Unit 42Cuong Dinh, Richard Emerson and Samantha Stallings
Unit 42 warns attackers are using AI red teaming tools
Unit 42 reports that a rapidly expanding ecosystem of AI-enabled red‑teaming and penetration testing tools, including ARTEX and CyberStrikeAI, is being used by attackers to execute autonomous offensive operations. ARTEX is described as an open‑source, multi‑agent AI penetration testing framework first published mid‑2026 and widely forked since.
Unit 42 incidents show attacker servers hosting an ARTEX console or infrastructure and user agents linked to ARTEX being used in intrusion attempts, with a separate track of activity in which ARTEX campaigns targeted customer cloud environments across sectors such as retail and consulting. External scrutiny has pressured development to pause: the author of ARTEX reportedly moved to closed‑source and ceased public development to prevent misuse, while new alternatives rapidly emerge to fill the gap.
Unit 42 notes the scale of deployment, identifying 1,323 internet‑facing hosts running CyberStrikeAI and 609 running ARTEX as of October 2026, with 21 hosts running both. The report categorises the AI‑assisted red‑teaming ecosystem into four activity areas—reconnaissance and attack surface management, agent‑led testing and vulnerability hunting, source‑code auditing and verification, and AI‑system security assessment—listing tools such as ARL, Scope Sentry, Nemo, CyberStrikeAI, ARTEX, Cairn, and AI‑Infra‑Guard.
Observations describe behavioural hallmarks of ARTEX‑driven activity, including think‑then‑act cadences, rapid credential validation, spec‑driven targeting, and automated write‑then‑delete tests, with occasional human inputs at sensitive steps.
Unit 42 emphasises that autonomous tooling currently prioritises speed over stealth, and that defenders should block by default, remove credentials and public attack maps, enforce authentication on write endpoints, and monitor for operator behaviour rather than relying solely on indicators. The piece directs readers to Unit 42 Threat Intel Services for tailored insights and analyst support.