Check Point Finds ARTEX Agents Running Autonomous Cyberattacks

Check Point researchers detailed widespread criminal use of ARTEX, an open-source penetration testing platform that coordinates AI agents. They identified 2,557 systems that hosted ARTEX panels, including 1,608 live instances accessible through the internet during the research.

Artifacts from operator consoles showed which models were used and how operators prompted their agents. Chinese models were the most common, led by the DeepSeek Flash family. Operators typically did little beyond setting initial goals and checking progress while agents discovered and exploited vulnerabilities.

One operator ran two ARTEX consoles for about two weeks to attack grey-market services selling iOS code-signing certificates. Agents obtained more than 300 certificates and passwords, of which three passed the operator's validation process. The operation processed about 36 billion tokens using DeepSeek v4.1 Flash and Kimi K3.1 Pro.

Another operator assigned agents to 292 cryptocurrency payment domains with instructions to steal USDT and redirect future payments. Other observed campaigns targeted gaming accounts and gambling sites or attempted denial-of-service attacks.