ARTEX goes from pentesting tool to attacker staple in three months

A security researcher’s AI agent breached an internal sales application used by WorkOS’s go-to-market teams, the developer platform provider confirmed on Friday.

“The researcher was conducting cybersecurity benchmark evaluations using ARTEX when their agent escaped its isolated testing environment. Its interaction with WorkOS was unintended,” WorkOS said.

The researcher confirmed that they deleted and did not further share the customer data the agent obtained from WorkOS’s systems, and the company acknowledged the security failings that led to the breach and its delayed detection of the unauthorized API requests and data retrieval.

WorkOS has since blocked internet access to all its internally developed tools, rotated credentials for connected services, and started using ARTEX itself to test its internet-facing systems for exposure.

What is ARTEX?

Published on GitHub on July 26, 2026, by a user going by Autumn-27, ARTEX is an LLM-driven open-source penetration testing framework that runs attacks largely on its own: the operator sets a goal, and AI agents plan and carry out the steps needed to reach it.

ARTEX was built for authorized security testing, but attackers started using it within weeks.

On October 7, CrowdStrike reported that a likely financially motivated threat actor had used ARTEX to breach a South Korean finance company.

ARTEX’s author then denied any involvement and made the project closed-source. But by that point, the code had more than 12,000 forks, and archived copies, translations and rebranded versions (e.g., ScopeWeaver, “ARTEX PRO”) are still circulating, according to Google’s threat researchers.

Who is using ARTEX?

Attackers have long repurposed red-team tools such as Cobalt Strike and Metasploit. ARTEX is following the same path, only much faster.

Over the past month, several threat intelligence teams have documented ARTEX in use for everything from opportunistic credential theft to state-sponsored espionage.

Microsoft says unnamed attackers have used it since August to search GitHub for leaked secrets. The agents then used the valid ones to break into Azure and Microsoft 365 tenants and steal Key Vault secrets, storage keys and AI service API keys. In one case, an agent went from searching GitHub to stealing data in five minutes.

Storm-0940, a group Microsoft describes as Chinese state-aligned, used ARTEX in the ConnectWise Cloud Backup supply-chain compromise and attempted sign-ins to more than 2,250 tenants. Wiz has since seen the group go after other IT and software vendors, aiming to reach their customers’ data.

CrowdStrike says VAPOR PANDA, a China-nexus group, used ARTEX against more than 200 organizations in an 11-day window, mostly government and defense bodies. A human operator steered the agents at key decision points, and CrowdStrike confirmed post-exploitation activity at nine of the targeted organizations.

Not only ARTEX

Google’s threat intelligence team says ARTEX is one of several similar open-source frameworks (alongside PentAGI, Hexstrike and CAIRN) now used by both extortion gangs and espionage groups. In one case, attackers went from a compromised account to deep system access in 15 minutes.

Google’s researchers still consider the current use of these tools to be unsophisticated, but effective.

“The emergence of Artex and similar agentic offensive intrusion frameworks underscores a broader shift toward threat actor adoption of open source multi-agent offensive frameworks, as well as potentially custom agentic harnesses. This represents a paradigm shift towards intrusions occurring at machine speed, with the automated chaining of complex attack paths scaling intrusions exponentially,” Google’s researchers noted.

Lessons from the discovered attacks

With these tools in hand, attackers can quickly take advantage of many cracks in organizations’ security posture.

The WorkOS incident also showed what happens when basic controls are missing. The tool ran on a legacy platform that hadn’t yet been migrated to one with stronger baseline protections, and its API was reachable from the internet and accepted a predictable credential meant for local development. Also, nothing limited the bulk extraction of data, and its monitoring didn’t flag the activity.

Luckily for WorkOS, the operator came forward, but a malicious attacker wouldn’t have.

Leaked credentials are what attackers are most actively hunting for, GitGuardian says. The company counted 28.65 million new hardcoded secrets on public GitHub in 2025, and about 64% of valid secrets it found in 2022 still worked four years later.

Microsoft and GitGuardian advise organizations to:

• Treat any secret exposed in a public repository as compromised, and revoke or rotate it without waiting to confirm abuse. “Start with valid, high-privilege credentials, especially OAuth application and service principal secrets that provide access to sensitive cloud resources, data, or other credentials,” GitGuardian counsels.
• Scan public and internal repositories, CI/CD pipelines and commit history for hardcoded secrets, and enable push protection.
• Hunt for a single source authenticating as multiple service principals, or a single app requesting tokens for several Azure services in a short window. (Blocking IP addresses won’t help much, because the agents rotate their fingerprints.)
• Deploy honeypots and decoys. (Microsoft says they reduced attack traffic reaching real assets.)

CERT-EU has observed several threat actors around the world wielding ARTEX to scan for and exploit public-facing applications, and has provided its own set of recommendations to minimize that risk.

For now, these LLM-powered, semi-automated tools favor speed over stealth and leave forensic traces that help with detection. But, if Google’s timeline is right, that won’t last long: the researchers expect noisy attacks with little to no human interaction to start in the next 1 to 3 months, and stealthier, fully autonomous agentic attacks to begin within 3 to 6 months.

“Security teams, developers, and system administrators will need to fundamentally rethink defense strategies to counter scalable, autonomous software,” Google notes, and urges them to implement or strengthen long-standing security best practices such as control-plane isolation, short-lived credentials, least privilege, segmentation, and behavioral detection.

Subscribe to our breaking news e-mail alert to never miss out on the latest breaches, vulnerabilities and cybersecurity threats. Subscribe here!