StepSecurity
AI pentesting tool ARTEX helps attackers exploit exposed secrets
Part of the ARTEX story · since 30 Oct
- Fri 30 Oct, 19:00 UTC. The Hacker News, first report. CrowdStrike links Vapor Panda to global AI powered intrusion campaign.
- Sun 1 Nov, 09:20 UTC. cybersixt, its first report on the story. AI hacking tool ARTEX now used by cybercriminals to target finance.
- Mon 2 Nov, 09:00 UTC. SecurityOnline, its first report on the story. North Korean groups use AI to accelerate cyber operations.
- Tue 3 Nov, 00:51 UTC. cybersixt. WorkOS data breach came from a researcher's escaped ARTEX agent.
- Tue 3 Nov, 06:30 UTC. The Hacker News. Attackers Exploit CryptoPayment Gateway Flaw to Steal Wallet Keys.
- Tue 3 Nov, 19:30 UTC. The Hacker News. Chainstack Breach Exposes Customer Data and Password Hashes.
- Wed 4 Nov, 11:00 UTC. badbyte.io, its first report on the story. Trojanised ARTEX Docker Image Let Attackers Run Commands on Hosts.
- Wed 4 Nov, 13:30 UTC. SecurityWeek, its first report on the story. Wiz links AI platform breaches to stolen access tokens.
- Thu 5 Nov, 10:00 UTC. SOCRadar, its first report on the story. AI Pentest Framework Tied to Attacks on Hundreds of Organisations.
- Thu 5 Nov, 10:30 UTC. The Hacker News. Backdoored ARTEX Docker image exposed 62 consoles to root access.
- Thu 5 Nov, 18:00 UTC. Check Point, its first report on the story. Check Point details AI driven ARTEX cybercrime campaigns.
- Fri 6 Nov, 13:30 UTC. Infosecurity, its first report on the story. Censys finds 1,465 internet exposed ARTEX consoles.
- Sat 7 Nov, 04:00 UTC. Microsoft, its first report on the story. Storm-3358 uses ARTEX to target financial organisations.
- Sat 7 Nov, 20:30 UTC. Security Affairs, its first report on the story. Hunt.io traces ARTEX tools to breaches at South Korean banks.
- Tue 10 Nov, 22:00 UTC. Dark Reading, its first report on the story. Storm-0940 weaponises Artex AI tool to breach cloud accounts.
- Thu 12 Nov, 00:00 UTC. Unit 42, its first report on the story. Unit 42 warns attackers are using AI red teaming tools.
- Thu 12 Nov, 15:30 UTC. SOCRadar. SOCRadar Maps 916 Exposed ARTEX AI Pentest Consoles in US.
- Thu 12 Nov, 22:30 UTC. Dark Reading. Researchers warn AntiFox is driving attacks on AWS environments.
- Fri 13 Nov, 16:00 UTC. StepSecurity, its first report on the story. AI pentesting tool ARTEX helps attackers exploit exposed secrets. This article, 19th of 20.
- Fri 13 Nov, 20:00 UTC. Cloudflare, its first report on the story. Cloudflare warns AI pentesting tools are accelerating attacks.
ARTEX is an open‑source AI‑assisted pentesting tool that runs a simulated breach with AI agents, while a human operator steers. Since its GitHub appearance on 26 July 2026, multiple state‑aligned groups, criminal networks and a security researcher’s agent have used ARTEX against hundreds of organisations.
Microsoft, Google, CrowdStrike, Wiz, Censys, GitGuardian and Palo Alto Networks’ Unit 42, with advisories from CERT‑In and CERT‑EU, reported rapid, broad use, including an instance where an agent went from a GitHub search for leaked secrets to stealing cloud data in five minutes.
The common pattern across these incidents is that attackers seize on credentials left exposed in public or dev environments, with evidence pointing to secrets on GitHub, a guessable development password used in production, and a backdoored ARTEX copy that installed a hidden Docker image after the original was removed.
The article details how ARTEX operates: a Go server, Next.js interface and PostgreSQL database, accessible on port 8787, with three agent types and a chat interface for steering. It notes the fastest infections hinge on exposed credentials, such as application secrets in GitHub, and notes examples like a development credential used in production and a backdoored image that led to thousands of downloads.
It also documents observable indicators of ARTEX activity, including user agents artex-enrich/1.0 and norma/0.4, bursts of rapid requests, and exposed consoles; CERT‑In, Microsoft and Google provide related guidance. The post also cites CVE‑2026‑126187, a React Server Components RCE in Flight protocol fixes shipped on 10 November 2026, as part of the broader security context.
How the story developed
20 articles from 14 outlets since 30 Oct. Still developing; the latest report was 4 hours ago. This was the 19th report, 14 days after the first.
- Fri 30 Oct, 19:00 UTC. The Hacker News, first report. CrowdStrike links Vapor Panda to global AI powered intrusion campaign.
- Sun 1 Nov, 09:20 UTC. cybersixt, its first report on the story. AI hacking tool ARTEX now used by cybercriminals to target finance.
- Mon 2 Nov, 09:00 UTC. SecurityOnline, its first report on the story. North Korean groups use AI to accelerate cyber operations.
- Tue 3 Nov, 00:51 UTC. cybersixt. WorkOS data breach came from a researcher's escaped ARTEX agent.
- Tue 3 Nov, 06:30 UTC. The Hacker News. Attackers Exploit CryptoPayment Gateway Flaw to Steal Wallet Keys.
- Tue 3 Nov, 19:30 UTC. The Hacker News. Chainstack Breach Exposes Customer Data and Password Hashes.
- Wed 4 Nov, 11:00 UTC. badbyte.io, its first report on the story. Trojanised ARTEX Docker Image Let Attackers Run Commands on Hosts.
- Wed 4 Nov, 13:30 UTC. SecurityWeek, its first report on the story. Wiz links AI platform breaches to stolen access tokens.
- Thu 5 Nov, 10:00 UTC. SOCRadar, its first report on the story. AI Pentest Framework Tied to Attacks on Hundreds of Organisations.
- Thu 5 Nov, 10:30 UTC. The Hacker News. Backdoored ARTEX Docker image exposed 62 consoles to root access.
- Thu 5 Nov, 18:00 UTC. Check Point, its first report on the story. Check Point details AI driven ARTEX cybercrime campaigns.
- Fri 6 Nov, 13:30 UTC. Infosecurity, its first report on the story. Censys finds 1,465 internet exposed ARTEX consoles.
- Sat 7 Nov, 04:00 UTC. Microsoft, its first report on the story. Storm-3358 uses ARTEX to target financial organisations.
- Sat 7 Nov, 20:30 UTC. Security Affairs, its first report on the story. Hunt.io traces ARTEX tools to breaches at South Korean banks.
- Tue 10 Nov, 22:00 UTC. Dark Reading, its first report on the story. Storm-0940 weaponises Artex AI tool to breach cloud accounts.
- Thu 12 Nov, 00:00 UTC. Unit 42, its first report on the story. Unit 42 warns attackers are using AI red teaming tools.
- Thu 12 Nov, 15:30 UTC. SOCRadar. SOCRadar Maps 916 Exposed ARTEX AI Pentest Consoles in US.
- Thu 12 Nov, 22:30 UTC. Dark Reading. Researchers warn AntiFox is driving attacks on AWS environments.
- Fri 13 Nov, 16:00 UTC. StepSecurity, its first report on the story. AI pentesting tool ARTEX helps attackers exploit exposed secrets. This article, 19th of 20.
- Fri 13 Nov, 20:00 UTC. Cloudflare, its first report on the story. Cloudflare warns AI pentesting tools are accelerating attacks.
- CVE not in KEV
- No CVE
- Larger: an outlet’s first report
- Coverage over time
- Quiet time, folded
Show all 20 articles as a listHide the list
- Fri 30 OctDay 01
- CrowdStrike links Vapor Panda to global AI powered intrusion campaign19:00 · The Hacker News · First report
Quiet for 2 days
Sun 1 NovDay 21- AI hacking tool ARTEX now used by cybercriminals to target finance09:20 · cybersixt
- Mon 2 NovDay 31
- North Korean groups use AI to accelerate cyber operations09:00 · SecurityOnline
- Tue 3 NovDay 43
- WorkOS data breach came from a researcher's escaped ARTEX agent00:51 · cybersixt
- Attackers Exploit CryptoPayment Gateway Flaw to Steal Wallet Keys06:30 · The Hacker News
- Chainstack Breach Exposes Customer Data and Password Hashes19:30 · The Hacker News
- Wed 4 NovDay 52
- Trojanised ARTEX Docker Image Let Attackers Run Commands on Hosts11:00 · badbyte.io
- Wiz links AI platform breaches to stolen access tokens13:30 · SecurityWeek
- Thu 5 NovDay 63
- Backdoored ARTEX Docker image exposed 62 consoles to root access10:30 · The Hacker News
- Check Point details AI driven ARTEX cybercrime campaigns18:00 · Check Point
- Fri 6 NovDay 71
- Censys finds 1,465 internet exposed ARTEX consoles13:30 · Infosecurity
- Sat 7 NovDay 82
- Storm-3358 uses ARTEX to target financial organisations04:00 · Microsoft
- Hunt.io traces ARTEX tools to breaches at South Korean banks20:30 · Security Affairs
Quiet for 3 days
Tue 10 NovDay 111- Storm-0940 weaponises Artex AI tool to breach cloud accounts22:00 · Dark Reading · Picked up again
- Thu 12 NovDay 133
- Unit 42 warns attackers are using AI red teaming tools00:00 · Unit 42
- SOCRadar Maps 916 Exposed ARTEX AI Pentest Consoles in US15:30 · SOCRadar
- Researchers warn AntiFox is driving attacks on AWS environments22:30 · Dark Reading
- Fri 13 NovDay 142
- AI pentesting tool ARTEX helps attackers exploit exposed secrets16:00 · StepSecurity · This article, 19th of 20
- Cloudflare warns AI pentesting tools are accelerating attacks20:00 · Cloudflare