Over 1,600 ARTEX consoles are exposed on the public internet, according to researchers cited in a FLASH alert the FBI published on November 13. The agency says threat actors have weaponized the open-source framework to automate intrusions from reconnaissance through data exfiltration, compressing what used to be days or weeks of manual work into hours.
ARTEX converts natural-language objectives into machine commands executed by AI agents. It ships no model of its own but can connect to any large language model. The FBI advisory says Chinese models dominate attacker-controlled deployments, with DeepSeek Flash appearing most frequently.
Three Hours to Privileged Access
The FBI says some intrusions moved from initial targeting to privileged access in under three hours. CrowdStrike documented similar speed in a campaign it attributed to a China-nexus actor it tracks as VAPOR PANDA, which targeted more than 200 organizations in 14 countries over an 11-day window beginning October 17. The firm said one ARTEX controller consumed more than 1.4 billion input tokens while directing simultaneous intrusions across government ministries and private-sector targets.
"This campaign marks an escalation in China-nexus use of AI agents, from single intrusions to multiple simultaneous engagements directed by a human operator," CrowdStrike's researchers wrote in their October 29 report.
Microsoft separately tied ARTEX activity to a group it calls Storm-0940 in a supply-chain compromise involving stolen ConnectWise credentials. The company observed AI-accelerated follow-on activity through Microsoft Graph, including reconnaissance, application credential changes, and privilege escalation attempts. Microsoft noted that in one case, an AI agent moved from scanning GitHub for exposed secrets to exfiltrating data from an Azure Key Vault in five minutes.
A Tool Built for Defense, Deployed for Attack
ARTEX was released on GitHub in July 2026 by a developer using the handle Autumn-27, whom The Record identified as Chinese cybersecurity engineer Li Puhua. The framework was designed for authorized penetration testing. Li pulled the repository on October 8 after reports surfaced that it had been used in attacks on South Korean banks.
"Given the misuse of the tool, the ARTEX project will no longer be updated and will be converted to closed source," the developer wrote before deleting the repository.
The removal did nothing to stop the spread. The FBI says forks, archived copies, and a commercial version called ARTEX PRO continue to circulate. Check Point Research, which published its own analysis of the framework last week, gained visibility into attacker consoles and observed operators issuing instructions marked in Chinese.
What the FBI Recommends
The FLASH advisory urges organizations to inventory peripheral internet-facing systems, restrict access to cloud administration endpoints, and apply least privilege to multi-tenant application consent grants. It also calls for monitoring outbound connections to LLM API endpoints and watching for token-consumption anomalies.
Victims span financial services, government, defense, technology, healthcare, energy, and telecommunications. Amazon's security team has cautioned that ARTEX allows smaller threat groups to launch multiple intrusion campaigns simultaneously at a scale that was previously beyond their reach.
The FBI asks organizations that identify suspicious activity to contact their local field office or the Internet Crime Complaint Center. Useful artifacts include ARTEX configuration files, console interface screenshots, and service-principal sign-in logs.
The agency's alert follows months of warnings from the private security industry about the offensive potential of agentic AI. What distinguishes ARTEX from earlier AI-assisted hacking tools is scale: a single operator, running parallel intrusions against dozens of targets, intervening only at decision points while the agents handle the repetitive work of reconnaissance, exploitation, and lateral movement.
Microsoft-tracked activity cited in the FBI's alert was still active as of November 6.
