissance and exploitation tasks that a human tester would otherwise run by hand. AntiFox is distributed as open source, which means anyone can download, modify and deploy it. The reported activity is a case of tool misuse rather than a flaw in the software itself: the attackers are using the platform as intended, but against targets they do not own.

The immediate goal described in the report is theft of AWS credentials. Stolen cloud access keys are a well-established route into a victim's wider cloud estate, and defenders have long treated credential exposure in web-facing services as a priority.

The available reporting does not identify the targeted organisations, the number of victims, the date the campaign began, or who is behind it. It also does not say how the AntiFox instances were configured, which AWS services were reached, or whether the attacks succeeded in any named case. No attribution has been made public, and this article does not speculate on one.

The episode fits a pattern that security teams have begun to watch closely: offensive tooling built for legitimate red teams being repurposed by attackers soon after release. With agentic tools, the concern is that a single operator can run many attack sequences at once, with less manual effort than traditional scripted tooling requires.

For defenders, the practical questions are unchanged by the use of an AI agent. Credentials exposed by web services remain the asset at risk. Organisations that rotate AWS keys, scope permissions tightly and monitor for unusual API calls from unfamiliar cloud ranges are in the same position against an agent-driven campaign as against a human one. Traffic originating from Alibaba Cloud address space is one indicator named in the reporting, though attackers can move hosting at will.

AntiFox's maintainers have not publicly commented on the reported abuse, and no vendor advisory has been issued.