The Federal Bureau of Investigation (FBI) has issued an urgent alert warning that cybercriminals are weaponising an artificial intelligence-assisted security testing framework called ARTEX to dramatically accelerate attacks on organisations worldwide — with some intrusions achieving privileged access in under three hours. The alert, issued on Friday, marks one of the most direct warnings from US law enforcement about the abuse of AI-powered offensive tools.

What ARTEX Is and How It Is Being Misused

Originally designed for authorised penetration testing, ARTEX is an open-source framework that automates multiple stages of a cyberattack — from identifying vulnerable targets to staging or executing data theft. According to the FBI alert, malicious actors have been exploiting the tool since at least August 2026, targeting organisations across finance, government, technology, defence, energy, and healthcare sectors.

The tool's developer reportedly pulled the original online repository in October following reports of malicious use, but copies and variants are said to remain widely available — a pattern seen previously with other dual-use security tools that escape the open-source ecosystem once released.

Speed Is the Core Threat

What makes ARTEX particularly dangerous, according to the bureau, is its speed. The FBI noted that some intrusions progressed from initial targeting to privileged access in under three hours — a window that leaves defenders with critically little time to detect, isolate, or contain a breach. The tool also reportedly enables attackers to pursue multiple targets simultaneously, multiplying its potential impact.

The alert specifically flagged organisations' internet-facing applications, cloud infrastructure, and systems connected to suppliers or partners as the highest-risk areas — the same attack surfaces that have driven major breaches in recent years.

Known Incidents Cited by the FBI

The bureau cited at least two documented cases tied to ARTEX-assisted attacks. In one, financially motivated actors targeted South Korean financial institutions, reportedly resulting in the personal information of approximately 67,000 people being exfiltrated. In a separate incident, a supply-chain compromise targeting users of a cloud backup service allegedly granted attackers access to more than 2,250 downstream customer environments — a scale that underscores the cascading risk posed by vendor ecosystem vulnerabilities.

What the FBI Is Recommending

The FBI urged organisations to take immediate steps, including reviewing their internet-facing exposure, tightening identity and access controls, monitoring for unusual activity, and securing credentials. Organisations that detect suspicious activity were encouraged to contact the FBI directly or file a report via the Internet Crime Complaint Center (IC3).

This alert comes amid a broader surge in AI-augmented cyberattacks globally, where tools that once required advanced technical expertise are increasingly accessible to low-skill threat actors. As AI continues to lower the barrier to entry for offensive operations, the gap between attacker capability and defender readiness is widening — and the FBI's warning signals that regulators are watching.