Science & Tech · Cybersecurity · 2 hrs ago
FBI Warns Artex Is Automating Cyberattacks at High Speed
The FBI warned that Artex is being used to automate cyberattacks against government agencies and businesses around the world.
The open-source tool, released on GitHub in August, uses AI agents to carry out steps such as finding targets and stealing data.
The FBI says some intrusions have reached privileged access in under three hours, and the tool can help people with limited technical skills run complex attacks.
Its developer later removed the GitHub repository after saying malicious actors had misused the tool, but copies and modified versions remain available.
Research cited by the FBI found more than 1,600 Artex consoles exposed to the public, while the total number of deployments may be higher.
Artex has been linked to attacks on many industries, including finance, government, energy and healthcare, and Microsoft said Chinese state-backed actors used it in a supply chain attack.
The FBI and security companies have described its use in ongoing operations, but the sources do not say what action will happen next.
The FBI warned that the Artex platform is being used by cybercriminals and nation-states to carry out cyberattacks at machine speed.
The agency said some intrusions progressed from initial targeting to privileged access in under three hours.
Artex can use AI agents to automate multiple stages of an intrusion, from reconnaissance to data theft, with limited human input.
Censys research cited by the FBI found more than 1,600 publicly exposed Artex console instances.
The FBI said the tool remains available through community forks, archived copies and a commercial version despite removal of its GitHub repository.
- Who
- Cybercriminals and nation-state actors are using Artex. The FBI issued the warning.
- What
- The FBI warned that Artex can automate cyberattacks and accelerate intrusions.
- When
- The FBI released its alert on Friday, November 13, 2026.
- Where
- The attacks have targeted organizations worldwide across multiple sectors.
- Why
- The FBI said Artex can automate several stages of cyber intrusions and reduce the time and expertise needed to conduct them.
This story does not have two clearly opposing sides.
An account known as Autumn-27 released Artex on GitHub.
The developer, identified as Li Puhua, said on GitHub that malicious actors had abused the tool, denied responsibility for crimes committed with it and later removed the repository.
The FBI released a flash alert warning about Artex.
- Publicly exposed Artex consoles
- More than 1,600, according to Censys research cited by the FBI
- Initial targeting to privileged access
- Under three hours in some intrusions, according to the FBI
- Tool released
- August on GitHub
- Developer
- Li Puhua, identified as a Chinese cybersecurity engineer
- Industries targeted
- Financial services, government, technology, defense, semiconductor, energy, healthcare, manufacturing, telecommunications and legal companies
2 sources
What people are saying
Artex significantly reduces the time required to chain attack techniques, with some intrusions progressing from initial targeting to privileged access in under three hours.
The framework enables threat actors with minimal technical expertise to conduct complex, multi-target operations simultaneously, fundamentally accelerating attack velocity and expanding operational scale.
Another campaign targeted cryptocurrency exchanges for know-your-customer (KYC) verification bypass using real-time deepfake injection.
have progressed from experimental use to sustained, multi-objective offensive operations that run with minimal human intervention.