Key Takeaways
- The FBI's FLASH alert of November 13, 2026, says a variety of malicious cyber actors have used the Artex AI penetration testing framework since at least August 2026 against organizations in sectors including finance, government, defense, energy, and healthcare.
- The FBI said some intrusions run with Artex progressed from initial targeting to privileged access in under three hours.
- The FBI said researchers found more than 1,600 publicly exposed Artex console instances as of early November 2026, even though the original developer removed the GitHub repository in October 2026.
- Amazon Threat Intelligence said on November 13, 2026, that Artex agents ran a self-sustaining campaign to steal AI model credentials, in which stolen keys paid for the AI that powered further credential hunting.
What happened
The FBI released a FLASH alert, numbered FLASH-20261113-001, on November 13, 2026, about Artex, an open-source framework that uses large language models (LLMs), the AI models behind chatbots, to run AI agents. The alert says threat actors have weaponized Artex to "automate multiple phases of cyber intrusions at machine speed, from reconnaissance through data exfiltration."
Artex was built for penetration testing, which its developer described as authorized security testing within defined scopes, the FBI said. Since at least August 2026, a variety of malicious cyber actors have used it against organizations worldwide in financial services, government, technology, defense, semiconductors, energy, healthcare, manufacturing, telecommunications, and legal services, according to the FBI.
"Artex significantly reduces the time required to chain attack techniques, with some intrusions progressing from initial targeting to privileged access in under three hours," the FBI said, as reported by The Record.
How Artex works
Artex runs several AI agents that turn goals written in plain language into commands, with little human involvement after the goals are set, the FBI said. It has no AI model of its own and connects to outside providers, including Anthropic's Claude, OpenAI's GPT, and the DeepSeek, GLM, Grok, and Kimi models, according to the alert.
In attacker-controlled Artex instances, Chinese models are the most common, the FBI said. It said DeepSeek Flash models dominate because of their "balance of capabilities, relatively low cost, and lack of observable guardrails when framed for penetration testing."
The FBI said Artex lets attackers with little technical skill run complex operations against many targets at once. It said the tool is good at finding and breaking into systems that get less security attention, such as partner and supplier portals, mobile app backends, and legacy services. Artex creates a lot of traffic that may set off alerts, but its speed leaves defenders little time to respond, according to the FBI.
Campaigns linked to Artex
The FBI listed two notable campaigns. Financially motivated attacks on South Korean financial institutions led to the theft of personal information on about 67,000 people. A supply chain attack on ConnectWise cloud backup customers gave access to more than 2,250 downstream tenants, the FBI said, citing Microsoft. The tenants are customer organizations' Microsoft 365 environments.
Microsoft attributed the ConnectWise attack to a China-state aligned threat actor it tracks as Storm-0940, CyberScoop reported on October 21. Microsoft did not say how many customers were compromised, according to CyberScoop.
Amazon Threat Intelligence published its own findings on November 13. Between October 3 and November 5, 2026, its MadPot decoy sensors, set up to look like popular AI model services, captured requests from Artex agents that carried the agents' own records of their campaigns, Amazon said. Amazon assessed with moderate confidence that the activity came from separate "Chinese-nexus" threat groups. It said it could not verify the outcomes the agents reported.
The largest campaign in those records was a theft of credentials for AI models at scale. Stolen keys paid for the AI that powered the search for more keys, according to Amazon. A second campaign tried to pass the identity checks at two cryptocurrency exchanges with real-time deepfake video and forged ID photos. The verification vendor rejected the deepfake in every attempt the agents recorded, Amazon said.
How the tool spread
A developer using the name "autumn-27" released Artex on GitHub in July 2026, and it gained an estimated 1,500 to 2,000 GitHub stars within 10 weeks, the FBI said. The developer removed the repository on October 8, 2026, after reports of abuse, according to the FBI. The Record reported that the developer denied any responsibility for crimes committed with the tool.
The framework still spreads through community copies, archived versions, and a commercial version called Artex Pro, the FBI said. Researchers found more than 1,600 publicly exposed Artex consoles as of early November 2026, and the real number of deployments is likely much higher, according to the FBI.
What organizations should do
The FBI advised organizations to inventory every internet-facing application, including partner portals, mobile backends, and legacy services. It advised limiting cloud administration and other sensitive management interfaces to trusted networks and giving applications only the permissions they need. It also advised scanning code and build pipelines for embedded secrets and rotating any exposed credentials quickly.
For the ConnectWise campaign, the FBI advised reviewing every Microsoft 365 tenant where the affected ConnectWise applications are or were installed, and reviewing activity from at least October 1, 2026.
Amazon said none of the techniques in the campaigns were new and the agents succeeded where basic security was missing, such as default or hardcoded credentials, keys left in code, and unpatched software. It advised bringing AI applications, model gateways, and inference endpoints under the same controls as other production systems and watching for unexpected spend on AI services. The FBI and Amazon published indicators of compromise, the technical traces of an intrusion such as IP addresses, in their reports, and the FBI asks organizations to report suspicious activity at ic3.gov.