ARTEX in the wild: Chainstack's breach and the AntiFox fork show what agentic attack frameworks actually do

On November 12, The Block reported that blockchain infrastructure provider Chainstack had updated its incident disclosure to say, with high confidence, that the attacker who reached its production environment in late October was driving ARTEX, an open-source framework that orchestrates LLM agents through an intrusion. A day earlier, BleepingComputer carried Arctic Wolf’s findings that a fork of ARTEX called AntiFox was linked to real intrusions that ended with production secrets pulled out of AWS.

Those two disclosures land on top of a month of reporting from Microsoft, Check Point, Datadog, Wiz and GitGuardian on the same tool family. Taken together, they are the clearest picture so far of what an agentic attack framework looks like when it is pointed at real companies: not novel exploits, but ordinary weaknesses found and chained faster and more persistently than a human operator would bother to.

What ARTEX is and how it spread

ARTEX describes itself as an “AI-native penetration framework.” According to Datadog Security Labs, a Chinese developer published it on GitHub in July 2026 and switched it to closed source on October 8, after it had passed 12,000 forks. Closing the repository did not contain it: Check Point Research notes that copies, backups and maintained forks remain public.

The design is a small multi-agent system. An operator gives a target and an objective in plain language. A planner agent breaks that into intents and hands them to worker agents, three at a time by default, while a separate main agent handles chat with the operator. Progress lives in a “blackboard” graph of tasks, goals, facts and findings. Operators can set allow, deny and escalate rules on commands, and some versions exclude government and education domains by default.

Two design choices matter for defenders. First, ARTEX speaks three API formats (OpenAI Chat Completions, OpenAI Responses and Anthropic Messages), so an operator can load keys for several model providers and fail over when one provider cuts a key off. Check Point found Chinese models, mostly the DeepSeek Flash family, dominated across the 10 instances it analyzed, and saw one operator switch models after running into Claude Opus 5.5’s safeguards. Second, ARTEX is commonly run as a hosted web console. Datadog found hundreds of internet-facing consoles, often behind Chinese-language login pages and under names such as ARTEX, ScopeWeaver and LUCK. Arctic Wolf’s AntiFox consoles were hosted on Alibaba Cloud.

The tool is not tied to one actor. Microsoft attributed its use to Storm-0940, a China-aligned group that used credentials stolen from ConnectWise’s Cloud Backup application to attempt sign-ins to more than 2,250 Microsoft 365 tenants at about 2,900 attempts per minute. Check Point documented cybercriminals using it against iOS app-signing services, 13 gaming-account marketplaces and 292 crypto-related domains. Chainstack explicitly attributes the tooling, not the actor, for this reason.

Chainstack: five days from a default password to production secrets

Chainstack’s timeline (UTC) is unusually detailed, and every step is a configuration weakness rather than a software flaw. The company says no vulnerability was exploited.

1. July 2026. A test Grafana instance was deployed to a development cluster with its default admin credentials unchanged and no SSO or basic auth in front of it.
2. October 26. The attacker logged in and used Grafana’s data-source proxy as a pivot to reach internal services.
3. October 26-27. It found an internal MCP tool server with no authentication and cluster-admin rights, and used it to inject a JavaScript loader into development and staging web apps.
4. October 29. It hijacked a workflow-automation platform to obtain machine credentials, then read production Kubernetes secrets.
5. October 30-31. It installed persistence on development hosts, bulk-read production secrets and used a compromised VPN key to reach the database network.

Detection came from a side effect: a database replication pipeline started failing on October 31, and containment followed the same day. The investigation closed on November 2. Exposed data includes organization names, account holder names, member emails and password hashes. Chainstack says it has no evidence node credentials were read but is treating them as exposed, and states that “Customer nodes, the console, and the API were not modified.” Customers are being asked to change passwords, rotate node credentials (self-service, without downtime) and regenerate platform API keys.

The MCP server in step 3 deserves attention. Teams are standing up MCP tool servers to give their own agents access to infrastructure, and an unauthenticated one with cluster-admin rights is exactly as useful to an attacker’s agent as it is to yours.

The ARTEX attribution rests on three kinds of evidence: attacker-created resources named with artx or artex prefixes and incrementing numeric suffixes, use of the chisel tunneling tool that public reporting associates with ARTEX operators, and a behavioral signature of parallel attack paths, rapid retries and throwaway test writes. That signature is worth remembering, because it is what agentic intrusion looks like in logs: many attempts in parallel, most of them failing, at a pace no human operator keeps up.

AntiFox and the AWS pattern

AntiFox started as a fork of ARTEX. Arctic Wolf linked AntiFox consoles to two kinds of intrusions. In one, attackers dropped an ASPX web shell on an internet-facing Microsoft IIS server, ran OS commands, read application settings and database connection strings, and copied config files and logs into a web-accessible directory. In the AWS cases, they used valid identities, including IAM users and assumed EC2 roles, to enumerate services and test permissions. In one intrusion they switched identities and sent hundreds of API requests in about 30 minutes. Most were denied; a few succeeded, and those exposed production secrets. A separate case involved reading, copying and deleting S3 objects. Arctic Wolf did not identify how initial access was gained, and notes that infrastructure links support attribution to AntiFox-linked operations without proving an agent performed every action.

Datadog’s ARTEX research shows the same shape in more detail. Sessions opened with anonymous S3 reads, often hunting front-end assets for build manifests and runtime configs. With stolen long-term keys, the agent ran CloudWatch FilterLogEvents searches for financial terms, then widened them to presigned URLs, internal IPs, database references, AKIA key prefixes and passwords. Against public Cognito user pools, it registered accounts, kept probing when a PreSignUp Lambda blocked some of them, exchanged tokens for short-term AWS credentials and then tried ListBuckets, ListSecrets, DescribeParameters and similar calls. Those all failed because the identity pool role had no permissions, which is the cheapest successful defence in the whole report.

Where the credentials come from is the other half of the story. Microsoft reported on November 5 that actors have used ARTEX and similar frameworks since August to search public GitHub for secrets, combining target company names with keywords for cloud and AI providers, and in one case moved on to exfiltrate data from Azure Key Vaults and Storage Accounts. GitGuardian adds a useful counterpoint to the idea that these tools need special secret-hunting modules: of about 45 offensive agent frameworks it examined, only four shipped a secrets scanner, yet an ARTEX build without one found 8 of 9 planted credentials in a lab test using plain git and grep, starting within 6 to 13 seconds of being asked only to assess a repository’s security.

What defenders should take from it

None of these intrusions needed a zero-day. The common inputs were a default password, an unauthenticated internal service, over-broad roles and long-lived credentials sitting where an attacker could read them. The same lesson came out of Railway’s breach report earlier this week. What agents change is the economics: an attacker can now afford to try every path on every target, and a weakness that used to be safe because nobody bothered to look is no longer safe.

The concrete checks from the reports:

• Look for success inside a burst of failures. Both Arctic Wolf and GitGuardian recommend reviewing CloudTrail for successful calls (especially GetSecretValue and other credential stores) that sit inside bursts of AccessDenied. Datadog also flags instance-role credentials used from non-AWS IPs and large CloudWatch log searches.
• Hunt the known markers, but do not rely on them. User agents containing “artex” (artex-pentest/1.0, ARTEX-worker/1.0, Mozilla/5.0 ARTeX), requests for placeholder objects such as zzz_nonexistent_abc.txt before fuzzing, and artx-prefixed resource names are all in public reports. All are trivial to change.
• Treat exposed secrets as compromised. Microsoft’s guidance is blunt: deleting a leaked file does not revoke the key. Rotate, then check what the identity touched.
• Put authentication on internal tools, including MCP servers. Chainstack’s attacker went from a dashboard to cluster-admin through an internal service that assumed the network was the perimeter.
• Prefer short-lived, narrowly scoped credentials. Datadog’s Cognito case failed for the attacker only because the role behind it could do nothing.

What to watch

ARTEX being closed source has not slowed its use, and AntiFox shows forks are already diverging, so expect more names attached to the same core design. The open questions are on the model side. Check Point’s observation that operators lean on Chinese models and switch providers when safeguards trigger suggests key revocation by model providers is now part of incident response, and providers will be under pressure to detect agentic attack traffic, not just individual harmful prompts. On the defender side, watch for Chainstack’s indicators and MITRE ATT&CK mapping (available from its security team) and for Arctic Wolf’s full AntiFox report, which should clarify how initial access was gained.