Inside ARTEX, the agentic AI offensive framework
TL;DR: ARTEX gives threat actors a ready-made system for coordinating AI agents, sharing discoveries, and pursuing new leads. Its planning and memory let those agents build on earlier work through a long investigation.
In the last month, Microsoft, CrowdStrike, Zscaler, Palo Alto, and Google reported real intrusions that used ARTEX, run by China-state-aligned groups and financially motivated extortion groups, against banks in South Korea and Southeast Asia, and against the ConnectWise cloud supply chain.
Something getting such a broad adoption is worth studying, so I took a look under the hood of ARTEX.
What is ARTEX?
ARTEX is an open-source offensive AI framework. It has a planner-workers architecture. The planner and workers coordinate tasks through a PostgreSQL database, where the planner posts work and the workers claim it and report results.
I recently wrote about what makes an offensive framework effective. ARTEX’s most interesting engineering is how it keeps a long investigation coherent.
How does it do it?
1. Discoveries trigger new planning. Workers execute tasks and record results; those updates wake the planner to decide what to investigate next.
2. Two linked graphs separate the target from the investigation. The asset graph records domains, services, and endpoints; the exploration graph records which observations motivated each task and what it produced.
3. Workers can recover observations another worker omitted from its findings. They search each other’s execution logs and retrieve specific steps, allowing useful errors or responses to inform later work.
4. Fresh planner sessions retain a shared checklist. The planner combines the current investigation overview with its checklist to coordinate dependent steps across rounds.
5. Compaction preserves history needed by active tasks. ARTEX can summarize eligible facts and completed tasks after six planning rounds without active dependencies, while keeping links to the original records.
How are defenders fingerprinting ARTEX?
- Request timing: Unit 42 reported bursts of 1–14 requests separated by 25–31-second pauses.
- Named artifacts: GTIG reported artex-probe-* files and ArtexProbe accounts; CrowdStrike flagged artx/artex command-line strings.
- HTTP signatures: Unit 42 reported realm="ARTEX"; WorkOS logged the user agents ArtEx and artex-enrich/1.0.
I recently wrote about what makes an offensive framework effective. ARTEX manages context, preserves investigation history, and runs real tools, but still relies on the model to judge whether an attack succeeded.
- Context management: the planner gets an updated summary each round, while older branches are compressed once active work no longer needs them.
- Long-term memory: ARTEX saves what it found and tried, so later tasks can build on linked investigations. However, it lacks a mechanism for turning experiences into attack strategies that can be reused in the future.
- Execution environment: workers can run commands and write files; each gets a workspace, but not its own sandbox.
- Oracle: ARTEX uses real tool results as evidence, but relies on an LLM to judge whether they confirm a vulnerability or satisfy a task goal.
ARTEX is a very well-engineered offensive framework, unlike many "marketing open-source projects" of security vendors, and another sign that the harness matters more than a model. The recent WorkOS incident, where ARTEX's agents were able to escape a sandbox and compromise WorkOS infra, shows its capability. If you decide to use or test it, do it in an air-gapped environment to prevent turning an experiment into a real incident.
Independent analysis you can act on, straight to your inbox.
Thanks. is on the list.