# SZB-99d2395657: Researchers link AntiFox AI pentesting platform to attacks on AWS credentials

Cybersecurity researchers say attackers used the AntiFox agentic penetration testing platform to steal AWS credentials and move laterally into compromised environments.

- Type: Breach
- Status: Corroborated
- Vendor: AntiFox
- Product: AntiFox AI pentesting platform
- Disclosed: 2026-11-11 15:34 UTC
- Sources: 1 distinct
- First seen by cve.now: 2026-11-11 16:12 UTC · Updated: 2026-11-11 16:15 UTC

> No statement or filing from AntiFox has reached cve.now yet. Every claim below is quoted from, and linked to, the source that made it.

Written by a model from the sources below. Verify against them.

## Summary

The researchers report that Alibaba Cloud systems hosting AntiFox interfaces were associated with confirmed malicious actions.

## What to do

- Rotate any AWS credentials that were used with AntiFox or stored where it runs
- Review AWS CloudTrail logs for unusual API activity and access from unknown sources
- Restrict network access to AntiFox interfaces and disable them if not needed
- Audit IAM roles and permissions for overly broad access

## Timeline

- 2026-11-11 15:34 UTC: Made public by The Hacker News
- 2026-11-11 16:12 UTC: First seen by cve.now
- 2026-11-11 16:12 UTC: [Posted on X by cve.now](https://x.com/i/status/2120550260074324381)

## Evidence (1 source)

- 2026-11-11 · Press · [The Hacker News](https://thehackernews.com/2026/11/antifox-ai-pentesting-platform-linked.html): “In several recently observed intrusions, Alibaba Cloud systems hosting AntiFox interfaces were associated with confirmed malicious actions against”

## Corrections

None so far.

Something wrong on this page? Report an error: https://github.com/sazabi/cve.now/issues/new?title=Wrong%20fact%20on%20SZB-99d2395657&body=https%3A%2F%2Fcve.now%2FSZB-99d2395657%0A%0AWhat%20is%20wrong%2C%20and%20the%20source%20that%20shows%20it%3A%0A

## Questions about the AntiFox breach

### Was AntiFox breached?

The Hacker News reports it. No statement from AntiFox has reached cve.now yet.

### What should AntiFox customers do?

Rotate any AWS credentials that were used with AntiFox or stored where it runs. Review AWS CloudTrail logs for unusual API activity and access from unknown sources. Restrict network access to AntiFox interfaces and disable them if not needed. Audit IAM roles and permissions for overly broad access.

## Related

- Started as early warning SZB-99d2395657, first seen 2026-11-11 16:12 UTC
- Browse: [Breaches](https://cve.now/breaches.md) · [Early warnings](https://cve.now/early-warnings.md)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/SZB-99d2395657
Site guide for agents: https://cve.now/llms.txt