{"slug": "fbi-flash-alert-says-artex-tool-automating-cyberattacks-at-machine-speed", "title": "FBI flash alert says Artex tool automating cyberattacks at ‘machine speed’", "summary": "The FBI issued a flash alert on Friday warning that the open-source AI platform Artex is being used by cybercriminals and nation-states to automate intrusions \"at machine speed,\" with some attacks reaching privileged access in under three hours. The advisory cites Censys research finding over 1,600 publicly exposed Artex console instances and notes the framework, released on GitHub in August by Chinese cybersecurity engineer Li Puhua, remains available through community forks, archived copies and a commercial version despite the repository's removal. Microsoft linked Artex to Chinese state-backed actors in a supply chain attack on ConnectWise, and Amazon published its own study finding Chinese-nexus threat groups using Artex agents for large-scale credential theft.", "body_md": "# FBI flash alert says Artex tool automating cyberattacks at ‘machine speed’\n\nOpen-source AI platform Artex is being used prolifically by cybercriminals and nation-states to breach government agencies and dozens of critical sectors worldwide, according to a new FBI advisory.\n\nThe FBI released a flash alert on Friday about the tool, which has caused alarm among cybersecurity experts for its ability to take any large language model and turn it into a powerful hacking tool that can “automate multiple phases of cyber intrusions at machine speed, from reconnaissance through data exfiltration.”\n\n“Artex significantly reduces the time required to chain attack techniques, with some intrusions progressing from initial targeting to privileged access in under three hours,” the FBI said. “The framework enables threat actors with minimal technical expertise to conduct complex, multi-target operations simultaneously, fundamentally accelerating attack velocity and expanding operational scale.”\n\n The tool was released in August on GitHub by an account known as \"Autumn-27.” The developer of the framework — [identified](https://www.wsj.com/world/asia/chinese-ai-tool-linked-to-hacks-in-japan-4813d13b) as Chinese cybersecurity engineer Li Puhua — [released](https://github.com/Autumn-27) a statement on GitHub on October 8 saying the tool was abused by malicious actors. \n\nThe developer denied any responsibility for crimes committed with it and eventually removed the GitHub repository.\n\nThe FBI said on Friday that despite the removal, the framework “continues to proliferate through community forks, localized variations, archived copies, and a commercial version … ensuring continued availability to threat actors.”\n\n The advisory cites [recent research](https://censys.com/blog/artex-agentic-asbestos/) from cybersecurity firm Censys showing over 1,600 publicly exposed Artex console instances, with total deployments likely significantly higher when including systems behind firewalls or in private networks. \n\nThe penetration testing platform can translate high-level tactical goals described in words into actionable machine commands executed by AI agents, requiring minimal human interaction beyond the initial objectives.\n\nArtex can integrate any AI model, including frontier models Anthropic Claude and OpenAI GPT as well as open-source or Chinese-origin models like DeepSeek, GLM, Grok and Kimi.\n\n“Analysis of attacker-controlled Artex instances shows Chinese models are most prevalent, with DeepSeek Flash family models dominating usage due to their balance of capabilities, relatively low cost, and lack of observable guardrails when framed for penetration testing,” the FBI explained.\n\nThe tool has been used to conduct reconnaissance and data exfiltration attacks targeting financial services, government, technology, defense, semiconductor, energy, healthcare, manufacturing, telecommunications and legal industries.\n\n It was recently [implicated](https://www.crowdstrike.com/en-us/blog/unknown-threat-actor-uses-artex-to-target-south-korean-finance/) in [multiple attacks](https://www.wsj.com/world/asia/hackers-use-chinese-ai-tool-to-hit-south-korean-banks-exposing-new-risk-5d4d3885) on South Korean and [Japanese](https://www.esecurityplanet.com/cybersecurity-threats/news-apac-artex-ai-cyberattacks-japan-companies/) financial institutions, causing national scandals in both countries. Microsoft said Artex was used by Chinese state-backed actors in a recent [supply chain attack on IT management software company ConnectWise](https://therecord.media/connectwise-suspends-cloud-backup-service-supply-chain-attack).  \n\n Amazon joined the fray on Friday, [releasing](https://aws.amazon.com/blogs/security/amazon-threat-intelligence-observes-threat-actors-running-cybercrime-campaigns-with-artex-ai-agents/) its own study finding “disparate Chinese-nexus threat groups” using Artex for “a large-scale theft of credentials to access AI models, organized as a self-sustaining operation in which stolen keys paid for the LLM inference powering further credential hunting.”  \n\n“Another campaign targeted cryptocurrency exchanges for know-your-customer (KYC) verification bypass using real-time deepfake injection,” Amazon CISO CJ Moses said.\n\nMoses argued their investigation showed that frameworks like Artex “have progressed from experimental use to sustained, multi-objective offensive operations that run with minimal human intervention.”\n\nThey warned that Artex is automating time-consuming phases of exploitation and is allowing smaller threat groups to run concurrent intrusion campaigns at a scale they previously could not.\n\nAgents deployed by Artex have shown an ability to “map trust relationships between organizations” and compromise weak third-party vendors.\n\nArtex is adept at identifying and exploiting systems that have less security attention than others, including “partner and supplier portals, mobile backends, employee applications, sales-support systems, legacy services, third-party integrations, and applications created across different business units,” the FBI explained.\n\nThe tool generates a high-volume of attempts that will set off defense sensors but works at a speed that makes it difficult for defenders to keep up.\n\nJonathan Greig\n\nis a Breaking News Reporter at Recorded Future News. Jonathan has worked across the globe as a journalist since 2014. Before moving back to New York City, he worked for news outlets in South Africa, Jordan and Cambodia. He previously covered cybersecurity at ZDNet and TechRepublic.", "url": "https://wpnews.pro/news/fbi-flash-alert-says-artex-tool-automating-cyberattacks-at-machine-speed", "canonical_source": "https://therecord.media/artex-ai-tool-fbi-flash-alert", "published_at": "2026-11-13 21:32:00+00:00", "updated_at": "2026-11-13 21:55:30.773234+00:00", "lang": "en", "topics": ["ai-safety", "ai-agents", "ai-policy", "artificial-intelligence"], "entities": ["FBI", "Artex", "Li Puhua", "Censys", "Microsoft", "ConnectWise", "Amazon", "DeepSeek"], "also_reported_by": [], "alternates": {"html": "https://wpnews.pro/news/fbi-flash-alert-says-artex-tool-automating-cyberattacks-at-machine-speed", "markdown": "https://wpnews.pro/news/fbi-flash-alert-says-artex-tool-automating-cyberattacks-at-machine-speed.md", "text": "https://wpnews.pro/news/fbi-flash-alert-says-artex-tool-automating-cyberattacks-at-machine-speed.txt", "jsonld": "https://wpnews.pro/news/fbi-flash-alert-says-artex-tool-automating-cyberattacks-at-machine-speed.jsonld"}}