Incident response specialists are raising the alarm because they are receiving more and more reports of incidents in which attackers are using AI in a novel way. By using agentic frameworks, the AI can autonomously carry out large parts of a multi-stage attack. In other words, the AI is not doing anything genuinely new here, but its use leads to “more frequent, faster, and more scalable automated attacks with a higher success rate,” warns CERT-EU, for example.
Old news – but faster and more of it
This warning refers specifically to Artex. This is an agent framework developed especially for penetration testing—that is, for carrying out targeted attacks on behalf of, for example, a company or public authority that wants to test its security measures. Attackers of every stripe, however, are not deterred by the “authorized use only” restriction; Artex is becoming increasingly popular among them. According to reports of misuse, the original author did remove the repository in October 2026, but independent forks continue to circulate.
There are also numerous alternatives, such as Cairn. What they have in common is that the human operator can assign the framework complex tasks, which it then largely completes independently. These might include “Search the internet for vulnerabilities that enable access to critical data” or “Get me domain admin rights.”
(Image: Artex Global Edition on GitHub)
For this purpose, an orchestrator agent launches additional agents and assigns them subtasks. To do so, they load and execute special tools and report results to the orchestrator, which then plans the next steps and sets them in motion. For example, attack paths in Active Directory are identified using classic tools such as BloodHound, and then, for instance, domain administrator privileges are obtained using something like Rubeus via Kerberoasting. If an attack attempt fails, the orchestrator looks for alternatives and has them evaluated.
None of this is new; it has long been the basis of thousands of ransomware attacks. What is new is that all these attack steps are carried out with incredible speed, and defenders are often simply overwhelmed. Attackers also hardly need any specialist knowledge and can still coordinate many attacks in parallel. This changes the economic parameters of an attack, as internationally renowned security expert and incident response specialist Florian Roth also warns ahead of an imminent wave of attacks. The current CERT-EU warning corroborates this assessment. Microsoft has also reported Artex campaigns targeting financial organizations.
Videos by heise
