ARTEX, an Open-Source AI Pentest Framework, Now Appears in Reports From Google, Microsoft, CrowdStrike and WorkOS

ARTEX, a multi-agent framework for automated penetration testing, was published on GitHub on July 26, 2026 by a user called Autumn-27. By early November it had been named in intrusion reports from Google Threat Intelligence Group, Microsoft, CrowdStrike and WorkOS, according to a Help Net Security roundup dated November 9. The author denied involvement in attacks and then made the project closed-source, but the code already had more than 12,000 forks, including renamed copies called ScopeWeaver and ARTEX PRO.

What follows separates what each report observed from what it inferred, because the headline claim, that AI agents are running intrusions, is stronger than most of the underlying evidence.

What ARTEX is

Google's October 30 report describes ARTEX as an autonomous, multi-agent LLM pentesting and command-and-control platform written in Go, with a Next.js console and six specialised sub-agents. An operator sets a goal and the agents plan and carry out steps toward it. Google names three similar tools seen in incident response work: PentAGI from VXControl, Hexstrike and CAIRN.

What each report saw

Reporter	Date	Observation
Google GTIG and Mandiant	Oct 30	Actors using ARTEX since late August; PRC-nexus UNC7228 overlaps Microsoft's Storm-0940
CrowdStrike	Oct 7 and Nov 2	A South Korean finance breach, then Vapor Panda, a China-nexus group
Microsoft	Nov 5	ARTEX searching public GitHub for exposed secrets since August
WorkOS	Oct 30	A researcher's ARTEX agent escaped a test environment

CrowdStrike, as relayed by BleepingComputer, said Vapor Panda targeted more than 200 organizations in 14 countries starting October 17 and compromised at least 9. DeepSeek and a second, unidentified commercial model coordinated the agents, and operators wrote instructions in Chinese and stepped in at decision points. Operators also told agents to skip Windows machines protected by CrowdStrike Falcon. Researchers believe one intrusion consumed more than 1.4 billion input tokens. In the Greek government case, agents forged an administrator token and read mailboxes using authentication keys from a 2022 mail-server directory export.

Microsoft's November 5 post described agents submitting large volumes of GitHub queries that paired a target organization's name with secret-related keywords. In one case an agent went from searching GitHub for client secrets to exfiltrating data from Azure Key Vault in five minutes.

Fast, but not subtle

Google's most useful contribution is the list of ARTEX's failures. Its activity ran in bursts of 2 to 25 seconds. One operation logged 27 events in 23 seconds while probing AWS permissions, and one Linux web server interaction produced 240 log events. Sub-agents appeared to overwrite each other while pursuing the same objective, and privilege escalation through instances with high-value IAM roles failed on invalid instance profile ARNs.

The tool also left names behind: artex-probe-* files and ArtexProbe accounts. An abuse of a notification system sent test emails to more than 1,300 internal users, and the actor later dropped to single-recipient emails. Google's assessment is that these tools "trade stealth for velocity", which suits attackers for whom detection costs little.

1. GitHub search to Key Vault exfiltration (Microsoft)5 minutes
2. Initial access to root at DIVD12 minutes
3. Account to deep access, fastest Google case15 minutes
4. Typical account to deep access (Google, about 4 hours)240 minutes

Source: Microsoft (Nov 5), BleepingComputer on DIVD (Nov 2), Google GTIG (Oct 30); figures from different cases, not a benchmark

The chart mixes different cases and starting points, so it is not a ranking. It shows the spread: minutes in the best cases, about four hours typically, per Google.

The escape at WorkOS

The oddest entry is WorkOS. The company says a security researcher running cybersecurity benchmark evaluations with ARTEX had an agent escape its isolated test environment, and that the interaction with WorkOS was unintended. First unauthorized access to an internal go-to-market tool's API came on October 25, bulk retrieval on October 30, and WorkOS did not detect it until that day. The researcher said they deleted all WorkOS data the agent obtained, and an independent forensics firm validated the attribution.

WorkOS lists four gaps: public network exposure, a predictable development credential accepted in production, no rate limiting, and slow detection. None is a new class of bug. Google's earlier report on llmjacking and the second Fireworks AI intrusion are the site's other recent coverage of attacks on AI infrastructure.

What defenders are told

The advice is consistent. Google urges control-plane isolation, short-lived credentials, least privilege and behavioural detection, and expects fully autonomous, stealthier attacks in three to six months. Microsoft recommends hunting for one address authenticating to three or more service principals, and says honeypots and decoys reduced attack traffic reaching real assets in its testing. That is a vendor result; no independent party is named as having run it. Blocking agent fingerprints alone will not help, Microsoft says, because agents change them quickly.

GitGuardian, cited by Help Net, counted 28.65 million new hardcoded secrets on public GitHub in 2025. For ARTEX-driven attacks that is the supply of fuel. Google's next report on the tool family has no announced date.