The FBI has warned that a range of hackers are using ARTEX, an open-source AI agent framework built for penetration testing, to automate break-ins from the first scan to data theft. In a FLASH alert dated Nov. 13, the bureau said some intrusions went from initial targeting to privileged access in under three hours.
The alert, numbered FLASH-20261113-001 and marked TLP:CLEAR for unrestricted sharing, says the framework has been used against organizations worldwide since at least August 2026. The FBI lists 10 targeted sectors, from financial services and defense to healthcare and legal.
How the framework works
According to the FBI, ARTEX is a multi-agent platform written in Go that turns goals written in plain language into commands carried out by specialized agents, with little human input after the objective is set. It does not ship with its own model. The bureau says it plugs into outside providers, including Anthropic's Claude and OpenAI's GPT models as well as DeepSeek, GLM, Grok and Kimi.
Analysis of attacker-controlled instances shows Chinese models are the most common, the FBI said. It added that DeepSeek Flash family models dominate because they are relatively cheap and capable, and show no observable guardrails when a request is framed as penetration testing.
A developer using the name "Autumn-27" released ARTEX on GitHub in July 2026, the FBI said, and it drew an estimated 1,500 to 2,000 stars within 10 weeks. The developer said the tool was meant for authorized testing and pulled the repository on Oct. 8 after reports of abuse. The Record, a news site run by Recorded Future, identified the developer as Chinese cybersecurity engineer Li Puhua and reported that the developer denied responsibility for crimes committed with the tool.
Taking the code down did not stop it. The FBI said ARTEX still spreads through forks, localized versions, archived copies and a paid edition called ARTEX PRO. It cited Censys research that found more than 1,600 publicly exposed ARTEX consoles as of early November.
Named campaigns
The alert points to two campaigns. One, against South Korean financial institutions, led to the theft of personal information on about 67,000 people, according to research from security firms including CrowdStrike and Zscaler. The other was a supply chain compromise of ConnectWise Cloud Backup customers that gave attackers access to more than 2,250 downstream tenants, based on Microsoft research that described it as a nation-state campaign.
The FBI said the agents are especially good at finding systems that get less security attention than a company's main products, such as supplier portals, mobile backends, employee apps and legacy services. In one case listed in the alert, the agents enumerated more than 110,000 Active Directory objects.
The bureau also noted a trait defenders can use. ARTEX generates "high volumes of forensically noisy traffic that may trigger alerts," it said, though the pace of the attacks leaves little time to respond.
What the FBI wants defenders to do
The recommendations start with shrinking the external attack surface. The FBI tells organizations to inventory every internet-facing application, including ones built by individual business units, and to keep cloud administration panels and backup platforms off the open internet.
Companies that used the affected ConnectWise applications are asked to review every Microsoft 365 tenant where those apps were ever installed, searching by application ID rather than display name. The FBI says that review should cover activity from at least Oct. 1.
The bureau also wants victims to report signs that are specific to AI agents. Those include outbound connections to model provider APIs, self-hosted LLM gateway software, unfamiliar LLM proxies or resellers in egress logs, and token billing anomalies. Citing Zscaler, the alert lists api.anthropic.com, api.deepseek.com, open.bigmodel.cn and api.x.ai among outbound API calls seen in one campaign.
Amazon published its own findings the same day. Its threat intelligence team said decoy sensors posing as AI model APIs captured the working memory of ARTEX agents stealing AI model credentials. Amazon CISO CJ Moses wrote that the records show agent frameworks have moved "from experimental use to sustained, multi-objective offensive operations that run with minimal human intervention."
Source: FBI / IC3, “Threat Overview of ARTEX Autonomous Penetration Testing Framework (FLASH-20261113-001)”
Additional sources: The Record, “FBI flash alert says Artex tool automating cyberattacks at 'machine speed'”; Amazon Threat Intelligence, “Amazon Threat Intelligence observes threat actors running cybercrime campaigns with ARTEX AI agents”
