On November 13, 2026, the Federal Bureau of Investigation (FBI) released a TLP:CLEAR FLASH report (FLASH-20261113-001), Threat Overview of ARTEX Autonomous Penetration Testing Framework, through the Internet Crime Complaint Center (IC3). The advisory warns that ARTEX, an open-source, large language model (LLM) driven agentic platform built for penetration testing, has been weaponized by a variety of malicious cyber actors to automate intrusions “at machine speed, from reconnaissance through data exfiltration.” It pulls together the tactics, techniques, and procedures (TTPs) and indicators of compromise (IOCs) reported by eleven industry and government sources, maps observed activity to MITRE ATT&CK, and sets out a prioritized list of mitigations.

OODA Loop has tracked ARTEX since the first reports of its use against South Korean banks in early October, including the initial bank intrusions, the developer taking the project closed source, and Storm-0940’s use of agentic AI in the ConnectWise breaches. The FBI FLASH is the clearest signal yet that U.S. law enforcement views agentic offensive frameworks as a mainstream threat rather than a research curiosity. This post summarizes what the advisory says and what it means for executives.

Bottom Line Up Front

• Agentic intrusion is now operational. The FBI says that since at least August 2026, a variety of malicious actors have used ARTEX against organizations globally in financial services, government, technology, defense, semiconductor, energy, healthcare, manufacturing, telecommunications, and legal sectors.
• Speed is the headline risk. Citing Microsoft, the FBI notes some intrusions progressed from initial targeting to privileged access in under three hours, leaving defenders little time to coordinate a response even when alerts fire.
• The barrier to entry has dropped. The FBI says ARTEX lets actors with minimal technical expertise run complex, multi-target operations simultaneously.
• Taking the code down did not stop it. The original developer removed the GitHub repository in October 2026, but forks, localized variants, archived copies, and a commercial ARTEX PRO version keep it available. Researchers counted over 1,600 publicly exposed ARTEX consoles in early November.
• The weak points are peripheral. Partner portals, mobile backends, employee apps, legacy services, exposed cloud administration endpoints, and trusted third-party applications are where ARTEX has found its way in. The FBI’s top recommendation is to inventory and shrink that external attack surface now.

About the Advisory

The FLASH is an FBI product, marked TLP:CLEAR, meaning it may be shared without restriction. It is not a joint advisory; no other U.S. agency is listed as a co-author. Its findings are footnoted to eleven published sources: Akamai, two Microsoft reports, two Google Threat Intelligence Group (GTIG) and Mandiant reports, Censys, CrowdStrike, Zscaler ThreatLabz, CERT-EU, and Check Point Research. Links to each are collected in the reference section at the end of this post. The FBI says it does not endorse any commercial entity referenced, and it asks organizations to vet IOCs before blocking on them.

What ARTEX Is

ARTEX is an autonomous, multi-agent penetration testing platform written in Go. It translates high-level goals described in natural language into machine commands executed by what the advisory calls specialized “super intelligence (SI) agents,” requiring minimal human interaction beyond setting the objective. ARTEX does not include its own model. It integrates with external LLM providers, which the FBI lists as frontier models (Anthropic Claude, OpenAI GPT) and open-source or Chinese-origin models (DeepSeek, GLM, Grok, Kimi).

Citing analysis of attacker-controlled instances by Zscaler and Check Point Research, the FBI says Chinese models are most prevalent, with DeepSeek Flash family models dominating “due to their balance of capabilities, relatively low cost, and lack of observable guardrails when framed for penetration testing.” GTIG’s analysis describes ARTEX as abstracting the attack lifecycle across six specialized sub-agents, and Censys describes a planner agent that converts the goal into attack “intents” executed by worker agents in a loop until the goal is met.

The FBI says the developer “Autumn-27” released ARTEX on GitHub in July 2026, and that it gained an estimated 1,500 to 2,000 GitHub stars within 10 weeks. The developer stated it was intended for authorized testing and made the repository unavailable on October 8, 2026, following reports of abuse. ARTEX nonetheless remains widely accessible through mirrors, community forks, localized variations, archived copies, and the commercial ARTEX PRO. As OODA Loop noted at the time, closing the source came after the tool was already in the wild. ARTEX is also not alone: GTIG reports threat actors using similar frameworks, including PentAGI, which OODA Loop covered in April.

The Campaigns Behind the Warning

South Korean financial institutions

The FBI cites financially motivated attacks against South Korean financial institutions that resulted in exfiltration of personal information from approximately 67,000 individuals, drawing on CrowdStrike, Zscaler ThreatLabz, and CERT-EU. The advisory’s IOC table ties the ARTEX host 38.244.50[.]120 and an LLM API reseller domain, xcai[.]pro, to this campaign. CrowdStrike and Zscaler each assessed with moderate confidence that the operator was a financially motivated Chinese speaker. OODA Loop covered the campaign in early reporting, technical analysis, and reports on the suspected operator.

The ConnectWise Cloud Backup supply chain compromise

The FBI also cites a supply chain compromise affecting ConnectWise Cloud Backup customers that enabled access to more than 2,250 downstream tenants. Microsoft attributes this activity to Storm-0940, which it describes as a China-state aligned actor, and reports that the actor used ARTEX to accelerate scanning, password spraying, and OAuth application abuse. Several of the advisory’s recommendations are specific to this incident, including reviewing every Microsoft 365 tenant where affected ConnectWise applications were ever authorized and keeping those connections disabled until ConnectWise provides formal restoration instructions. ConnectWise has published advisories and a technical investigation and remediation guide.

Financially motivated expansion

The advisory’s indicator table also lists command and control and ARTEX server infrastructure from a Storm-3358 campaign, sourced to Microsoft’s November 2026 report on ARTEX abuse against the financial sector, with infrastructure noted as active as of November 6, 2026. Separately, citing Check Point, the FBI says agents have demonstrated the ability to modify iOS application distribution infrastructure via exposed cloud credentials. OODA Loop has also reported on CrowdStrike findings of ARTEX use against more than 200 organizations and reported links to attacks on Japanese companies.

Why the FBI Is Worried

The advisory lists five risks based on observed capabilities and continued adoption:

• Accelerated multi-target operations. Agents automate time-consuming enumeration and exploitation, so small groups can run concurrent campaigns at a scale previously unavailable to them.
• Exploitation of overlooked attack surfaces. Citing Akamai, the FBI says ARTEX excels at finding peripheral systems such as partner and supplier portals, mobile backends, employee and sales-support applications, legacy services, third-party integrations, and applications built by individual business units.
• Supply chain compromise. Agents can systematically map trust relationships and pivot from a weaker supplier, CI/CD pipeline, or integrated software provider into high-value upstream networks.
• Reduced barrier to entry. Actors with minimal expertise can run sophisticated campaigns.
• Compressed detection window. ARTEX generates high volumes of forensically noisy traffic that may trigger alerts, but attack speed limits the time available for a coordinated response.

Observed TTPs Mapped to MITRE ATT&CK

The FBI maps observed ARTEX activity across the intrusion lifecycle. The table below condenses the advisory’s mapping; technique links go to MITRE ATT&CK.

Phase	Observed activity (per the FBI)	ATT&CK techniques
Initial reconnaissance	Mapping effective permissions of Azure credentials (SAS tokens, service principals, Kudu credentials, storage account keys) with sub-second capability checks and ARM deployment validation dry-runs; testing compromised IAM permissions with DryRun flags; fuzzing web directories across 500+ requests; WHOIS asset mapping; querying api.db-ip[.]com for victim geolocation	T1595 (Active Scanning), T1580 (Cloud Infrastructure Discovery), T1087.004 (Cloud Account), T1069.003 (Cloud Groups), T1526 (Cloud Service Discovery)
Initial access	Unsigned SAML assertions, XXE, SSRF, SQL injection, command injection, SSTI, IDOR, authentication bypass, missing API authentication, anonymous file upload, hardcoded admin passwords in JavaScript bundles, weak credentials, stolen VPN configurations, abuse of cross-account cloud trust and third-party vendor credentials	T1190 (Exploit Public-Facing Application), T1078 (Valid Accounts), T1133 (External Remote Services), T1195 (Supply Chain Compromise), T1199 (Trusted Relationship), T1606.002 (SAML Tokens), T1552.001 (Credentials in Files)
Foothold and persistence	JSP and PHP web shells (including via MySQL log poisoning); Kudu administrative API abuse; C2 on internal Windows database servers; open-source RATs (WISP, vshell, AdaptixC2); SSH keys and Elastic IPs; password-reset account takeover; credentials added to existing OAuth applications	T1505.003 (Web Shell), T1078.004 (Cloud Accounts), T1098.001 (Additional Cloud Credentials), T1574.001 (DLL), T1036.005 (Masquerading), T1105 (Ingress Tool Transfer), T1059 (Command and Scripting Interpreter)
Privilege escalation	Launching compute with high-value IAM roles; Kerberoasting; SQL injection to dump credentials; DCSync to steal the krbtgt key; accounts created with is_admin=true; resource-based constrained delegation abuse; metadata service queries via XXE; forged admin tokens using unrotated keys	T1134.001 (Token Impersonation/Theft), T1098.003 (Additional Cloud Roles), T1552.005 (Cloud Instance Metadata API), T1606 (Forge Web Credentials), T1558.003 (Kerberoasting)
Internal reconnaissance	Iterative PowerShell enumeration of domain controllers; enumeration of over 110,000 Active Directory objects; reading LAPS passwords; inventorying endpoint sensor coverage to find unprotected Windows hosts	T1518.001 (Security Software Discovery), T1555 (Credentials from Password Stores), T1087.002 (Domain Account), T1552.006 (Group Policy Preferences), T1059.001 (PowerShell)
Lateral movement	Attempted Pass-the-Ticket, WinRM, Kerberos relay, and Pass-the-Hash against domain controllers (blocked by endpoint protection in the reported case)	T1550.003 (Pass the Ticket), T1550.002 (Pass the Hash), T1021.006 (WinRM), T1557.001 (LLMNR/NBT-NS Poisoning and SMB Relay)
Collection and exfiltration prep	Backend SQL interrogation; mass blob reads; custom EC2 boot scripts to harvest data; command output sent to rotating webhook.site endpoints; mailbox reads; new 100GB volumes for staging	T1114.002 (Remote Email Collection), T1555.006 (Cloud Secrets Management Stores), T1530 (Data from Cloud Storage), T1005 (Data from Local System), T1074.001 (Local Data Staging), T1074.002 (Remote Data Staging)
Command and control	Residential proxies; Tor, SOCKS proxies, and compromised relays; tunneling via Chisel and SoftEther; BLOODALCHEMY communicating with C2 domains	T1090 (Proxy), T1090.003 (Multi-hop Proxy), T1572 (Protocol Tunneling), T1071.001 (Web Protocols)

Two patterns stand out. First, much of the activity abuses identity and cloud control planes (service principals, OAuth applications, IAM roles, Kudu publishing endpoints) rather than exploiting novel software flaws. Second, the techniques themselves are familiar. What changes is that an agent can chain them in minutes and try many paths at once. The advisory does not cite specific CVEs; its initial access list is made up of vulnerability classes and misconfigurations, which is consistent with Akamai’s point that AI “changes the speed of attack, not the fundamentals.”

Indicators of Compromise

The FLASH lists IP addresses for ARTEX hosts, proxies, and C2 servers tied to the South Korean financial campaign (CrowdStrike, Censys), the ConnectWise campaign (Microsoft, including Microsoft Graph access via compromised apps from transient VPN IPs relevant October 15 to 16, 2026), and the Storm-3358 campaign (Microsoft). It lists one domain, xcai[.]pro, described as an LLM API reseller. Defenders should take the full, defanged list directly from the FLASH rather than from secondary sources.

The FBI stresses that cloud-hosted infrastructure is frequently reassigned, so these indicators should be treated as historically observed during the activity window and corroborated with current telemetry before blocking. More durable are the behavioral indicators, sourced to Zscaler:

• Unexpected outbound API calls to LLM endpoints such as api.anthropic.com, api.deepseek.com, open.bigmodel.cn, and api.x.ai, investigated alongside other suspicious activity.
• High-frequency automated requests with sequential enumeration against login and search endpoints.
• Outbound HTTPS transfers of structured data such as names, phone numbers, and financial information to unauthorized destinations.
• *.aspx or *.jsp files in unexpected web application paths.

What the FBI Wants Reported

The FBI asks organizations to report suspicious activity to their local FBI field office or to IC3. For incidents involving ARTEX or similar agentic frameworks, it requests eight categories of information: ARTEX console screenshots and configuration files; authentication and access logs (including service principal sign-ins from unusual networks); Microsoft Graph, Entra, and Microsoft 365 audit activity; LLM infrastructure indicators such as outbound connections to LLM APIs, self-hosted LLM gateways or resellers (CLIProxyAPI, New API), and token or billing anomalies; cloud and container activity; exploitation and persistence artifacts; attack characteristics such as compressed bursts of activity and duplicate requests from sub-agents; and loss and impact information including time to detection and containment.

The FBI’s Recommended Mitigations

The advisory groups its “Immediate Actions” into four areas. Highlights:

Reduce the external attack surface

• Inventory all internet-facing applications, including peripheral partner, supplier, mobile, employee, sales-support, legacy, and business-unit applications.
• Restrict cloud administration, network device management, Kudu/SCM publishing interfaces, hypervisors, backup platforms, and other sensitive services to trusted networks or dedicated administrative paths.
• Disable basic publishing authentication where not required, restrict deployment credentials, and consider deployment models such as run-from-package that reduce direct modification of deployed files.
• Govern public IP allocation and require architecture review before workloads or management interfaces are exposed to the internet.
• Move enterprise applications behind Zero Trust access solutions where feasible (see CISA’s Zero Trust Maturity Model).

Harden identity and access

• Apply least privilege to multi-tenant application permissions and consent grants, and monitor credential additions, privilege assignments, and anomalous app-only activity.
• Review every Microsoft 365 tenant where affected ConnectWise applications are or were installed, searching by application ID rather than display name, and review successful and failed service principal sign-ins separately without limiting the review to published IPs.
• Review Microsoft Entra audit records for new credentials, applications, owners, role assignments, consent grants, and Conditional Access changes; revoke and rotate if suspicious activity is confirmed.
• Require approval for higher-risk certificate enrollment, enable Extended Protection for Authentication on CA web interfaces, and monitor unusual enrollment involving privileged users.

Strengthen application protections

• Put rate limits, recipient limits, and transaction thresholds around high-impact business APIs, and alert when applications operate well outside normal volume.
• On partner and employee portals, alert on sequential lookups and unusually high record access per session, and enforce server-side authorization.
• Stop returning stack traces, SQL errors, internal paths, and framework details to unauthenticated users.
• Scan configurations, infrastructure-as-code, pipelines, repositories, container images, and build artifacts for embedded secrets, and rotate exposed credentials promptly.

Preserve evidence and respond

• Preserve Entra sign-in and audit logs, Purview Audit records, SIEM data, and Microsoft Graph telemetry, without delaying urgent containment.
• Review ConnectWise-related activity starting at least October 1, 2026, and investigate earlier related activity including failed authentications.
• Remove unauthorized credentials, grants, and identities only after preserving evidence; do not delete enterprise applications as a first response.

What This Means for Executives

The FLASH confirms a shift OODA Loop has been describing for some time, from adversaries using LLMs as assistants to agents that run large parts of an intrusion on their own. Our OODA Network survey on agentic AI and our analysis of the infinite attack surface of agentic AI both anticipated this. Several implications follow:

• Your attack surface is what an agent can find, not what your inventory says. ARTEX succeeds on the systems that get less attention. Boards should ask whether the organization has a complete, current inventory of internet-facing assets, including those owned by business units and suppliers, and how quickly it can be produced. Our recent essay Guarding the Wrong Door draws a related lesson about defending against the threat leaders imagine rather than the conditions adversaries actually exploit.
• Response time must be measured in minutes. If intrusions can reach privileged access in under three hours, processes that depend on a morning triage meeting will fail. Executives should test whether alerts on cloud identity changes, new OAuth credentials, and anomalous service principal sign-ins trigger automated containment.
• Third-party trust is now an automated attack path. The ConnectWise case shows a single compromised vendor application opening a path to thousands of tenants. Inventory the applications that hold app-only permissions in your tenants, and treat vendor consent grants as privileged access. See also our coverage of securing agentic identity.
• Fundamentals still win, but they must be continuous. The advisory cites no zero-days. Exposed admin panels, hardcoded credentials, verbose errors, and unrotated keys are the raw material. CERT-EU makes the same point and urges organizations to keep even minor findings in the remediation cycle because AI tools chain them together.
• Watch for AI in your own egress. Unexpected calls from servers to LLM APIs or resellers are now a useful signal. Organizations adopting AI themselves, as described in our Cybersecurity AI Acceleration Story and Financial Sector AI Acceleration Story, will need baselines that separate sanctioned AI use from attacker infrastructure.
• Expect more, not fewer. The FBI notes ARTEX persists through forks and a commercial edition, and GTIG reports similar frameworks in use. Planning should assume that agentic offensive tooling is now a permanent part of the threat landscape.

Read the full advisory: FBI FLASH-20261113-001, Threat Overview of ARTEX Autonomous Penetration Testing Framework.

Sources Cited in the FBI Advisory

• Akamai, What ARTEX Reveals About Overlooked Attack Surfaces (October 23, 2026)
• Microsoft, AI-driven, large-scale nation-state campaign using ARTEX enables supply chain compromise (October 21, 2026)
• Google Threat Intelligence Group and Mandiant, ARTEX and Friends: Enter Agentic Offensive Frameworks, including Mandiant’s defensive strategies (October 30, 2026)
• Censys, ARTEX: Agentic Asbestos (November 5, 2026)
• CrowdStrike, Unknown Threat Actor Uses AI-Driven ARTEX to Target South Korean Finance (October 7, 2026)
• Zscaler ThreatLabz, Threat Actor Abuses Agentic AI Pentesting Framework to Target South Korean Financial Institutions (October 14, 2026)
• CERT-EU, From Penetration Testing to Cyber Threat: Beware of ARTEX (November 5, 2026)
• Check Point Research, Hacking on Autopilot: Inside ARTEX Cybercrime Campaigns (November 5, 2026)
• Microsoft Threat Intelligence, ARTEX abuse expands as cybercriminals target financial sector (November 2026)
• Also relevant (not cited in the FLASH): ConnectWise Cloud Backup technical investigation and remediation guide and ConnectWise Trust Center advisories

Further Reading on OODA Loop

• How Open-Source AI Pen-Testing Framework “ARTEX” Rapidly Morph Into a Hackers Weapon
• State-Backed Threat Group Storm-0940 Deployed Agentic AI in High-Speed ConnectWise Breaches
• China-Linked Hackers Target Over 200 Organizations Using DeepSeek and ARTEX, CrowdStrike Says
• Security Firm Links China-Linked “Artex” AI Agent to Recent Cyberattacks on Japanese Companies
• Chinese Developer Makes ARTEX AI Agent Closed-Source After Korean Bank Hack
• Hackers Use Chinese AI Tool to Hit South Korean Banks, Exposing New Risk
• Why AI-Driven Cyberattacks Are Accelerating and Becoming Harder to Stop
• The Infinite Attack Surface of Agentic AI
• A New Wave of Cyberattackers Enabled by Adversarial Use of LLMs and Agentic AI
• The Cybersecurity AI Acceleration Story: Early Adoption Gains, Expanding Attack Surfaces, and the Race Between Autonomy and Governance
• Agentic AI: Risks, Opportunities, and the Race Between Capability and Control: An OODA Network Survey
• The September 2026 OODA Network Meeting: AI After the Frontier, Economics, Governance, and Offensive Cyber
• The Financial Sector AI Acceleration Story
• FBI and CISA Release Advisory on Ransomware Gang (Scattered Spider) Behind the Recent MGM Attack