ARTEX and beyond: AI-enabled penetration testing platforms

Cisco Talos is tracking the growing in-the-wild usage of AI-enabled penetration testing frameworks. AI-enabled penetration testing and red team frameworks can automate and chain reconnaissance, vulnerability testing, and follow-on actions, lowering the skill threshold for attackers and accelerating intrusions when the tools are misused. Talos has seen full automation of the attack chain by these frameworks, which not only use free and open-source tools, like nmap and nuclei, but also take advantage of internet mapping services like Censys and Shodan, CAPTCHA bypass services, credential leak management services, residential proxies, and even hash cracking services. This is the case of Hephaestus, which we mentioned in our previous report . Although these frameworks all have the same purpose, they come in different flavors. Some, like Hephaestus, are command line tools which can be deployed with a single script on a VPS and are completely controllable via Telegram. PentAGI has a web interface to monitor the agent activity with a full attack chain graph design and monitoring. Talos found more than 700 instances of currently reachable PentAGI instances on the internet. HexStrike AI integrates with many different clients like Claude Code, VS Code, or any other client that supports MCP. One such framework making waves, ARTEX, has enabled threat actors to scale offensive operations, compressing work that may have previously taken skilled teams hours or days into activity that can unfold at machine speed. Talos’ analysis of ARTEX-associated IP addresses identified a diverse set of tools concurrently present on that infrastructure, reinforcing ARTEX’s role in a broader and varied threat environment. AI-enabled frameworks: A new reality Before we delve into ARTEX, it is clear that these frameworks are the new reality. Their evolution will most likely include autonomous lateral movement followed by data identification and exfiltration. The precursor of this can already be seen in the victim prioritization of the Volta Infostealer, described in detail in this Talos report . It is highly likely that future attack chains involving these frameworks will culminate in data exfiltration and ransomware activation, all being done autonomously by one of these frameworks. Such evolutions present new challenges to defenders: It reduces the time it takes to detect a compromise without any known indicators of compromise (IOCs). We provide guidance to help overcome this challenge in the Recommendations section. After malicious activity is identified, it is crucial to contain the incidents. These frameworks work at speeds that can make it impossible for human operators to identify, assess and react in time to disrupt the attack. These frameworks make mitigation and containment, along with a battle-tested cybersecurity incident response plan, imperative for organizations' resiliency. Defenders using AI can be a force multiplier to provide much-needed improvements, both in the speed and scale of response to such attacks. ARTEX ARTEX is an AI-enabled penetration testing framework developed under the pseudonym Autumn-27 and published on GitHub in July 2026. An operator gives it a target and objective, a planner agent breaks the objective into tasks, worker agents perform them using security tools, and the framework records assets, findings, and progress in a shared graph. ARTEX can use different large language models (LLMs) and requires relatively little operator input after a task begins. It was designed for authorized security testing, but recent public reporting documented its use in both criminal and targeted intrusion campaigns within weeks of its release. It is important to note that ARTEX is not natively bundled with any traditional command-and-control (C2) framework, though the Model Context Protocol (MCP) extensibility layer means any compatible tool server can be added by an operator. This explains why we have observed multiple instances of ARTEX being deployed alongside tools such as VShell, GoPhish, and AdaptixC2. Threat actors leveraging ARTEX in offensive campaigns Multiple threat actors with distinct motives and tradecraft have been associated with ARTEX activity; its release as open-source software, followed by the continued availability of forks and copies, almost certainly facilitated adoption across different actor groups. Public reporting (referenced below) and Talos observations indicate ARTEX is largely used by financially motivated cybercriminals and threat actors with a China nexus. Observed ARTEX campaigns range from opportunistic scanning and credential theft to targeted intrusions and supply chain activity, with targets spanning financial services, cryptocurrency, government, telecommunications, defense, pharmaceuticals, semiconductors, and technology organizations across multiple regions. Reported outcomes vary from unsuccessful attempts to confirmed compromise and data exfiltration. Reported campaigns: VAPOR PANDA : CrowdStrike attributed an espionage campaign (beginning Oct. 17, 2026) leveraging ARTEX to China-nexus actor VAPOR PANDA. The actor used ARTEX against more than 200 organizations in at least 14 countries, with targets that included government ministries, telecommunications providers, and organizations in the defense, pharmaceutical, semiconductor, nuclear, and financial sectors. CrowdStrike confirmed post-compromise activity at nine organizations and reported additional credential-scanning and password-spraying activity against at least 12 others. Storm-0940 : Microsoft attributed ARTEX-driven activity to Storm-0940, who they assess is a “China-state aligned actor”. Following the compromise of ConnectWise application credentials, Storm-0940 used ARTEX to accelerate sign-in attempts against more than 2,250 downstream Microsoft 365 tenants, with follow-on activity involving Microsoft Graph, application credentials, and privilege changes. Storm-3358 : Microsoft also reported financially motivated Storm-3358 activity targeting financial organizations, primarily in Southeast Asia, and describes the cluster as Cambodia-based. Its ARTEX activity included exploitation of public-facing systems and deployment of remote access trojans (RATs). Cisco’s observations for this cluster are in line with Microsoft’s findings. We found IP addresses associated with this cluster conducted asset scanning in October 2026. Unidentified Chinese-speaking threat group : CrowdStrike reported an unattributed campaign against South Korean financial organizations that resulted in data exfiltration; it assessed with moderate confidence that the actor was Chinese-speaking and financially motivated. Talos separately analyzed actor-associated directories used in these attacks and found ARTEX-related artifacts, including directory listings and prompt history references. The archive did not contain the ARTEX executable or source tree, so these artifacts support an association with an ARTEX environment but do not, by themselves, prove that the complete framework was present or used in a successful attack. Unidentified criminal threat actors : Check Point Research documented additional criminal operators pursuing goals that included stealing code-signing certificates and gaming-account credentials and attempting cryptocurrency theft. Unattributed ARTEX-associated activity: Microsoft reported agents using ARTEX to search public GitHub repositories for exposed credentials, including application credentials and AI service API keys, and then use discovered secrets for follow-on activity. In one case, the agent moved from searching GitHub to exfiltrating data from Azure Key Vault within five minutes. Datadog separately observed ARTEX activity in AWS environments involving compromised long-term access keys and public Cognito user pools. The activity included searching cloud logs for financial information and secrets, registering accounts, collecting tokens, and attempting cloud resou