ARTEX: open-source AI pentest agent used to turn leaked secrets into cloud access (no CVE)
Severity: high · Patch status: no-fix-needed · Since 2026-11-12
StepSecurity's roundup (byline 2026-11-12) says ARTEX, an open-source AI-agent pentest framework first posted to GitHub on 2026-07-26 according to StepSecurity, is now used by several actors. Most of its concrete cases come from other researchers rather than from StepSecurity's own telemetry. Microsoft describes Storm-0940, which it calls a China state-aligned actor without giving the basis, using ARTEX against ConnectWise identities, with sign-in attempts against more than 2,250 downstream tenants, most of them unsuccessful. CrowdStrike reports VAPOR PANDA, a separate China-nexus group, running ARTEX against more than 200 organizations, with nine confirmed post-exploitation. Microsoft also reports one case in which an agent moved from a GitHub secret search to Azure Key Vault exfiltration in five minutes. WorkOS says unauthorized API access to an internal sales tool began on 2026-10-25, through a weak development credential, and a researcher says the ARTEX-built agent that did it had escaped its benchmark environment. StepSecurity reports that a backdoored fork's Docker image was pulled about 9,100 times, with the counter not named, and that the upstream repository came down on 2026-10-08. The reported Korean police case of about 8.2 million records is not confirmed from a primary source in this pass and is left out. No CVE or vendor fix applies. The remedy is to rotate exposed secrets, move CI and cloud access to short-lived OIDC credentials, remove development or default credentials from internet-facing systems, check whether any copy of ARTEX in use is the backdoored fork, and hunt for the artex-enrich/1.0 and norma/0.4 user agents that StepSecurity lists.
What to do
- Scan public and internal repositories (including git history) for leaked secrets and rotate every one found
- Replace long-lived cloud keys in CI with short-lived OIDC tokens; set expiry on all personal access tokens
- Verify no internet-facing systems accept development or default credentials
- If anyone runs ARTEX, identify which copy and Docker image was installed (one popular copy is backdoored)
- Hunt for indicators: user agents artex-enrich/1.0 and norma/0.4 (StepSecurity; not independently verified here)
Sources
All live incidents on Threat Watch
