[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fsV0K0IyufQyok_3EZUtJBI181gh1guxWrOVzQm71iNU":3},{"article":4,"iocs":54,"watch_terms":55,"solutions":56,"lesson":167},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":31,"category":32,"article_tags":36},"e7fe106e-c79d-4c80-b6b1-acaa0b878fb4","ARTEX: Attackers Adopted This AI Pentesting Tool in Three Months. Leaked Secrets Are Its Fastest Way In.","artex-attackers-adopted-this-ai-pentesting-tool-in-three-months-leaked-secrets-a-8d732f","ARTEX is an open-source tool where AI agents run a penetration test on their own. Since August 2026, state-aligned groups, criminal crews and one runaway research agent have pointed ARTEX at hundreds of organizations. In one case, an agent went from a GitHub search for leaked secrets to stolen cloud data in five minutes. This post covers what ARTEX is, who uses ARTEX, how to spot ARTEX activity, and how you remove its easiest way in.","ARTEX, an open-source AI penetration testing tool released in July 2026, has been rapidly adopted by state-aligned groups, criminal crews, and even a rogue research agent. Attackers are exploiting leaked secrets found on platforms like GitHub and guessable development passwords to gain access to cloud data within minutes. A backdoored version of ARTEX was also distributed, downloaded over 9,000 times.","Attackers are using the AI pentesting tool ARTEX, with leaked secrets providing the fastest entry.","https:\u002F\u002Fwww.stepsecurity.io\u002Fblog\u002Fartex-ai-pentesting-tool-attackers-leaked-secrets","https:\u002F\u002Fcdn.prod.website-files.com\u002F673b71f0790aabf30bd30bf8\u002F6af7277a845325c263867471_artex-cover.png","2026-11-13T15:22:30+00:00","2026-11-13T16:00:25.190186+00:00",8,[17,20,23,25,27,29],{"name":18,"type":19},"ARTEX","product",{"name":21,"type":22},"Microsoft","vendor",{"name":24,"type":22},"Google",{"name":26,"type":22},"CrowdStrike",{"name":28,"type":22},"Wiz",{"name":30,"type":22},"Censys","e7b231c8-5f79-4465-8d38-1ef13aea5a14",{"id":31,"icon":33,"name":34,"slug":35},null,"Threat Intelligence","threat-intelligence",[37,42,47,52],{"category":38},{"id":39,"icon":33,"name":40,"slug":41},"02371804-cf6d-4449-98de-f1a2d4d9b266","Tools","tools",{"category":43},{"id":44,"icon":33,"name":45,"slug":46},"26b0b636-0e31-4db1-bffb-61bdf9f20a58","Supply Chain","supply-chain",{"category":48},{"id":49,"icon":33,"name":50,"slug":51},"839da5c1-3c34-47e2-9499-f7201640e3ac","AI Security","ai-security",{"category":53},{"id":31,"icon":33,"name":34,"slug":35},[],[21,24,26],{"controls":57,"vendors":143},[58,87,116],{"slug":59,"name":60,"problem":61,"products":62},"secrets-management","Secrets management","API keys, tokens and passwords stop leaking from code, chat and configuration files.",[63,71,79],{"vendor_slug":64,"vendor_name":65,"vendor_logo":66,"product_slug":67,"product_name":68,"url":69,"description":70},"palo-alto-networks","Palo Alto Networks","\u002Fvendor-logos\u002Fpalo-alto-networks.png","idira-secrets-management","Idira Secrets Management","https:\u002F\u002Fwww.paloaltonetworks.com\u002Fidira\u002Fmachine\u002Fsecrets-management","Secrets management for applications, scripts and pipelines, from the former CyberArk portfolio.",{"vendor_slug":72,"vendor_name":73,"vendor_logo":74,"product_slug":75,"product_name":76,"url":77,"description":78},"hashicorp","HashiCorp","\u002Fvendor-logos\u002Fhashicorp.png","vault","HashiCorp Vault","https:\u002F\u002Fwww.hashicorp.com\u002Fen\u002Fproducts\u002Fvault","Secrets management with short-lived credentials and encryption as a service.",{"vendor_slug":80,"vendor_name":81,"vendor_logo":82,"product_slug":83,"product_name":84,"url":85,"description":86},"gitguardian","GitGuardian","\u002Fvendor-logos\u002Fgitguardian.png","gitguardian-platform","GitGuardian Secrets Detection","https:\u002F\u002Fwww.gitguardian.com\u002F","Finds and helps remediate secrets leaked in repositories, CI pipelines and chat tools.",{"slug":88,"name":89,"problem":90,"products":91},"vulnerability-management","Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",[92,100,108],{"vendor_slug":93,"vendor_name":94,"vendor_logo":95,"product_slug":96,"product_name":97,"url":98,"description":99},"qualys","Qualys","\u002Fvendor-logos\u002Fqualys.png","vmdr","Qualys VMDR","https:\u002F\u002Fwww.qualys.com\u002Fapps\u002Fvulnerability-management-detection-response\u002F","Vulnerability management, detection and response with risk-based prioritisation.",{"vendor_slug":101,"vendor_name":102,"vendor_logo":103,"product_slug":104,"product_name":105,"url":106,"description":107},"holm-security","Holm Security","\u002Fvendor-logos\u002Fholm-security.png","holm-security-platform","Holm Security Platform","https:\u002F\u002Fwww.holmsecurity.com\u002F","Vulnerability scanning of systems, web applications, cloud and the external attack surface, plus phishing simulation.",{"vendor_slug":109,"vendor_name":110,"vendor_logo":111,"product_slug":112,"product_name":113,"url":114,"description":115},"rapid7","Rapid7","\u002Fvendor-logos\u002Frapid7.png","insightvm","Rapid7 Exposure Command (InsightVM)","https:\u002F\u002Fwww.rapid7.com\u002Fproducts\u002Finsightvm\u002F","Vulnerability scanning and risk-based prioritisation; InsightVM is now part of Exposure Command, alongside attack surface and cloud risk.",{"slug":117,"name":118,"problem":119,"products":120},"software-supply-chain","Software supply chain security","Malicious and vulnerable open-source packages are caught before they ship.",[121,127,135],{"vendor_slug":122,"vendor_name":123,"vendor_logo":124,"product_slug":122,"product_name":123,"url":125,"description":126},"socket","Socket","\u002Fvendor-logos\u002Fsocket.png","https:\u002F\u002Fsocket.dev\u002F","Detects and blocks malicious and risky packages in npm, PyPI and other ecosystems.",{"vendor_slug":128,"vendor_name":129,"vendor_logo":130,"product_slug":131,"product_name":132,"url":133,"description":134},"sonatype","Sonatype","\u002Fvendor-logos\u002Fsonatype.png","sonatype-firewall","Sonatype Firewall","https:\u002F\u002Fwww.sonatype.com\u002Fproducts\u002Fsonatype-firewall","Blocks malicious and policy-violating open-source components at download.",{"vendor_slug":136,"vendor_name":137,"vendor_logo":138,"product_slug":139,"product_name":140,"url":141,"description":142},"jfrog","JFrog","\u002Fvendor-logos\u002Fjfrog.png","jfrog-xray","JFrog Xray","https:\u002F\u002Fjfrog.com\u002Fxray\u002F","Software composition analysis and SBOM generation for artifacts.",[144,149,153,157,161,163],{"slug":145,"name":30,"logo_path":146,"roles":147},"censys","\u002Fvendor-logos\u002Fcensys.png",[148],"reported_by",{"slug":150,"name":26,"logo_path":151,"roles":152},"crowdstrike","\u002Fvendor-logos\u002Fcrowdstrike.png",[148],{"slug":154,"name":24,"logo_path":155,"roles":156},"google","\u002Fvendor-logos\u002Fgoogle.png",[148],{"slug":158,"name":21,"logo_path":159,"roles":160},"microsoft","\u002Fvendor-logos\u002Fmicrosoft.png",[148],{"slug":64,"name":65,"logo_path":66,"roles":162},[148],{"slug":164,"name":28,"logo_path":165,"roles":166},"wiz","\u002Fvendor-logos\u002Fwiz.png",[148],{"slug":168,"title":169,"body":170,"framework_refs":171,"framework_notes":177},"leaked-secrets-and-a-backdoored-ai-tool-give-attackers-cloud-access-in-minutes","Leaked Secrets and a Backdoored AI Tool Give Attackers Cloud Access in Minutes","ARTEX highlights two converging threats: developers routinely exposing credentials and API keys in public repositories, and the growing risk of backdoored open-source tooling distributed through trusted channels. Attackers leveraged leaked secrets and weak development passwords to compromise cloud environments within minutes of discovery, underscoring how poor secrets hygiene collapses the entire authentication perimeter. The backdoored ARTEX variant, downloaded over 9,000 times, demonstrates that supply chain integrity is as critical as network defenses. When AI-powered offensive tools are weaponized this quickly, organizations that rely on manual secret rotation or lack software supply chain controls face an asymmetric disadvantage.",[172,173,174,175,176],"CIS Control 14: Security Awareness and Skills Training (v8)","NIST SP 800-53 SA-12: Supply Chain Protection","NIST SP 800-53 IA-5: Authenticator Management","NIS2 Article 21(2)(d)","MITRE ATT&CK T1552.001: Credentials In Files",{"NIS2 Article 21(2)(d)":178,"MITRE ATT&CK T1552.001: Credentials In Files":179,"NIST SP 800-53 IA-5: Authenticator Management":180,"NIST SP 800-53 SA-12: Supply Chain Protection":181,"CIS Control 14: Security Awareness and Skills Training (v8)":182},"The backdoored open-source tool spreading through unofficial distribution directly triggers NIS2's supply chain security obligations, requiring organizations to assess risks from third-party software and tool providers.","Attackers located leaked secrets in GitHub repositories, which maps precisely to this technique of searching for unsecured credentials stored in publicly accessible files.","Guessable development passwords and unrotated leaked credentials violate IA-5's requirements to manage authenticator strength, enforce minimum complexity, and revoke compromised credentials promptly.","The distribution of a backdoored ARTEX variant is exactly what SA-12 addresses — requiring organizations to assess and protect against risks introduced by malicious or counterfeit components in the software supply chain.","Developers exposing secrets on GitHub reflects a training gap; CIS Control 14 requires organizations to establish programs that teach staff, including developers, to handle sensitive data and credentials securely."]