Threat actors use agentic AI framework ARTEX to abuse exposed secrets

# Threat actors use agentic AI framework ARTEX to abuse exposed secrets

https://gcdradar.vercel.app/incidents/threat-actors-use-agentic-ai-framework-artex-to-abuse-expose · AIR-2026-1795 · live

- Lane: Breaches & attacks
- Severity: 3 (Confirmed exploitation): Confirmed active exploitation by threat actors using AI tools.
- Fix status: No fix needed
- First reported: 2026-11-05
- AI role: AI-enabled attack
- Products: ARTEX, GitHub

## Summary

Threat actors utilized the agentic offensive security framework ARTEX to scan GitHub for OAuth secrets. The compromised credentials were then used to execute authenticated actions within targeted organization tenants.

## What to do

Audit GitHub repositories for exposed OAuth secrets and monitor for unauthorized tenant access.

## Latest updates

- 2026-11-07: Storm-3358 targeted the financial sector using the ARTEX framework in October 2026 (https://microsoft.com/en-us/security/blog/2026/11/06/artex-abuse-expands-as-cybercriminals-target-financial-sector)
- 2026-11-05: CERT-In Flags AI-Driven Attacks as Backdoored ARTEX Exposes 62 Consoles to Root Access (https://thehackernews.com/2026/11/backdoored-docker-image-for-artex-ai.html)
- 2026-11-05: Threat actors use agentic AI tooling to find and abuse exposed secrets (https://microsoft.com/en-us/security/blog/2026/11/05/threat-actors-use-agentic-ai-tooling-to-find-and-abuse-exposed-secrets)

## Sources

- 2026-11-05 Microsoft Security: Threat actors use agentic AI tooling to find and abuse exposed secrets https://microsoft.com/en-us/security/blog/2026/11/05/threat-actors-use-agentic-ai-tooling-to-find-and-abuse-exposed-secrets
- 2026-11-05 The Hacker News: CERT-In Flags AI-Driven Attacks as Backdoored ARTEX Exposes 62 Consoles to Root Access https://thehackernews.com/2026/11/backdoored-docker-image-for-artex-ai.html
- 2026-11-07 Microsoft Security: ARTEX abuse expands as cybercriminals target financial sector https://microsoft.com/en-us/security/blog/2026/11/06/artex-abuse-expands-as-cybercriminals-target-financial-sector
- 2026-11-10 Dark Reading: Artex: The AI Pen-Test Tool Hackers Turned Into a Weapon https://darkreading.com/cyberattacks-data-breaches/artex-ai-pen-test-tool-hackers-weapon

Verify against the vendor's advisory before changing production. Data CC BY-SA 4.0, https://gcdradar.vercel.app.