On the hunt for ARTEX: understanding agentic attacks in AWS environments

Summary

In October 2026, Datadog observed in-the-wild activity from ARTEX, an AI-native penetration framework in which LLM agents plan and run attacks, against several AWS environments. Using compromised long-term IAM access keys, ARTEX searched CloudWatch logs with FilterLogEvents for financial data, file paths and secrets, and it also abused unauthenticated public Amazon Cognito user pools through anonymous sign-ups and token collection.

Topics

• AI agents

Related items

• InfoJim Cramer says Anthropic's IPO could make or break the AI trade. Here's whySame vendor · CNBC Technology
• InfoFORGE Lab uses agentic tools to identify memory safety issues in RustSame vendor · Microsoft Security Blog
• LowHelp defend against memory poisoning in Amazon Bedrock AgentCore with multi-layer write validationSame vendor · AWS Security Blog
• InfoChatGPT Enterprise now available in AWS MarketplaceSame vendor · OpenAI Blog
• MediumARTEX abuse expands as cybercriminals target financial sectorSame vendor · Microsoft Security Blog