FBI warns hackers are using a free AI tool to break into networks in under three hours

The bureau says the tool "significantly reduces the time required to chain attack techniques", and that it lets attackers with minimal technical expertise run complex operations against several targets at the same time. It produces a lot of noisy traffic that can trigger alerts, but the FBI says the speed of the attack leaves defenders little time to respond in a coordinated way before the attackers reach their goal.

What is ARTEX and how does it work?

The tool is called ARTEX. According to the FBI, it is a multi-agent platform written in the Go programming language. It turns goals written in plain language into commands that specialised AI agents carry out, with little human input after the objective is set.

ARTEX does not include its own AI model. It connects to outside providers, including Anthropic's Claude and OpenAI's GPT, as well as DeepSeek, GLM, Grok and Kimi. In attacker-run installations the FBI says Chinese models are the most common, with DeepSeek's Flash family dominating because of its capability, relatively low cost and lack of observable guardrails when a request is framed as penetration testing.

The FBI says the tool is especially good at finding and exploiting overlooked systems, such as partner and supplier portals, mobile back-ends, legacy services and third-party integrations, and at mapping trust relationships between organisations so attackers can move from a weaker supplier into a bigger target.

Campaigns named in the FBI alert

The alert points to two notable campaigns. In one, financially motivated attacks on South Korean financial institutions led to the theft of personal information on about 67,000 people. In the other, a supply-chain compromise affecting customers of ConnectWise Cloud Backup gave attackers access to more than 2,250 downstream tenants.

The alert's own text does not name a country behind ARTEX activity. Its footnotes, however, cite a Microsoft Threat Intelligence report from 21 October 2026 headlined "AI-driven, large-scale nation-state campaign using ARTEX enables supply chain compromise". Much of the FBI's advice is aimed at Microsoft cloud customers, including checking Microsoft Entra and Microsoft 365 records.

The ARTEX developer pulled the code, but it is still out there

ARTEX was released on GitHub in July 2026 by a developer using the name "Autumn-27", who said it was meant for authorised security testing. The repository was taken down on 8 October 2026 after reports of abuse by threat actors.

The FBI says the tool still circulates through community forks, localised versions, archived copies and a paid edition called ARTEX PRO. As of early November, researchers had found more than 1,600 ARTEX control consoles exposed on the public internet, and the FBI says the real number is likely significantly higher once systems behind firewalls are counted.

How organisations can defend against ARTEX attacks

The FBI urges organisations, particularly those running internet-facing applications, self-service portals, cloud infrastructure and supplier systems, to start by listing every internet-facing application, including peripheral and forgotten ones, and to restrict cloud administration and application-publishing interfaces to trusted networks.

It also advises applying least-privilege rules to multi-tenant application permissions and watching for new credentials being added to apps, putting rate limits and alerts on partner and employee portals to catch rapid, sequential lookups, and scanning code and configuration for embedded secrets, rotating any that are exposed. Organisations responding to an incident should keep their logs and evidence without delaying containment.

Anyone who suspects they have been targeted is asked to contact their local FBI field office or report through the Internet Crime Complaint Center at ic3.gov.

Also on JAM this week

Two other technology disruptions made headlines on the same day: the Microsoft 365 outage that hit ASIO and the AFP, and the nationwide FAA ground stop of US flights. The FBI alert does not link ARTEX to either incident.