On 13 November 2026 the FBI released FLASH-20261113-001, a TLP:CLEAR alert describing ARTEX, an open-source, LLM-driven agentic penetration-testing framework that the FBI says malicious actors have weaponized to automate intrusions from reconnaissance through data exfiltration. The FBI reports that some intrusions went from initial targeting to privileged access in under three hours.
What the FBI said on 13 November 2026
The alert is titled “Threat Overview of ARTEX Autonomous Penetration Testing Framework.” According to the FBI, a variety of malicious cyber actors have used ARTEX since at least August 2026 in campaigns against organizations globally. The sectors it lists are financial services, government, technology, defense, semiconductor, energy, healthcare, manufacturing, telecommunications and legal. Higher education and research institutions are not named in that list.
The FBI describes ARTEX as written in Go and built as a multi-agent platform that turns high-level goals written in natural language into machine commands run by AI agents, with minimal human input after the objective is set. It does not ship its own model. The FBI says it integrates with external providers, including frontier models (Anthropic Claude, OpenAI GPT) and open-source or Chinese-origin models (DeepSeek, GLM, Grok, Kimi), and that analysis of attacker-controlled instances shows Chinese models are most prevalent.
Campaigns and figures the FBI cites
- South Korean financial institutions: financially motivated attacks that the FBI says resulted in exfiltration of personal information from approximately 67,000 individuals.
- ConnectWise Cloud Backup supply chain compromise: the FBI cites Microsoft reporting that it enabled access to more than 2,250 downstream tenants.
- Exposure: as of early November 2026, researchers identified over 1,600 publicly exposed ARTEX console instances; the FBI says total deployments are likely significantly higher.
- Availability: the developer, “Autumn-27,” made the GitHub repository unavailable on 8 October 2026 after reports of abuse, but the FBI says the framework continues to circulate through forks, localized variations, archived copies and a commercial version, ARTEX PRO.
Which systems ARTEX goes after
The FBI says ARTEX is effective at finding and exploiting peripheral systems that receive less security attention than flagship applications: partner and supplier portals, mobile backends, employee applications, sales-support systems, legacy services, third-party integrations, and applications created across different business units. It also says agents have shown they can map trust relationships between organizations and pivot from a weaker third-party vendor, CI/CD pipeline or integrated software provider into higher-value networks.
The observed techniques the alert maps to MITRE ATT&CK include exploitation of public-facing applications (unsigned SAML assertions, XXE, SSRF, SQL injection, missing authentication on web APIs), use of valid and vendor credentials, web shells, additions of credentials to existing OAuth applications, Kerberoasting and enumeration of Active Directory objects.
What the FBI recommends
The FBI’s immediate actions fall into four groups:
- Reduce the external attack surface: inventory all internet-facing applications, including peripheral ones; restrict cloud administration, network device management and Kudu/SCM publishing endpoints to trusted networks or dedicated administrative paths; and require architecture review before workloads or management interfaces are exposed to the internet.
- Harden identity and access: apply least privilege to multi-tenant application permissions and consent grants, and monitor credential additions, privilege assignments and unusual app-only activity.
- Strengthen application protections: add rate limits and abuse controls to high-impact APIs, alert on sequential lookups and unusually high record counts per session on partner and employee portals, enforce server-side authorization, and scan configurations, repositories, container images and pipelines for embedded secrets, rotating any that are exposed.
- Preserve evidence and respond: preserve sign-in and audit records, do not delay urgent containment while waiting for exports, and have an authorized responder remove confirmed unauthorized credentials only after evidence is preserved.
The alert also lists indicators of compromise and cautions that organizations should investigate or vet them before blocking, because addresses on cloud platforms can be reassigned to benign services. It asks recipients to report suspicious activity to a local FBI field office or the FBI Internet Crime Complaint Center at ic3.gov, and lists the logs and artifacts that are most useful to include, such as service-principal sign-in logs, Microsoft Graph and Entra audit records, outbound connections to LLM API endpoints and token-consumption anomalies.
What it means for universities and research offices
The following is editorial interpretation, not a statement by the FBI. The alert does not mention universities, but the exposure it describes is common on campuses: many portals, departmental and lab-run web applications, vendor integrations and cloud tenants, often owned by different units. The FBI’s emphasis on forgotten peripheral systems and trusted third-party relationships maps onto that structure. Research data that sits behind departmental web services, grant-administration portals shared with sponsors and partners, and cloud applications authorized with broad consent grants are the kinds of assets an inventory under the first recommendation should capture.
Practical starting points for a research office working with IT and security staff: ask who owns each internet-facing research application, review which third-party applications hold consent grants in the institution’s Microsoft 365 or other cloud tenants, and check that incident-response and data-breach plans cover research data. CASRAI’s guides on NIST Cybersecurity Framework 2.0 for a federally funded research lab, a data breach response plan for research data and cybersecurity as a research field and institutional duty cover the program side, and research security and NIST’s AI Agent Standards Initiative give wider context for how agentic AI is being treated by standards bodies.
How the figures are attributed
The speed, victim and exposure figures above are the FBI’s, each drawn in the alert from named industry reporting (for example Microsoft for the 2,250-tenant figure and CrowdStrike for the South Korean campaign infrastructure). The tenant figure measures access to downstream tenants reported by Microsoft, as cited in the FBI alert; the alert’s own summary is where to check how each number is framed.
Sources
- FBI, “Threat Overview of ARTEX Autonomous Penetration Testing Framework,” FLASH-20261113-001, 13 November 2026: https://www.ic3.gov/CSA/2026/261113.pdf (checked 2026-11-14)
- Cyber Security News, “FBI Reveals How Hackers Use ARTEX AI Agents to Gain Privileged Access in Under Three Hours,” 14 November 2026: https://cybersecuritynews.com/fbi-reveals-hackers-artex-ai-usage/ (checked 2026-11-14)
