FBI alert states Artex was used to automate intrusions across multiple industries
Start here
On November 13, 2026, the FBI issued a FLASH alert stating that since at least August 2026, multiple malicious cyber actors have weaponized the open-source LLM agent penetration-testing framework Artex to conduct automated intrusions against multiple industries including finance, government, and technology. The FBI stated that the framework can turn any LLM into an attack tool, automating multiple intrusion stages from reconnaissance to data exfiltration, with some intrusions taking less than three hours from initial target identification to obtaining privileged access, and that attackers with limited technical capability can also use it to conduct multi-target operations simultaneously. Cases cited in the alert include an attack on a South Korean financial institution that stole the personal information of approximately 67,000 people, and a ConnectWise Cloud Backup supply chain intrusion affecting more than 2,250 downstream tenants. The FBI also stated that among attacker-controlled Artex instances, Chinese models are the most common, with the DeepSeek Flash series used most due to lower cost and no observable guardrails when used for penetration testing. The tool was released in August by the GitHub account Autumn-27, and developer Li Puhua stated on October 8 that it had been abused by malicious actors and deleted the repository; the FBI stated that the framework continues to spread through community forks, archived copies, and the commercial version Artex PRO. The alert cited Censys research stating that as of early November 2026, more than 1600 publicly exposed Artex console instances existed.
Generated by AI from reports · Updated 15 hr ago
Attention and developments
Attention, hourlyA report
Now 75, -1% in 24 hours·Peak 80 (Nov 15 11:00)·1 report in this range, 1 earlier
Progress timeline
- X @AISecHubSelectedFBI issues FLASH alert: open-source LLM agent penetration testing framework ARTEX weaponized by attackers for automated intrusions
The FBI issued a FLASH notification on November 13, 2026, warning that at least since August 2026, multiple malicious cyber actors have weaponized the open-source LLM agent penetration testing framework ARTEX to conduct automated intrusions against multiple industries worldwide, including finance, government and technology. The notification said ARTEX greatly shortens the time to chain attack techniques, with some intrusions going from initial target identification to obtaining privileged access in under three hours, and that attackers with limited technical capability can also use it to conduct multi-target operations simultaneously; cases include an attack on a South Korean financial institution that stole the personal information of approximately 67,000 people, and a ConnectWise Cloud Backup supply chain intrusion affecting more than 2,250 downstream tenants. After the original developer deleted the GitHub repository in October 2026, the framework continued to spread through community forks, archived copies and the commercial version ARTEX PRO; as of early November 2026, researchers found 1,600 publicly exposed ARTEX console instances. The FBI recommends that organizations operating internet-exposed applications, self-service portals, cloud infrastructure and partner systems implement the mitigation measures in the notification.
- WebAI Threat Watch (aithreat.io)· Media coverage¿Qué es ARTEX? FBI advierte sobre nueva amenaza de inteligencia artificial utilizada por hackers(opens the original post in a new tab)
- WebAI Threat Watch (aithreat.io)· Media coverageFBI Warns Hackers Are Weaponizing ARTEX AI Framework to Launch Autonomous Cyberattacks Worldwide(opens the original post in a new tab)
- X@jgreigj· Discussionhttps://t.co/LhY0NbxTTR(opens the original post in a new tab)
- The RecordSelectedFBI alert says Artex automates cyberattacks at machine speed
The FBI issued an urgent alert saying the open-source AI platform Artex is being used extensively by cybercriminals and state-backed actors to break into government agencies and multiple critical industries. The FBI said the framework can turn any LLM into an attack tool, automating multiple intrusion stages from reconnaissance to data exfiltration; some intrusions advanced from initial positioning to privileged access in under three hours, and let lower-skilled actors conduct multi-target operations simultaneously. The FBI also said that among attacker-controlled Artex instances, Chinese models are the most common, with the DeepSeek Flash series used most because of lower cost and no observable guardrails when used for penetration testing. The tool was released in August by the GitHub account Autumn-27; developer Li Puhua stated on October 8 that it had been abused by malicious actors and deleted the repository; the FBI said the framework continues to spread through community forks, localized variants, archived copies and commercial versions. The alert cited Censys research saying more than 1600 publicly exposed Artex console instances exist.
Related discussion
What people think
By account: 13 hold one of the views above, 17 posted without a clear one, and 37 more only relayed the news. AI drew the views from the posts; a post is placed only when three models, judging apart, all agree. The posts themselves are the record.
- X@gugx75o FBI soltou um alerta sobre o ARTEX, framework open source de pentest autonomo com IA (agentes em Go plugados em LLM t…(opens the original post in a new tab)
- X@ShadesbbbNew FBI alert for any business with a website or portal: ARTEX, an open-source AI hacking tool, has taken some attacks…(opens the original post in a new tab)
- X@samilaihoFBI flash alert says Artex tool automating cyberattacks at ‘machine speed’ https://t.co/aMdengdgfd(opens the original post in a new tab)
- X@justeliteFBI FLASH: attackers have used the ARTEX LLM pentest framework since August, some reaching privileged access in under 3…(opens the original post in a new tab)
- X@edgardnogueiraFBI flash alert: attackers use ARTEX, an open-source AI agent pentest tool, to go from targeting to privileged access i…(opens the original post in a new tab)
- X@vyoogamFBI alert on ARTEX, an AI attack framework: some intrusions reached privileged access in under three hours. Its advice…(opens the original post in a new tab)
- X@Killa_RunaXthe fbi just issued a flash alert warning that hackers are using an open source multi agent ai tool called artex to go…(opens the original post in a new tab)
- X@chris_uk2026The FBI has warned that hackers are using ARTEX AI agents to automate network attacks, with some intrusions reaching pr…(opens the original post in a new tab)
- X@chris_uk2026‼@FBI Reveals How Hackers Use ARTEX AI Agents to Gain Privileged Access in Under Three Hours Details: https://t.co/k…(opens the original post in a new tab)
- X@paul_fregoneseFrom initial access to privileged access in under three hours. The FBI's warning on Artex is worth reading if you track…(opens the original post in a new tab)
- X@alok3368The FBI put a name to the shift: ARTEX, an open-source framework that turns any LLM into an attack engine, automating i…(opens the original post in a new tab)
- X@trustBynhالـ FBI يحذّر من أداة Artex. الأداة تخلّي أشخاص بخبرة قليلة يخترقون شركات، وبعضهم وصل في ٣ ساعات. لو تشتغل في شركة، تأ…(opens the original post in a new tab)
Attention trend
New sources per day
- Nov 14: 33 new sources (2 outlets, 31 accounts)
- Nov 15: 37 new sources (1 outlets, 36 accounts)
- Nov 16: 0 new sources (0 outlets, 0 accounts)