The FBI has issued a FLASH alert warning that cybercriminals are weaponizing an open-source AI agent framework called ARTEX to automate network intrusions from first foothold to privileged access — in some observed cases in under three hours. The November 13, 2026 bulletin describes how operators are pairing stolen credentials, exposed applications, and overprovisioned cloud permissions with autonomous AI agents that scan, exploit, and adapt with minimal human steering.

What ARTEX Actually Is

Contrary to what its appearance in a hacking advisory might suggest, ARTEX is not a malware strain. It is a legitimate, open-source security-testing framework written in Go that connects external large language models to autonomous agents capable of translating plain-language objectives into executable commands. In its intended use, security teams set a goal and the agent handles reconnaissance, exploitation attempts, and troubleshooting on its own. In the hands of attackers, the same capability removes much of the manual labor — and the time — that intrusions traditionally require.

Google’s own observations, cited in the FBI alert, found individual automated bursts of activity lasting as little as two to 25 seconds, a cadence that leaves defenders very little room to triage before an agent moves to its next step.

From a Named Threat Group to a Vendor Breach

Microsoft has previously linked ARTEX usage to Storm-0940, a group it assesses as aligned with Chinese state interests, which has used compromised ConnectWise application credentials to attempt access to more than 2,250 Microsoft 365 tenants. Investigators stress that attempted sign-ins using permissions customers had already granted to a third-party app is not the same as confirmed data theft — but the scale illustrates how a single compromised supply-chain credential can fan out across thousands of downstream organizations.

A separate incident at identity infrastructure provider WorkOS adds a concrete example: the company detected unauthorized access to a sales application holding customer contact details and internal conversation records, including Slack excerpts, and its CEO has pointed to ARTEX involvement. WorkOS says it found no evidence that production services or core application data were touched. In another case documented by Microsoft, an ARTEX-style agent moved from a routine GitHub secrets search to extracting data from an Azure Key Vault in roughly five minutes — a reminder of how quickly a leaked credential can translate into cloud-wide access when the underlying identity carries broad permissions.

A Widening Attack Surface

The FBI’s advisory lists SQL injection, missing API authentication, exposed passwords, and abuse of trusted cloud connections among the entry techniques agents are automating. Once inside, documented post-compromise behavior includes:

• Adding attacker-controlled credentials to existing OAuth applications
• Deploying JSP and PHP web shells for persistent access
• Searching for Windows hosts with no endpoint protection installed
• Mapping more than 110,000 Active Directory objects in a single campaign

Researchers also examined infrastructure tied to an operator linked to attacks on South Korean financial institutions, which affected roughly 67,000 people. The servers contained AI routing tools, reusable attack playbooks, proxy services, and stored credentials — though the FBI notes that shared use of ARTEX does not by itself tie that operator to Storm-0940 or the WorkOS intrusion. By early November, security researchers had counted more than 1,600 publicly exposed ARTEX consoles, though an exposed console does not automatically mean it is being used maliciously.

What Defenders Should Do Now

The FBI’s recommendations focus less on detecting ARTEX itself — which, as a legitimate tool, won’t reliably trigger malware signatures — and more on closing the gaps that let AI agents move quickly once inside:

• Restrict and monitor exposed administration consoles and management tools
• Scope down application and OAuth permissions to the minimum needed
• Scan public and private repositories for exposed secrets and credentials
• Correlate unusual application sign-ins with new credential grants, role changes, and bursts of API activity

The common thread across every case cited in the alert is not a novel exploit but familiar weaknesses — leaked credentials, excessive permissions, unpatched web applications — moving through an attack chain fast enough that traditional, human-paced response may no longer keep up.