FBI Warns AI Hacking Tool ARTEX Reaches Privileged Access in Under Three Hours

An AI hacking tool can take an intrusion from first targeting to privileged access in under three hours, the FBI warned on Friday in a FLASH alert dated November 13. The tool, ARTEX, automates what the bureau called "multiple phases of cyber intrusions at machine speed, from reconnaissance through data exfiltration," and criminals and state-backed hackers alike are now using it.

By Tom Whitfield

The bureau's figures give the scale. One campaign against South Korean financial institutions stole personal data on roughly 67,000 people. A separate supply chain compromise of ConnectWise Cloud Backup customers reached more than 2,250 downstream tenants. Censys counted more than 1,600 publicly exposed ARTEX consoles online as of early November.

The victim list matters for the hardware industry. Since at least August, ARTEX has been used against financial services, government, technology, defense, semiconductor, energy, healthcare, manufacturing, telecommunications and legal organizations worldwide. Chipmakers and their suppliers sit squarely inside that set.

How does ARTEX work?

ARTEX is an open-source penetration-testing framework written in Go. An operator types a goal in plain language, and AI agents translate it into commands and carry them out with little human input afterward. The framework has no model of its own. It connects to outside providers, including Anthropic's Claude, OpenAI's GPT, and models such as DeepSeek, GLM, Grok and Kimi.

On attacker-controlled instances, Chinese models dominate. The FBI said DeepSeek Flash leads because it combines capability, low cost and a "lack of observable guardrails when framed for penetration testing." That detail is the mechanism of the story: cheap inference plus no refusals equals intrusions that run at machine speed and cost almost nothing to repeat.

"ARTEX significantly reduces the time required to chain attack techniques, with some intrusions progressing from initial targeting to privileged access in under three hours," the FBI said. The framework lets attackers "with minimal technical expertise" run complex operations against several targets at once.

Who is behind the attacks?

Microsoft has tied the ConnectWise Cloud Backup compromise to Chinese state-backed actors. Amazon published research on Friday describing Chinese-linked groups using ARTEX to steal AI model credentials, with the stolen keys then paying for the inference behind further credential theft. In plain terms, stolen compute funds the next round of theft.

Attribution on the tool itself is thinner. The developer, who uses the handle "Autumn-27," released ARTEX on GitHub in July, according to the FBI, and pulled the repository on October 8 after reports of abuse, saying it was meant for authorized testing. The Record identified the developer as Chinese security engineer Li Puhua. The takedown changed little: community forks, mirrors, archived copies and a commercial ARTEX PRO version keep the framework available.

What should defenders do?

The FBI said ARTEX finds its openings in systems that receive less attention: partner and supplier portals, mobile backends, employee apps, legacy services and third-party integrations. Its traffic is noisy and trips alerts, but the speed leaves defenders almost no time to respond. For manufacturers with sprawling supplier networks, that is the core problem.

The alert lists IP addresses from the South Korea and ConnectWise campaigns, plus behavioral signs such as unexpected calls to AI model APIs and high-frequency sequential lookups on login and search pages.

Its recommendations are concrete:

• Inventory every internet-facing application.
• Keep cloud admin, backup and deployment interfaces off the open internet.
• Apply least privilege to multi-tenant application permissions.
• Rate-limit high-impact business APIs.
• Scan code and pipelines for embedded secrets.
• Review every Microsoft 365 tenant where ConnectWise apps were ever authorized.

Separately, the White House AI task force has discussed liability relief for companies that report AI-fueled cyberattacks, a signal that reporting rules may shift as these tools spread.

The takeaway is simple: attack tooling now costs little, runs fast and needs little skill, and defenders who leave secondary systems exposed will meet it first.