FBI warns hackers are using open-source AI tool ARTEX to automate intrusions at machine speed

The FBI says threat actors are using ARTEX, an open-source AI penetration-testing tool, to automate cyber intrusions “at machine speed, from reconnaissance through data exfiltration.” In a FLASH alert dated 13 November 2026, the bureau says some intrusions went from initial targeting to privileged access in under three hours.

The FBI says a variety of malicious actors have used ARTEX since at least August 2026 against organisations in financial services, government, technology, defence, semiconductors, energy, healthcare, manufacturing, telecommunications and legal services. Its Cyber Branch announced the alert on X on 13 November, US time.

Threat actors are weaponizing ARTEX, an open-source, large language model (LLM)-driven agentic platform to automate multiple phases of cyber intrusions at machine speed. Since at least August 2026, a variety of malicious cyber actors have used ARTEX to conduct campaigns targeting organizations globally across multiple sectors, including financial services, government, and technology.

— FBI Cyber Branch (@FBICyberBranch) November 13, 2026

What ARTEX is

ARTEX is a multi-agent platform written in Go, the FBI says. According to Censys and Talos, an operator sets a goal in plain language, a planner agent turns it into tasks, and worker agents run security tools such as nmap, recording what they find in a shared graph until the goal is met. A developer using the name Autumn-27 published it on GitHub on 26 July 2026 under the AGPL-3.0 licence, Censys says.

ARTEX has no model of its own. The FBI says it connects to outside providers, including Anthropic’s Claude and OpenAI’s GPT, and to DeepSeek, GLM, Grok and Kimi. In attacker-controlled copies, the FBI says Chinese models are most common, with DeepSeek’s Flash family leading “due to their balance of capabilities, relatively low cost, and lack of observable guardrails when framed for penetration testing.”

Autumn-27 removed the GitHub repository on 8 October 2026, the day after CrowdStrike published a report on its abuse, and said they weren’t involved in the attacks, Censys says. The FBI says forks, localised variations, archived copies and a commercial version called ARTEX PRO keep the tool available.

The campaigns on record

The FBI names two. It says financially motivated attacks on South Korean financial institutions led to the exfiltration of personal information from about 67,000 people. CrowdStrike, whose 7 October report the FBI cites, said an unattributed actor assessed with moderate confidence to be a financially motivated Chinese speaker ran ARTEX against a South Korean finance company from late September to early October, according to Censys.

The second is the ConnectWise Cloud Backup compromise, which the FBI says enabled access to more than 2,250 downstream tenants. Microsoft’s report attributes it to Storm-0940, a China state-aligned actor, and says the actor used ARTEX to attempt sign-ins to more than 2,250 tenants at up to 2,900 attempts a minute. Microsoft says several of the actor’s ARTEX-driven attacks reached privileged cloud access, including multiple cases in under three hours. The FBI’s notes cite that report for its under-three-hours figure. In the password-spray stage Microsoft describes, against 327 accounts at eight organisations, it saw no successful authentication.

Other reports go beyond the FBI’s two. Talos, citing CrowdStrike, says a China-nexus actor called VAPOR PANDA used ARTEX against more than 200 organisations in at least 14 countries from 17 October, with post-compromise activity confirmed at nine. Amazon says its decoy sensors captured ARTEX agents’ own records between 3 October and 5 November, covering one campaign that stole AI model API keys and another that used deepfakes to try to beat identity checks at two cryptocurrency exchanges. In the deepfake case Amazon describes, the verification vendor’s server-side check rejected the deepfake in every recorded attempt. Japan’s computer emergency response team also lists ARTEX among the tools in attack attempts there, as covered earlier.

How many copies are running

The FBI says researchers found over 1,600 publicly exposed ARTEX consoles in early November and that total deployments are likely significantly higher. Its notes cite Censys, whose 5 November post counted 1,465 hosts as of 4 November. About 650 of those sit in two blocks of identically configured hosting, which leaves roughly 815 distinct-looking deployments, Censys says. Censys also says some exposed hosts are likely run by authorised testers, and that the console doesn’t need to be public.

Google Threat Intelligence Group describes how ARTEX looks in logs. Its analysis found execution sequences running in bursts of roughly 2 to 25 seconds, and says ARTEX reached code execution in a far noisier way than a competent human operator, with 240 log events in one case.

What the FBI tells defenders to do

The FBI’s recommendations start with attack surface. It asks organisations to inventory every internet-facing application, including partner and supplier portals, mobile backends, employee apps, sales-support systems and legacy services. It also asks them to restrict cloud administration and Kudu/SCM publishing endpoints, the management interface for Azure App Service deployments, to trusted networks. On identity, it recommends least privilege for multi-tenant app permissions and monitoring for credential additions to OAuth applications. On partner and employee portals, it recommends rate limits and alerts for sequential lookups and unusually high record counts per session.

For ConnectWise Cloud Backup customers, the FBI says to review every Microsoft 365 tenant where its applications are or were installed, searching by application ID, and to keep the connections disabled until ConnectWise gives restoration instructions. The FLASH also lists IP addresses, domains and outbound API hosts to check, and says to vet them before blocking because cloud IP addresses get reassigned. Amazon’s analysis says none of the techniques in the campaigns it saw were new, and that the agents succeeded where default credentials, keys left in code and unpatched software were present.

The FBI’s 11 notes cite reports from Akamai, Microsoft, Google, Censys, CrowdStrike, Zscaler, CERT-EU and Check Point, and the flash gives no total for organisations breached. The FBI asks anyone with ARTEX-related activity to report it through ic3.gov or a local field office.