FBI says some Artex intrusions reached access in under three hours

The FBI has released flash alert FLASH-20261113-001 on Artex, an open-source tool that threat actors have used to automate intrusions from reconnaissance through data theft. Some of those intrusions moved from initial targeting to privileged access in under three hours.

The bureau dated the alert November 13. Artex is an open-source platform driven by large language models, and it does not ship its own model. It connects to outside models, including Claude and GPT. The framework is written in Go. It turns a plain-language goal into commands that specialized agents carry out, with little human direction after the objective is set.

Use has run since at least August. Actors have aimed the tool at financial services, government, technology, defense, semiconductors, energy, healthcare, manufacturing, telecommunications, and legal work. People with limited technical skill have used it to run complex operations against more than one target at the same time.

Two campaigns are named in the alert. Attacks on South Korean financial institutions took personal information from about 67,000 people. A compromise of ConnectWise Cloud Backup opened access to more than 2,250 downstream tenants.

The original code host is gone. The developer removed the GitHub repository in October. The framework is still spreading through community forks, local variants, archived copies, and a commercial build called Artex Pro.

The alert asks exposed operators to apply its mitigations. That request covers organizations running internet-facing applications, self-service portals, cloud infrastructure, and partner or supplier systems. The flash does not say the tool has been taken out of use.