FBI issues FLASH alert: open-source LLM agent penetration testing framework ARTEX weaponized by attackers for automated intrusions
The FBI issued a FLASH notification on November 13, 2026, warning that at least since August 2026, multiple malicious cyber actors have weaponized the open-source LLM agent penetration testing framework ARTEX to conduct automated intrusions against multiple industries worldwide, including finance, government and technology. The notification said ARTEX greatly shortens the time to chain attack techniques, with some intrusions going from initial target identification to obtaining privileged access in under three hours, and that attackers with limited technical capability can also use it to conduct multi-target operations simultaneously; cases include an attack on a South Korean financial institution that stole the personal information of approximately 67,000 people, and a ConnectWise Cloud Backup supply chain intrusion affecting more than 2,250 downstream tenants. After the original developer deleted the GitHub repository in October 2026, the framework continued to spread through community forks, archived copies and the commercial version ARTEX PRO; as of early November 2026, researchers found 1,600 publicly exposed ARTEX console instances. The FBI recommends that organizations operating internet-exposed applications, self-service portals, cloud infrastructure and partner systems implement the mitigation measures in the notification.
The FBI reported real-world cases and IOCs of attackers using the open-source LLM agent framework ARTEX to carry out intrusions; teams operating internet-exposed systems can check their own systems against its mitigation measures.
https://www.ic3.gov/CSA/2026/261113.pdf
Threat actors are weaponizing ARTEX, an open-source, large language model (LLM)-driven agentic platform to automate multiple phases of cyber intrusions at machine speed. Since at least August 2026, a variety of malicious cyber actors have used ARTEX to conduct campaigns targeting organizations globally across multiple sectors, including financial services, government, and technology.
ARTEX significantly reduces the time required to chain attack techniques and enables threat actors with minimal technical expertise to conduct complex, multi-target operations simultaneously.
Today, the FBI released a FLASH highlighting the tactics, techniques, and procedures and indicators of compromise associated with the ARTEX framework. Organizations should follow the mitigation steps outlined in the FLASH to improve their security posture in response to ARTEX and similar agentic SI frameworks: https://www.ic3.gov/CSA/2026/261113.pdfView the quoted post on X