Anti-fox AI agents are associated with stealing AWS credentials.
The attackers are using Alibaba's cloud-hosted instances of Antifox, an open source agent testing platform, in hacks targeting web services and AWS environments. Observed activity included deploying webshells on exposed IIS servers, validating credentials, revealing configuration, abusing AWS APIs with valid IAM users and EC2 roles, and in some cases accessing production secrets and S3 objects.
The report shows that AI-enabled offensive tools are deployed as an intrusion workflow layer rather than a standalone capability. The key signal is a combination of web compromise with short bursts of authenticated AWS API activity, including repeated rejected calls mixed with successful access using app-held credentials.
Open sources - closed narratives.