Circuit Wire — a daily news update from the Circuit.
On November 13, the FBI issued a FLASH alert warning that ARTEX, an open-source artificial intelligence platform, is being used to automate cyber intrusions "at machine speed." The bureau says some attacks moved from first targeting to privileged access in under three hours.
ARTEX is a multi-agent penetration testing framework written in the Go programming language. An operator describes a goal in plain language, and software agents turn it into commands with little further human input. The tool has no model of its own. It connects to outside large language models, and the FBI says Chinese models, led by the DeepSeek Flash family, are the most common choice on attacker-controlled systems.
According to the alert, a range of malicious actors have used ARTEX since at least August 2026. Targets span financial services, government, technology, defense, semiconductors, energy, healthcare, manufacturing, telecommunications and legal firms. The FBI says the framework lets groups with little technical skill run complex operations against several targets at once.
Two campaigns stand out in the bureau's account. Attacks on South Korean financial institutions led to the theft of personal information belonging to about 67,000 people. A separate supply chain compromise of ConnectWise Cloud Backup customers opened access to more than 2,250 downstream tenants. The Record reports that Microsoft attributed the ConnectWise attack to Chinese state-backed actors.
The FBI says ARTEX is especially good at finding weaker systems that get less attention than an organization's main applications. These include partner and supplier portals, mobile backends, employee apps, legacy services and third-party integrations. The alert also describes agents mapping trust relationships between companies, then using a weaker vendor as a route into larger networks.
A developer using the name Autumn-27 first published ARTEX on GitHub in July 2026. The tool gathered an estimated 1,500 to 2,000 stars within 10 weeks. The developer said it was meant for authorized testing and made the repository unavailable on October 8 after reports of abuse. Copies have kept spreading through community forks, archived versions and a commercial edition called ARTEX PRO.
As of early November, researchers had found more than 1,600 ARTEX control consoles exposed on the public internet, according to the FBI. The bureau says the real number of deployments is likely much higher, since many systems sit behind firewalls or on private networks. The alert lists indicators of compromise and mitigation steps, and asks organizations to report related incidents to their local FBI field office or the Internet Crime Complaint Center.
Want a weekly roundup of the major stories shaping the security industry? The On The Circuit newsletter is read by more than 12,000 protection professionals.
Spotted something we should cover? Send tips and feedback via circuit-magazine.com.