FBI alert says Artex automates cyberattacks at machine speed

The FBI issued an urgent alert saying the open-source AI platform Artex is being used extensively by cybercriminals and state-backed actors to break into government agencies and multiple critical industries. The FBI said the framework can turn any LLM into an attack tool, automating multiple intrusion stages from reconnaissance to data exfiltration; some intrusions advanced from initial positioning to privileged access in under three hours, and let lower-skilled actors conduct multi-target operations simultaneously. The FBI also said that among attacker-controlled Artex instances, Chinese models are the most common, with the DeepSeek Flash series used most because of lower cost and no observable guardrails when used for penetration testing. The tool was released in August by the GitHub account Autumn-27; developer Li Puhua stated on October 8 that it had been abused by malicious actors and deleted the repository; the FBI said the framework continues to spread through community forks, localized variants, archived copies and commercial versions. The alert cited Censys research saying more than 1600 publicly exposed Artex console instances exist.