Artex and the Rise of Agentic Exploitation: Hours, Not Days, to Privileged Access

Following the release of Mythos, the threat and implications of widely available, agentic aided offensive tooling that could lower the skill barrier to entry, automate high volumes of activity, and be employed at a low cost was widely discussed. With Artex, this threat is no longer a hypothetical. 

Artex is an open-source, AI pentest framework, that has been used since late August 2026 by a variety of criminal and state aligned threat actors, most notably China-linked Storm-0940. The techniques commonly leveraged in Artex linked campaigns are password spraying, leveraging stolen app credentials, Kerberoasting, and Key Vault reads. These techniques aren’t unique - however, how fast agents may chain them and how many targets one operator can work at once leveraging a tool like Artex is.

Security leaders should be concerned with Artex aided campaign activity because:

• Response windows have been condensed to hours. Microsoft saw targeting reach privileged cloud access in under three hours; Google and Wiz saw one case take 15 minutes.
• The way in is the apps you already trust. Storm-0940 used a vendor's stolen app credentials to attempt sign-ins to 2,250+ Microsoft 365 tenants through Artex. Obsidian found attempts at leveraging an additional vendor’s credentials for access in this same campaign. No user was phished and controls like MFA never applied. https://www.obsidiansecurity.com/incident-watch/wider-saas-supply-chain-targeting-beyond-connectwise 
• It is cheap, continues evolving, and isn’t alone. Artex is an open source framework that can leverage multiple LLMs, meaning its only real cost is compute. Artex is also not the only agentic exploitation framework available and in use. Artex and other similar tooling will adapt and advance, almost certainly faster than static detections can be written. 

What is Artex?

Artex is an open source, multi-agent penetration testing framework written in Go with an embedded Next.js web console. It is designed to automate offensive security tasks and to work with any AI model (DeepSeek, GLM, and other commercial models have been observed). It was first published on GitHub in July 2026 by a Chinese developer, Autumn-27. 

The original developer took Artex closed source in October, citing misuse. However, multiple forks of the tool including ScopeWeaver and ARTEX PRO still circulate and are employed by multiple threat actors. CheckPoint found 1,608 public ARTEX instances, suggesting that variants of the tools are widely deployed.

Artex is valuable because it allows for easy attack automation. Artex automates attacks by splitting an intrusion across six sub-agents that plan, act, read results, and choose the next step, from reconnaissance through exfiltration. Artex allows an operator to select an exploitation goal. With this, the planner agents choose each step and worker agents scan, exploit, steal credentials and move laterally, feeding results back into the plan. It can handle a full attack cycle through final objectives such as data exfiltration with minimal human intervention. 

How Are Actors Using It?

Multiple threat actors are employing Artex for automation of campaigns targeting a variety of sectors and geographies. However, when looking at previous Artex activity, the agents rarely relied on anything exotic. The successful paths mostly ran through a credential, key, or app identity that was already valid. 

• Storm-0940 and ConnectWise: China-state-aligned actor used ARTEX to accelerate abuse of stolen ConnectWise Cloud Backup app credentials, attempting sign-ins to more than 2,250 Microsoft 365 tenants. In multiple cases it reached privileged cloud access in under three hours. 
• IT and software vendors: Wiz tracked overlapping activity against software vendors. The agent pulled JavaScript source maps, then called internal API routes by name minutes later. It sprayed Okta and Entra at one-second intervals and rotated IPs within minutes of being blocked.
• Vapor Panda: CrowdStrike reported that a China-nexus group leveraging Artex targeted 200 organizations in 14 countries over 11 days, with confirmed post-exploitation at nine. 
• Secrets in public code. On November 5, Microsoft reported agents finding OAuth app secrets on GitHub and, in one case, moving from search to Azure Key Vault exfiltration in five minutes.

Artex Isn’t Alone

Artex may be the most commonly employed agentic framework for exploitation, however it is only one of many in use. Other frameworks include:

• PentAGI: Google saw most use stay at scanning, but some operations reached intrusion and persistence, including against telecom firms in Asia.
• CAIRN and Hexstrike: Named by Google alongside ARTEX in its incident response engagements.
• CyberStrike: Named by Check Point as offering similar capabilities.
• Multiple reports have also suggested the use of home-built frameworks and custom harnesses in some intrusions observed in the wild.

Threat actors may also combine the usage of these tools in campaigns. For example Censys has found Artex consoles sharing hosts with other tools including CyberStrike.

The development of forked versions of Artex and other tools demonstrate demand for this type of tooling, strongly suggesting that Artex will not be the last AI enabled exploitation framework that we see. Given this demand, we should continue to expect the development of more advanced models moving forward. These models are also likely to improve their stealth, making detection of activity more difficult.

How to Prepare for Artex 

Artex can automate attacks throughout an entire lifecycle and establish initial access through a wide variety of methods. As this is an AI- enabled tool, its method of attacks will be non-deterministic between targets and may exploit a variety of attack surfaces. Combine this with the volume of attacks that an agentic tool like Artex and defenders would be correct in showing concern. 

However, as in previous agentic aided attacks - Artex activity observed has generally followed known attack paths, particularly focused on credential compromise. For defenders this means that cyber best practices are a best defence. Methods such as layered defense, zero trust, patch discipline, credential rotation, MFA, encryption, least privilege, and strong monitoring are impactful. Artex has been used to scan public repositories like Github for passwords and other credentials, so it is also crucial to maintain strict standards for credential hygiene and development (e.g. never hardcode an API key). Obsidian previously provided guidance in response to “breakouts” during frontier model testing, which reamains relevant to Artex: https://www.obsidiansecurity.com/blog/frontier-model-agentic-threats 

Artex enabled activity observed such as the Connectwise campaign has commonly targeted the longtail for access, third party apps. As such special attention should be paid to secure apps and minimize potential impacts of compromise. This should include steps to improve the information known about every third party app (discovery) and limiting potential impacts and access these apps possess (governance). 

• Discovery: Know what your third party apps are, what they can access, and how they are authenticated. Optimal state is to employ a live, relationship-aware model of every identity, integration, agent, application, and data path. One that can tell the difference between what was granted and what is actually used, and that traces multi-hop paths instead of listing findings. 
• Governance: Strictly and continuously enforce least privilege to limit any potential impacts. Leveraging what is learned through continuous discovery, defenders should retire what's dormant, revoke standing OAuth tokens for agents and integrations that do not require persistent access, only grant privileges to the minimal level required, and control who can create new exposure in the first place. 

Artex also serves as a good reminder for organizations to develop and test incident response plans for agent-driven attacks. 

How Obsidian Can help

Agentic enabled exploitation frameworks like Artex are notable because they can widen access to advanced offensive capabilities, automate attacks to allow for improved speed and higher volumes, and target the long tail for exploitation including third party applications. (Learn about how AI is changing the economics of cyber attacks https://www.obsidiansecurity.com/blog/frontier-ai-changes-cyber-attacks-economics) 

Obsidian has a clear role in minimizing the threat Artex and other offensive frameworks may pose to the long tail, third party. Customers use Obsidian’s posture management and supply chain security to inventory the third-party apps and integrations connected to Microsoft 365 and other SaaS platforms, flag the ones holding high-risk permissions, and see which tenants and users are tied to each. Obsidian’s threat detection baselines how each integration normally behaves and flags deviations in infrastructure, clients and activity, across identity providers like Entra ID and Okta. If a vendor were exploited by an agentic framework like Artex and discloses a compromise, that makes it possible to answer the first questions quickly: are we exposed, did anything happen, and what do we disable?

Come watch a live walkthrough of how Obsidian can help you protect against AI enabled exploitation frameworks

weekly demo