AI agents are already changing how cyberattacks are carried out. Check Point Research (CPR) analyzed ARTEX, an AI-powered penetration testing platform increasingly adopted by cybercriminals and gained rare visibility into how attackers are using autonomous agents from inside their own operator consoles.
The findings show that attackers can set an initial objective and leave AI agents to independently find vulnerabilities, exploit systems and pursue that goal at scale, often with very little human involvement.
Key Findings
- ARTEX is already operating at scale: CPR identified 2,557 systems that hosted ARTEX, including 1,608 live, publicly accessible instances at the time of the research.
- Attacks can run almost entirely autonomously: Once operators set an initial goal, agents handled vulnerability discovery and exploitation with little to no further human direction.
- One campaign generated 400,791 agent messages across 292 objectives without further operator prompting, showing the scale at which autonomous attacks can operate.
- AI agents achieved serious compromises: They exploited vulnerabilities including remote code execution, exposed databases and cloud credentials, and in one case independently identified and executed a supply chain compromise.
- Autonomy still has limits: Despite finding serious vulnerabilities, the crypto campaign generated $0 for the attacker, with agents sometimes mistaking successful API responses for successful cryptocurrency theft.
What Is ARTEX?
ARTEX is an open-source, AI-powered penetration testing platform originally designed to help security teams test systems they own or are authorized to assess. It connects large language models (LLMs) with multiple AI agents that can plan tests, run security tools, investigate vulnerabilities and document their findings.
After ARTEX was observed in attacks against South Korean banks, its developer made the original project closed-source. However, maintained forks and backups have kept the platform available.
CPR identified 2,557 systems that currently or previously hosted ARTEX panels, including 1,608 live and publicly accessible instances at the time of the research. Many additional ARTEX deployments are likely to be inaccessible from the public internet because they operate behind firewalls or within local networks.
Most importantly, researchers discovered 10 misconfigured ARTEX instances exposing their full databases. This provided visibility into the operator side of the attacks, including the models being used, instructions given by operators and the steps taken independently by the AI agents.
Figure 1 – ARTEX Panel
How Autonomous Are ARTEX Cyberattacks?
The research shows that in many observed cases, ARTEX required remarkably little interaction from its operators once an objective had been established.
Rather than continuously directing attacks step by step, operators frequently issued a goal and left the agent fleet to work toward it. Human interactions were largely limited to checking progress, asking whether a target had been compromised or occasionally adjusting priorities.
In one cryptocurrency campaign, 292 campaign objectives produced 230 findings and 400,791 agent messages without any additional operator prompting after the initial goals were set.
This provides a direct look at how agentic hacking changes the role of a cybercriminal. The human can establish the desired outcome, while AI agents perform much of the reconnaissance, vulnerability discovery and exploitation required to pursue it.
Which AI Models Are Cybercriminals Using With ARTEX?
Across the 10 exposed ARTEX instances analyzed by CPR, Chinese AI models dominated, with models from the DeepSeek Flash family appearing most frequently.
American models were configured on three instances. Researchers observed guardrails being triggered only while Anthropic’s Opus 5.5 was being used, after which the operator switched to more permissive Chinese models.
The findings suggest that attackers are not simply experimenting with AI models. They are selecting models according to practical operational considerations, including capability, cost and restrictions.
Which Industries Are Being Targeted, and Where Is ARTEX Infrastructure Hosted?
The observed campaigns were predominantly opportunistic and financially motivated, rather than attacks focused on a single predefined organization.
CPR observed agents targeting organizations and infrastructure connected to:
- Cryptocurrency and digital asset services
- Online gambling, slots and card-game platforms
- Payment infrastructure and crypto payment services
- Over-the-counter crypto trading and custody services
- Gray-market iOS application signing services
Attack objectives ranged from stealing cryptocurrency and code-signing certificates to compromising gaming accounts and conducting denial-of-service attacks against gambling websites. Agents exploited vulnerabilities including weak or hardcoded passwords, missing authentication, insecure direct object references and remote code execution.
The infrastructure behind ARTEX also has a significant global footprint. Among the live ARTEX servers identified by CPR, 882 (54%) were hosted in the United States, 295 (18%) in Hong Kong and 103 (6%) in China. These figures describe the hosting locations of ARTEX servers, not the geographic distribution of attack victims.
Figure 2 – Location of observed ARTEX C&C servers
How Did ARTEX Agents Steal Apple Code-Signing Certificates?
One operator tasked ARTEX with attacking gray-market iOS signing services to obtain Apple code-signing certificates that could potentially be resold.
Two ARTEX consoles operated in parallel for roughly two weeks, targeting 10 signing shops. Instead of directing agents through every stage of the attack, the operator primarily asked questions such as “What’s the progress?” and “Which one is closest to the goal?”
The agents independently searched compromised systems for certificate databases and then validated stolen certificates by checking passwords, private keys, Apple revocation status, expiration dates and associated provisioning profiles.
They ultimately obtained more than 300 certificates and their passwords, with three certificates passing the full validation process, meaning they could be used to sign arbitrary iOS applications.
The scale came at a relatively low cost. The operation processed approximately 36 billion tokens, with CPR estimating the AI model costs at $700 to $1,500 based on official DeepSeek API pricing at the time of writing.
Figure 3 – Example gray-market signing certificate service with more than 90,000
Can Autonomous Hacking Agents Carry Out Supply Chain Attacks?
A second campaign shows how far an AI agent can progress independently once given a broader financial objective. An operator tasked agents with stealing cryptocurrency from hundreds of targets. During a later attempt to identify and compromise the infrastructure associated with a specific cryptocurrency wallet, an agent discovered an unauthenticated API exposing AWS S3 credentials.
Those credentials provided write access to a bucket containing iOS applications and landing pages for a cryptocurrency service. The agent independently reasoned through the possibility of compromising this distribution infrastructure, executed the write and verified the attack chain.
The original file was later restored, and there was no evidence that the operator ultimately profited from the compromise. However, the activity demonstrates that an agent pursuing one objective can identify and act on a supply chain compromise opportunity without being explicitly instructed to do so.
Where Do Autonomous Hacking Agents Still Fail?
Autonomy does not necessarily translate into successful outcomes. In the cryptocurrency campaign, the agents processed 167.5 million tokens and identified multiple vulnerabilities, including remote code execution and exposed databases. Yet across 292 objectives, 230 findings and 400,791 agent messages, the attacker made no money.
Some agents even incorrectly reported successful cryptocurrency cash-outs because APIs returned a “success” response. The attacker’s wallet showed a $0 balance and no transactions, exposing a significant weakness: agents can successfully execute technical tasks while still misunderstanding whether the intended real-world objective has actually been achieved.
What Does Agentic Hacking Mean for Cybersecurity Teams?
ARTEX shows that agentic hacking is already part of the cyber threat landscape. CPR observed more than 1,600 live publicly accessible ARTEX instances, while the exposed databases provide direct evidence of agents operating with very limited human supervision.
For defenders, the important change is scale and speed. A cybercriminal can task agents with investigating large numbers of targets simultaneously, allowing vulnerabilities across internet-facing systems to be discovered and exploited with considerably less manual effort.
At the same time, the research demonstrates the current limitations of these systems. Agents hallucinate, misunderstand results and may fail to achieve their underlying objective even after successfully compromising systems.
Organizations should therefore expect greater automated pressure against exposed infrastructure. Internet-facing systems should be continuously tested and hardened, with particular attention paid to weak authentication, exposed APIs, credential leakage, remote code execution vulnerabilities and cloud storage permissions.
The ARTEX campaigns provide a glimpse of a threat model that is already taking shape: attackers define the objective, while increasingly autonomous AI agents do much of the work required to pursue it.
For the full technical analysis, read the research from Check Point Research here.
