FBI Warns Artex AI Tool Automates Hacks at Machine Speed
The FBI issued a flash alert about Artex, an open-source pentesting platform that plugs any LLM into AI agents that run attack stages automatically. Some intrusions reached privileged access in under three hours.
⚡ Why it matters
Artex lowers the skill needed to run complex, multi-target attacks against finance, government, energy and telecom, which shrinks the time defenders have to respond.
The FBI published a Flash Alert on Friday, November 13, about Artex, a penetration testing framework that turns plain-language objectives into commands executed by AI agents. It covers the whole chain, from reconnaissance to data exfiltration, with little human input.
Key facts
- The tool appeared on GitHub in August. Its developer said on October 8 that it was being abused and later deleted the repository, but the FBI says forks, archived copies and a commercial edition keep it available.
- Censys found more than 1,600 Artex consoles exposed online, and the real number is likely higher.
- Artex works with any LLM. The FBI says attacker-run instances mostly use Chinese models such as DeepSeek because they are cheap and have weak guardrails.
- It has been linked to attacks on South Korean and Japanese banks, and Microsoft tied it to a supply chain attack on ConnectWise. Amazon reported campaigns that steal AI API keys to fund more attacks.
What to do
- Patch internet-facing systems faster, since automated attackers scan for known flaws quickly.
- Enforce MFA and monitor usage of your AI service API keys.
- Hunt for bursts of fast, automated reconnaissance in your network logs.
🔗 Sources
This article is original reporting by the Security World editorial team based on the sources listed above; direct quotes are kept short and marked with quotation marks. Corrections and feedback: info [at] securitywd.net.
Related stories
Xen Orchestra Auth Bypass Exploited to Take Over XCP-ng
French vendor Vates warned that a critical flaw in Xen Orchestra, the management tool for XCP-ng virtualization, is under active exploitation. A crafted cookie bypasses authentication, granting admin rights and root control of hosts.
Cisco BroadWorks and Openwave Flaws Exploited, Added to KEV
On Tuesday, November 10, CISA listed two flaws, one in Cisco BroadWorks and one in Openwave Messaging Webtop Media Transcoder, in its Known Exploited Vulnerabilities (KEV) catalog, even though fixes have been out for months.
OpenSSH Flaw Exploited on Alpine: CISA Adds 4 KEV Bugs
On November 9, CISA added four actively exploited flaws to its KEV catalog. The standout is an OpenSSH bug on Linux systems using musl libc without PAM, such as Alpine Linux, where some setups accept any long password.