The FBI issued a warning on Friday, Nov. 13, about ARTEX, a security-testing tool that uses AI and that hackers have turned into a way to automate break-ins. The FBI says a variety of hackers have used ARTEX since at least August 2026 against organizations around the world. The targets span finance, government, technology, defense, chipmaking, energy, health care, manufacturing, telecommunications and law.
The FBI says ARTEX works "at machine speed," from scouting a target to carrying data out. Some break-ins went from first targeting to privileged access, the kind of high-level control usually reserved for system administrators, in under three hours. The FBI says the tool lets attackers with little technical skill run complex attacks on several targets at the same time.
ARTEX was released as open source, its code posted for anyone to use, study, change and share. It runs AI agents, AI that can carry out tasks on its own instead of only answering questions. A user types a goal in plain language, and the agents turn it into commands. The FBI says it needs little human input once the goal is set. ARTEX has no AI of its own. Instead it plugs into outside AI models, the kind behind chatbots such as ChatGPT, Claude and Gemini, including Anthropic's Claude, OpenAI's GPT, DeepSeek, GLM, Grok and Kimi.
Among copies of ARTEX run by attackers, the FBI says, Chinese AI models were the most common, led by DeepSeek's Flash models. The FBI says attackers favored DeepSeek's Flash models for their mix of ability and relatively low cost, and because they showed no visible safeguards when a request was framed as security testing.
The FBI highlights two campaigns that security companies reported in October. Attacks on South Korean financial firms, aimed at making money, took personal information on about 67,000 people. In another, a break-in that hit customers of ConnectWise Cloud Backup, a service other companies rely on, opened the way into the cloud systems of more than 2,250 organizations further down the chain.
ARTEX first appeared on GitHub in July 2026, posted by a developer using the name "Autumn-27", who said it was meant for authorized security testing within set limits. The developer took the code down on Oct. 8 after reports that attackers were abusing it. The FBI says ARTEX still spreads through copies, altered versions, archives and a paid version called ARTEX PRO. Security researchers counted more than 1,600 ARTEX control panels reachable from the open internet in early November. The FBI says the total number of ARTEX setups is likely much higher, counting those hidden behind firewalls or on private networks.
The FBI says ARTEX attacks create bursts of unusual network activity that can set off security alerts, but move so fast that defenders have little time to respond. It urges organizations to list every app they run on the internet, including easily overlooked ones such as partner and supplier portals and old services, and to limit access to cloud and other management tools to trusted networks or private, dedicated connections. The FBI does not say how many organizations have been broken into with ARTEX across all the campaigns.