What happened
The FBI’s FLASH describes ARTEX as a multi-agent penetration-testing platform written in Go. It translates high-level goals expressed in natural language into machine commands carried out by specialized agents, with little human interaction after the initial objective is set. ARTEX does not include its own model; it connects to external LLM providers. The FBI names Anthropic Claude, OpenAI GPT, DeepSeek, GLM, Grok and Kimi among the models that can be integrated. Analysis of attacker-controlled instances found Chinese-origin models particularly common, with DeepSeek Flash-family models prominent.
The FBI says ARTEX was released on GitHub by a developer using the name Autumn-27 in July 2026, reached an estimated 1,500–2,000 stars within ten weeks, and was removed by its original developer on October 8 after reports of abuse. The framework nevertheless remains accessible through forks, localized variants, archived copies and a commercial version called ARTEX PRO. The FLASH cites more than 1,600 publicly exposed console instances identified by early November; it says deployments behind firewalls or on private networks likely raise the total.
According to the FBI, malicious actors have used ARTEX since at least August 2026 in campaigns against organizations across finance, government, technology, defense, semiconductors, energy, health care, manufacturing, telecommunications and legal services. The framework can automate several phases, from reconnaissance to data exfiltration. Some intrusions advanced from initial targeting to privileged access in under three hours. The agency points to attacks on South Korean financial institutions that exfiltrated personal information belonging to approximately 67,000 people, and a ConnectWise Cloud Backup supply-chain compromise that enabled access to more than 2,250 downstream tenants.
The FLASH maps observed activity across intrusion stages: cloud and web-asset discovery, exploitation of public-facing systems and trusted relationships, persistence, privilege escalation, internal reconnaissance and attempted lateral movement. Examples include sequential web-directory requests, tests of cloud permissions, use of compromised vendor credentials, web shells, and enumeration of large Active Directory environments. The FBI also warns that attackers may use proxies and tunnels, and that the resulting high-volume traffic can be noisy even as the speed of operations narrows defenders’ response window.
The FBI’s recommendations focus on reducing exposure and improving detection. They include inventorying internet-facing applications such as supplier portals and mobile backends; restricting management and publishing interfaces to trusted networks; applying least privilege to multi-tenant applications; monitoring credential changes and unusual service-principal activity; and adding rate limits and alerts for high-impact APIs. For ConnectWise-related activity, the FLASH recommends reviewing relevant tenant records and preserving audit and sign-in logs. It cautions that listed indicators should be corroborated with current telemetry because infrastructure addresses can be reassigned.
What the archive adds
New Runtime’s earlier coverage reported Censys’s discovery of 1,465 publicly exposed ARTEX consoles in its November 7 Field Note. An earlier note described reports of exposed ARTEX, Cairn and PentAGI consoles being hijacked for credential theft and malware deployment (November 8). This is a new authoritative account of the threat and its defensive implications, not simply a restatement of the exposure count.
Trend signal
This event supports agent security moving to runtime boundaries: the reported harm comes from agents operating against real systems with credentials, APIs and network access, not from persuasive prompt text alone. The FBI’s emphasis on restricting interfaces, constraining permissions, rate-limiting APIs and monitoring execution is consistent with treating the environment and its controls as the security boundary.
Connections to other events
The FBI’s account builds on the ARTEX exposure story covered by New Runtime on November 7 and November 8, but shifts the focus from publicly reachable consoles to observed intrusion campaigns and organizational mitigations. It also recalls New Runtime’s November 4 coverage of indirect attacks on agents through fabricated safety hazards: both show that agent behavior can be redirected through the systems and signals surrounding it, although the mechanisms and consequences differ.
Why it matters
For teams defending cloud and software estates, automation changes the time available to detect and contain a breach. A workflow that chains discovery, credential use and privilege escalation can turn small weaknesses in overlooked systems into access to a larger environment before a conventional response process has mobilized. The FBI’s examples also make the supply-chain risk concrete: a partner’s credentials or application permissions can become a route into downstream tenants.
The useful response is not to search only for an ARTEX signature or block every listed address. Teams should reduce the attack surface across peripheral applications, constrain service identities and administrative interfaces, and alert on behavior that is abnormal for their own business flows. Those controls help against agentic tooling and other automated intrusions alike.
Limits and uncertainty
The FLASH combines FBI guidance with findings attributed to multiple security companies and researchers; it is not a controlled evaluation of ARTEX’s effectiveness. The reported attack durations, exposed-console counts and campaign impacts are specific observations, not rates that establish how often comparable organizations will be affected. Publicly exposed consoles are a lower bound on deployments, and removal of the original repository did not establish how many copies remain in use. Listed IPs and domains are time-sensitive indicators, which the FBI says should be checked against current telemetry. The document does not establish that every listed campaign used ARTEX in the same way or that the framework alone caused the reported outcomes.
Reader takeaway
Treat agent-driven intrusion as a reason to harden the ordinary seams attackers already exploit: exposed partner and administrative interfaces, broad application permissions, weak rate controls and incomplete audit coverage. Inventory those surfaces, constrain what their identities can do, and detect unusual access patterns before an automated chain reaches privileged systems.