The FBI issued a flash alert Friday warning that the open-source Artex platform is being used by cybercriminals and nation-state actors to automate cyberattacks, according to The Record¹.

The bureau said the framework can take a large language model and use it to run multiple phases of an intrusion, from reconnaissance through data theft, at what it called machine speed¹.

The Record quoted the FBI as saying Artex "significantly reduces the time required to chain attack techniques," with some cases moving from initial targeting to privileged access in under three hours¹.

The FBI also said the tool lets operators with little technical skill run complex, multi-target operations at once, according to the report¹.

Artex was posted in August on GitHub by an account known as Autumn-27, The Record said¹. The outlet, citing the Wall Street Journal, identified the developer as Chinese cybersecurity engineer Li Puhua¹.

A statement on GitHub dated Oct. 8 said the tool had been abused by malicious actors; the developer denied responsibility for crimes committed with it and later removed the repository, The Record reported¹.

The FBI said the framework still spreads through community forks, localized copies, archives and a commercial version, according to the article¹.

The advisory cited Censys research showing more than 1,600 publicly exposed Artex consoles, with more likely behind firewalls, The Record said¹. The platform can turn high-level goals written in words into commands run by AI agents with little further human input¹.

The FBI said Artex can plug into models including Anthropic Claude, OpenAI GPT, DeepSeek, GLM, Grok and Kimi, and that attacker-controlled instances most often used Chinese models, with DeepSeek Flash family models dominating because of cost, capability and limited guardrails when framed as penetration testing¹.

The Record said the tool has been used against financial services, government, technology, defense, semiconductor, energy, healthcare, manufacturing, telecommunications and legal targets, and has been implicated in attacks on South Korean and Japanese financial institutions¹. Microsoft said Chinese state-backed actors used Artex in a supply-chain attack on ConnectWise, the outlet reported¹.

Amazon chief information security officer C.J. Moses said another campaign targeted cryptocurrency exchanges for know-your-customer bypass using real-time deepfake injection, according to The Record¹. Moses said such frameworks have moved from experiments to sustained operations with little human intervention¹.

The FBI said Artex agents can map trust ties between organizations, hit weaker third-party systems and generate high volumes of attempts that outpace defenders, The Record reported¹.