Attackers Use Free AI Pentest Tool ARTEX to Reach Cloud Accounts in Under a Day

Palo Alto Networks’ threat research team traced intrusions in which ARTEX, an open-source framework of AI agents built for penetration testing, turned public password reset pages and exposed APIs into cloud access, sometimes in under a day.

The path runs through identity workflows and APIs that companies publish on purpose, and none of it needs a software flaw. ARTEX tests every exposed workflow in parallel and acts on a stolen credential within a minute. Because these tools cannot target what they cannot find, the researchers say continuous discovery of exposed assets remains an effective barrier.

What did the intrusions look like?

In several intrusions, the company’s incident response team found the attacker’s server running an ARTEX console or using infrastructure and user agents tied to the tool. A separate threat hunting team tracked a coordinated ARTEX campaign against customers’ cloud environments worldwide, among them retail and consulting companies.

The fastest attacks went from a public password reset page or exposed API to cloud access in under a day, with no software vulnerability exploited. Palo Alto Networks did not say how many of the targets were breached.

How big is the footprint?

As of October 2026, the researchers counted 609 internet-facing hosts running ARTEX and 1,323 running CyberStrikeAI, a similar tool; 21 hosts ran both. ARTEX first appeared in mid-2026 and has been widely forked since.

Its author has since made the repository closed-source and stopped public development to prevent misuse. Newer tools are already filling the gap: the researchers analyzed 14 tools in all, the 12 emerging ones plus ARTEX and CyberStrikeAI.

What gives the attacker away?

Speed. Attackers pivoted within about a minute of downloading a credential and checked more than 200 client secrets in about three minutes. Their requests came in bursts, then paused for 25 to 31 seconds, a rhythm consistent with an agent waiting on a language model.

In one case the attacker switched from scripts to a desktop browser for the password reset and the first token request, which the researchers read as a person in the loop or browser automation at the most sensitive steps.

Because ARTEX is forked constantly and its operators rotate infrastructure, the researchers say indicators of compromise lose value fast and recommends detections built on behavior.

What do the researchers recommend?

Their advice starts with removing what the tools look for. Companies should take OpenAPI specifications, the machine-readable maps of an API, and source maps off internet-facing applications, and require authentication on every endpoint that writes data. Password reset and verification code flows need rate limits and bot protection.

They also urge replacing long-lived cloud keys with role-based access and moving the secrets that cloud functions use into a secrets manager.

A tool that acts on a stolen credential within a minute sets a short clock: could the company’s security team find a leaked cloud key and revoke it before one is used?