ARTEX shows even the biggest WAFs aren’t enough

ARTEX shows a WAF is no longer enough

We have been tracking ARTEX, the AI framework that runs intrusions on its own, for about a month. It has never got past DiamWall, it is getting past others, and the reason is simple: against AI agents, a WAF on its own is no longer enough.

On 13 November the FBI published a FLASH alert about ARTEX, an open-source framework that hands the work of an intrusion to large language models, from reconnaissance and vulnerability scanning all the way to web shells and data theft. According to the FBI it has been used since at least August 2026 against financial services, government, technology, defence, energy, healthcare, telecommunications and other sectors around the world, and by early November researchers had found more than 1,600 ARTEX consoles exposed on the internet, with many more likely hidden behind firewalls.

For us none of this is news, because we have been following ARTEX for about a month, both in the traffic that reaches the services we protect and through our threat intelligence on the underground channels where these tools are traded.

What ARTEX actually is

ARTEX is a multi-agent attack platform written in Go. The person running it describes a goal in plain language, and a set of specialised AI agents turns that goal into commands, runs them, reads the results and decides what to try next, with very little human input after the first instruction. It has no AI model of its own and plugs into whichever one its operator pays for, from frontier models to Chinese ones such as DeepSeek, GLM and Kimi. On the attacker-controlled instances that have been analysed, Chinese models are the most common, with DeepSeek's cheaper models dominating because they are inexpensive and show no visible guardrails when the request is framed as a penetration test.

It was published on GitHub in July 2026 by a developer who described it as a tool for authorised security testing, and it collected an estimated 1,500 to 2,000 stars in ten weeks. When reports of abuse started to pile up, the developer took the repository down on 8 October, but by then it was too late, because the framework kept spreading through community forks, localised variants, archived copies and a commercial edition called ARTEX PRO.

From the FBI alert and our own tracking.

What it has already done

The campaigns already on record show how far this goes. In one of them, attacks on South Korean financial institutions ended with the personal data of around 67,000 people being taken. In another, a supply chain compromise involving ConnectWise Cloud Backup customers opened the way to more than 2,250 downstream tenants. Some intrusions went from the first contact to privileged access in under three hours, which leaves defenders very little time to react even when the noisy traffic does set off an alarm.

ARTEX is particularly good at finding the parts of an organisation that nobody looks after, such as partner and supplier portals, mobile app backends, employee tools, legacy services and applications built by other departments. Once inside, it has been seen planting web shells, including through MySQL log poisoning, install open-source remote access tools such as WISP, vshell and AdaptixC2, and move data out through rotating webhook services. Above all, it lets small groups with very little skill run several intrusions at the same time, at a pace they could never manage by hand.

What we are seeing in Portugal

Our threat intelligence points to a sharp rise in activity, with more web shells, more website defacements, government websites among the targets, and attempts against platforms in both the private and the public sector. Since ARTEX appeared we have been seeing more of those attacks succeed, which is what you would expect from a tool that scans, chains vulnerabilities and tries again without ever getting tired.

Since we started following it, we have also come across signs of a threat actor in Portugal, possibly a single person or a small group of threat actors, using ARTEX in its operations. Seeing it adopted here this quickly is exactly what worries us most about the weeks ahead, because others will follow the ones who are already getting results with it.

The FBI alert, seen from Portugal

The FBI alert is a valuable piece of work, and it gives security teams around the world the details they need to defend themselves. What we have noticed in Portugal is what happened next on the underground channels: ARTEX was rarely mentioned there before the alert, and since then it has been everywhere, as people who had never heard of it went looking for a copy. That is not a reason to stay quiet about threats, it is a reason to act on them, and in our experience too many organisations in Portugal only act once they have already been compromised. This is one of those moments when waiting is the most expensive option.

What happened when ARTEX met DiamWall

ARTEX has been pointed at several of our customers over the past month, and it has never worked. In every ARTEX attempt we identified against our customers, our antibot stopped the attack straight away, before our WAF was ever needed.

On top of that, our Advanced Threat Defense, the AI-driven part of our platform, automatically deployed an additional rule aimed specifically at ARTEX. ARTEX did not work against DiamWall before that rule existed, because the antibot was already stopping it, and with the rule in place it has even less of a chance now.

ARTEX traffic reaching our edge went up week after week, from around 500 requests a day in mid-October to almost 10,000 a day by 12 November, and the FBI alert pushed it further, to more than 13,000 on the day it came out and over 16,000 the day after.

ARTEX requests reaching our edge per day, with the day of the FBI alert marked.

Why a WAF is no longer enough

For years the WAF has been the centre of web protection, and it was built for a world where attacks were written by people and changed slowly. It looks for attacks inside requests, matching them against rules and signatures, and it works as long as the attacker keeps sending things it recognises. ARTEX turns that model upside down, because it puts an AI behind every request that reads the response, understands why it was blocked and tries again with something slightly different, as many times as it takes, at a speed no human attacker could ever match. Sooner or later one of those variations gets through, and the WAF only has to miss once.

An antibot asks a different question, which is not whether a request looks like an attack, but whether there should be an automated agent behind it at all. That is a question an attacking agent cannot rewrite its way out of, however clever its payloads are, and it is why our antibot stopped ARTEX before it ever got the chance to start probing. In every ARTEX attempt against our customers, the WAF never even had to be involved, and that is where the focus of web protection has to move now.

That is also where our antibot is different, because it does not decide on the strength of what a client says it is, such as its User-Agent or a list of known signatures, but on what the client actually is and how it behaves. We built it to recognise every generation of bots, from simple scripts and automation libraries to headless browsers and now AI agents, along with the frameworks they are built on, and that is why it recognised ARTEX from its first requests, before anyone had written a single rule for it.

Even if something ever got past the antibot, it would still have to get through every layer behind it.

Where others are failing

Not everyone has been as well protected as our customers. Among the services hit in this wave of attacks are some sitting behind well-known CDNs and security providers, some of them market leaders, whose protection leans mainly on the WAF. These are not small or careless organisations, they are companies that did what they were told was enough, and it no longer is. The common thread is that the agent was allowed to keep talking to the site long enough to find a way in, which is exactly the situation an antibot is there to prevent.

A month at our edge

Here is how the requests our antibot challenged or blocked over the last 30 days break down across the services we protect, counting everything it dealt with and not only ARTEX.

Our AI-driven Advanced Threat Defense accounted for 11% of the challenged or blocked requests over the last 30 days.

Nearly half of these requests declared themselves as Chrome and more than three quarters as some kind of browser, which shows how little the User-Agent tells you on its own. The requests our AI picked up were even more insistent about it, with eight in every ten of them posing as Chrome.

Declaring a browser User-Agent costs nothing, so we never take it at face value.

How to spot it in your own logs

Most of the time ARTEX presents itself as an ordinary Chrome browser, which is exactly why User-Agent rules are not enough to stop it. Every now and then, though, it gives itself away: some of its requests carry "ARTEX" or "pentest" in the User-Agent, it often leaves the word "ARTEX" inside the HTML of the pages it defaces and in the names of the functions in its XSS payloads, and it marks what it creates with IDs of its own, and most of the attackers using it never even notice. If you find any of these in your pages, your logs or your database, assume ARTEX has been there, but do not assume that their absence means it has not.

These are the other signs we look for when an AI agent like ARTEX is working on a target, and they are worth checking on your own systems today:

• High-frequency automated requests that walk through login or search endpoints one value at a time.
• Short, intense bursts of activity with large numbers of failed attempts, each one only slightly different from the last.
• Duplicate requests, a sign of several AI agents working on the same target and stepping on each other.
• Unexpected outbound connections from your servers to AI model APIs such as DeepSeek, Zhipu or xAI.
• Web shells, such as .aspx or .jsp files, appearing in places in your applications where they have no reason to be.
• Outbound transfers of structured personal or financial data to destinations you do not recognise.

Hackers infecting hackers

When the original repository came down on 8 October, ARTEX did not disappear, it went underground. On the underground channels it now circulates as forks that promise new features, localised versions, archived copies of the original code and ready-to-run packages passed from hand to hand, alongside people selling or reselling access to the commercial ARTEX PRO edition. Most of the people downloading these copies have no way of checking what is inside them, and many would not know how to even if they tried.

The irony is that copies of ARTEX circulating on these channels have been found with a backdoor of their own, so attackers who grab the wrong copy without checking it can end up handing their own machines, and everything on them, to whoever repackaged it. The people trying to break into everyone else's systems are leaving their own doors wide open, and in a scene where nobody checks the code they run, hackers end up hacking hackers.

ARTEX is only the beginning

ARTEX is the first of these tools to become famous, but it will not be the last. Taking down the original repository did not stop it, it simply turned one project into hundreds of copies that nobody controls, and the same thing will happen with whatever comes next. We expect the situation to get a lot worse over the coming months, with new AI agents trying everything they can to get around WAFs and to look more and more like real visitors.

That is exactly the fight our antibot was built for. It has stopped every ARTEX attempt against our customers from the first request, our Advanced Threat Defense adapted to ARTEX on its own without anyone having to write a rule by hand, and everything our threat intelligence picks up feeds straight back into how we protect the companies that trust us.

DiamWall is ready to help any company that needs it, whether you are already seeing strange traffic, are under attack right now, have been hit and need to make sure it does not happen again, or simply want to be protected before ARTEX or the next tool like it reaches your door. Get in touch or open the DiamWall dashboard and we will put our antibot in front of your applications, so that these agents meet the same wall they have been meeting at every one of our customers.

What we would do now

• Make a list of everything you have exposed to the internet, including the forgotten pieces such as partner portals, old admin panels and mobile backends, because these tools are very good at finding them.
• Rotate long-lived tokens and API keys, especially the ones sitting in CI/CD pipelines, and restrict where they can be used from.
• Keep deployment and administration interfaces off the public internet wherever you can.
• Put a real antibot in front of your applications and stop relying on the WAF alone, so that automated agents are stopped before they can start probing.
• Do not wait until you have been compromised to take this seriously.

ARTEX is knocking on doors right now. Put your website behind DiamWall from our dashboard, see our plans, or talk to our team if you need help today.