Cybercriminals Use ARTEX AI Agents to Automate Attacks and Supply-Chain Compromise

Check Point Research found evidence that cybercriminals are using ARTEX, a Chinese open-source AI-powered penetration-testing platform, to attack systems with minimal human supervision. ARTEX uses large language models to coordinate agents that plan tests, run security tools and record findings. Researchers identified 2,557 systems that had hosted the platform, including 1,608 live, publicly accessible instances, and examined databases exposed by 10 misconfigured deployments. Observed campaigns targeted cryptocurrency services, gambling platforms, payment infrastructure and gray-market iOS signing services, exploiting missing authentication, exposed credentials and remote code execution vulnerabilities.

One campaign obtained more than 300 Apple code-signing certificates and their passwords, while another autonomously identified and executed a supply-chain compromise using exposed AWS S3 credentials. The findings demonstrate agents’ ability to move beyond vulnerability discovery into operational compromise, but also expose limitations: a cryptocurrency campaign generated no revenue despite extensive activity, with agents misinterpreting whether their objectives had been achieved. For defenders, the observed attack paths reinforce the importance of enforcing authentication, protecting cloud credentials and code-signing material, and monitoring for unauthorized changes to software distribution assets.