Amazon Threat Intelligence reported that decoy threat sensors captured requests from AI agents running offensive campaigns on the ARTEX framework between October 3 and November 5, 2026.
AI Agent Campaigns
Amazon Threat Intelligence reported that decoy threat sensors captured requests from AI agents running offensive campaigns on the ARTEX framework.
The most prominent campaign involved large-scale theft of AI model access credentials, while another targeted cryptocurrency exchanges using real-time deepfake injection.
Framework Details and Attribution
ARTEX is described as an open-source agentic AI penetration testing framework used by threat actors to automate operations with minimal human intervention.
Amazon Threat Intelligence assessed with moderate confidence that the activity involved disparate Chinese-nexus threat groups.
What to do
- Review environments using the provided indicators of compromise.
- Assume exposed secrets and misconfigurations will be found quickly and remediate accordingly.
- Bring AI applications, model gateways, and inference endpoints under the same controls as other production systems.
Key facts and where they come from
- MadPot captured requests from AI agents running offensive campaigns on ARTEX.
captured requests from AI agents that included operating memory from offensive campaigns that threat actors ran on ARTEX
- ARTEX is an open-source agentic AI penetration testing framework.
ARTEX, an open-source agentic AI penetration testing framework.
- The main campaign focused on stealing credentials to access AI models.
The most prominent ARTEX campaign was a large-scale theft of credentials to access AI models
- Another campaign targeted cryptocurrency exchanges for KYC verification bypass using deepfakes.
Another campaign targeted cryptocurrency exchanges for know-your-customer (KYC) verification bypass using real-time deepfake injection.
The catch
- Amazon Threat Intelligence did not observe the campaign activity as it happened and cannot verify the outcomes the agents reported.
- Attribution to Chinese-nexus threat groups is assessed with moderate confidence based on language, time zones, and tooling.
The open question: How can defenders effectively detect and mitigate autonomous AI-driven cyber attacks that operate with minimal human intervention?
Tell us what you think · Discuss it in the Threat Intel room
Reader poll: Are your organization's AI inference endpoints secured with the same controls as production systems?
A show of hands from readers, not a scientific poll. Say why in the comments.