Amazon's threat intelligence team said on Friday, Nov. 13, that its decoy servers captured records in which criminals' AI agents described their own attacks. AI agents are AI that can carry out tasks on their own, such as using apps and websites, instead of only answering questions. From Oct. 3 to Nov. 5, some decoys in MadPot, Amazon's worldwide network of fake targets that record what attackers do, posed as popular AI services. The agents, which Amazon believes were built with ARTEX, a publicly available AI tool made for testing a network's defenses, sent requests to the decoys as if they were the AI that decides each next step.
Agent software sends its running history along with each request, so the AI it relies on knows what has already happened. Amazon says that is why single requests often held a campaign's full record: the attackers' instructions, the tools used and the results the agents reported. Amazon says it is moderately confident that ARTEX was behind the campaigns, because the records refer to ARTEX's tools.
The main campaign, Amazon says, stole keys to AI models. These keys are secret codes that work like passwords and let a program use a paid AI service on the owner's bill. Amazon says the attackers most likely wanted to use those models while someone else paid. The agents' records show the stolen keys paying for the AI that powered their search for more keys. The agents went after online AI apps that store keys for several AI companies at once, since one poorly protected settings page can expose many accounts. Amazon says targets included AI tools such as LiteLLM, Dify, Langflow, Open WebUI and Ollama, attacked through known flaws and default passwords. The agents also searched code that programmers share publicly on GitHub, ready-made software packages, packaged copies of software that companies run on their servers, AI model-sharing sites, Telegram channels and paste sites, where anyone can post text for others to read. ARTEX is the same tool Microsoft named on Nov. 5 in its report on attackers using AI agents to hunt for keys left in public code.
In a second campaign, agents worked on getting past the identity checks at two cryptocurrency exchanges. Their records describe building live deepfake video, in which AI makes a face look real and moving, to pass a selfie check, where an app has a person move in front of the camera to prove they are real and present. Their records also describe editing ID photos so the hidden data inside each image file matched an untouched camera shot. Against one verification company's selfie check, the best recorded attempt made every movement the check asked for, but the check rejected the fake video every time the agents recorded. Amazon does not say whether the edited ID photos got through. At least four agents worked at once, Amazon says, and they handed work to one another.
Amazon says with moderate confidence that the campaigns came from separate groups linked to China. It points to instructions written in simplified Chinese, the script used in mainland China, China time zone settings and targets that fit Chinese interests. Some instructions told the agents to leave targets in mainland China and government websites alone. Amazon says it told customers of its cloud business, AWS, who may have been affected, and published the internet addresses the attackers used so others can check their own systems.
Amazon did not watch the attacks as they happened and says it cannot verify the results the agents reported, so it is not known how many of the hundreds of targets in the records were actually broken into. Amazon says none of the techniques were new, but AI agents let attackers work faster and keep at it longer. It says that, by the agents' own accounts, they succeeded where basic security was missing, such as default passwords, keys left in code and software that was never patched. Amazon advises organizations to assume that exposed keys and setup mistakes will be found quickly. It says AI apps and the services that pass requests to AI models need the same protection as other business systems, and that unexpected AI spending can be a sign of misuse.