Amazon says decoy servers posing as AI model APIs captured the working memory of hacking agents built on ARTEX, an open-source penetration testing framework. In a Nov. 13 post, Amazon CISO CJ Moses wrote that the largest campaign was a self-sustaining operation in which stolen AI model keys paid for the inference that powered the hunt for more keys.
From Oct. 3 to Nov. 5, Amazon's MadPot network of decoy sensors presented LLM-compatible chat-completions interfaces on various ports, according to the post. ARTEX agents treated those endpoints as their model backend and sent them prompts. Because agent frameworks carry the history of past conversations, Amazon said, single requests often held a campaign's full record, including system prompts, tool histories, knowledge-graph state and reported findings.
Amazon said it did not observe the described activity as it happened and "cannot verify the outcomes the agents reported." It assessed with moderate confidence that the tool was ARTEX and that the operators were disparate Chinese-nexus groups, pointing to simplified Chinese prompts, China time-zone settings, targeting consistent with Chinese interests and tooling mostly used by Chinese-nexus actors.
Agents that grade stolen keys
Most of the activity split work among planner, worker, verification and compression agents that shared a persistent knowledge graph, Amazon said. Each agent read from the graph and wrote its results back, so the next one could pick up where the last had stopped.
According to Amazon, the credential campaign went after software that pools keys for many model providers, since one weak admin panel can expose many downstream accounts. Amazon named LLM gateways such as One API, New API, Veloera, Sub2API and LiteLLM, along with AI app builders including Dify, FastGPT, Langflow, RAGFlow, Open WebUI, LobeChat and Ollama.
The agents worked from a playbook that matched each product to a known attack, according to the post. Examples included the LiteLLM default master key, an authentication bypass through the isCliRequest header in One API family systems, CVE-2025-3248 in Langflow and CVE-2026-28797 in RAGFlow.
To find exposed secrets, the agents searched GitHub repositories and event archives, npm and PyPI packages, container image layers, notebooks, paste sites and Telegram channels, Amazon said. One operation worked through countries in a fixed order and graded every credential, from L1 for a lead up to L3 for measurable impact such as readable data or spendable balance. Keys that had been public for more than 30 days were filed as low-value inventory.
Amazon said the agents put access to premium frontier models ahead of general cloud permissions. The point of the theft was "most likely so they could use those models while someone else paid for them," the post said.
A deepfake push against crypto exchanges
A second campaign tried to beat identity checks at two cryptocurrency exchanges. The agents reverse-engineered one vendor's liveness check, and their best recorded attempt finished the full movement sequence with the face within 7 pixels of the target. The vendor's server still rejected the deepfake in every attempt the agents logged, Amazon said.
A separate session built a real-time deepfake video pipeline on a single consumer GPU using an open-source face animation model and reached 11.5 frames per second, the post said. At least four agent sessions ran at once on that campaign, and handed off tasks through cross-session tools.
Old holes, faster attackers
Amazon wrote that "none of the techniques in these campaigns were new." What agents change, it said, is the speed and persistence of the attacker. The agents succeeded where basic hygiene was missing, such as default credentials, keys left in code, unauthenticated inference endpoints and unpatched software.
Organizations should assume exposed secrets will be found quickly, Amazon said, and should bring model gateways and inference endpoints under the same controls as other production systems. It also suggested watching for unexpected AI spend as a sign that keys have been taken.
The post landed the same day the FBI issued a FLASH alert on ARTEX. The bureau said some intrusions using the framework reached privileged access in under three hours and cited Censys research that found more than 1,600 exposed ARTEX consoles.
Source: Amazon Threat Intelligence, “Amazon Threat Intelligence observes threat actors running cybercrime campaigns with ARTEX AI agents”
Additional sources: FBI / IC3, “Threat Overview of ARTEX Autonomous Penetration Testing Framework”; The Record, “FBI flash alert says Artex tool automating cyberattacks at 'machine speed'”
