Cyber Experts Weigh In: How to Fight Artex & AntiFox

Cybercriminals using agentic pen-testing tools is a proverbial genie out of the bottle at this point, so enterprises need to get a defense plan in place right away.

A month since it went closed-source, the Artex agentic penetration testing framework is spreading faster and causing more havoc than ever. Still, cyber defenders tell Dark Reading that defending against it is largely a matter of willingness, not capability.

To recap: In August, a Chinese open source (OSS) developer released a cybercrime-grade agentic red-teaming tool called “Artex.” In the months that followed, attackers and cybersecurity researchers have gradually realized just how effective Artex is at probing for vulnerabilities, and turning initial access into meaningful compromise at so-called machine speed.

“Artex is what the perpetual conflict era looks like,” says Yuval Itzchakov, cofounder and chief technology officer (CTO) of A Security. “When our research team ran it against our open source benchmark, it found eight vulnerabilities in about 45 minutes, including a critical privilege escalation to admin, and chained them into a full attack path through a WAF, CAPTCHA, and MFA. All it took was a download, an install script, and a model key.”

Nothing about it is so complicated, he says, “And that’s the point. Take the guardrails off an AI hacking tool and anyone can run agentic attacks at scale. In Artex, scope is just a suggestion to the model.”

Though its author de-listed the original Artex on Oct. 8, new variants continue to cause trouble. The variant du jour, “AntiFox,” was recently weaponized by attackers to exploit Internet-facing Web services and their associated Amazon Web Services (AWS) environments. According to researchers at Arctic Wolf Labs, threat actors used their new agentic toy to breach, deploy Web shells, and execute operating system (OS) commands on compromised Microsoft Internet Information Services (IIS) servers, as well as enumerate services, expose production secrets, and manipulate Simple Storage Service (S3) buckets across AWS environments.

Notably, Arctic Wolf Labs offered relatively banal advice for organizations defending against this quite new threat: hunt for indicators of compromise (IoCs), rotate and revoke relevant credentials and sessions. In fact, researchers say, there’s little more to defending against Artex or AntiFox than basic cybersecurity hygiene. However, it’s also important to avoid making assumptions; as GitGuardian pointed out in a blog post on AntiFox, “Blocking scanner tools won’t stop these agents, and a leaked key stays dangerous until someone revokes it.”

How to Defend Organizations Against the Artex Cyberthreat

The prospect of every Tom, Dick, and Harry having an agentic attack framework in their pocket might be intimidating, but cybersecurity defenders still possess some distinct advantages.

First off, Itzchakov points out that “Artex stops at the front door. It has no lateral movement, no Active Directory testing, and no view inside. Defenders can see their whole environment and test it continuously with the same speed and autonomy, under guardrails no one can switch off. The organizations that come out ahead will treat this as permanent and build their security around it.”

In a profile of a recent incident response (IR) effort against an Artex attack, Eye Research noted another serious weakness of agentic tools in general: they’re loud. “The agents left their name in pod names and probes, hammered endpoints no human would touch, and tripped detections on systems with EDR installed,” it explained. “Where we had visibility, we saw them immediately.”

“If you want to be positive, there are a lot of small steps you can put together in order to protect networks and organizations,” says Guillaume Valadon, lead cybersecurity researcher at GitGuardian. To catch Artex or AntiFox’s loudness, for example, “blue teams must have in place a security information and event management (SIEM) platform and a really good detection system, to make sure that they will detect these tools in the noise.”

Besides active detection, organizations would be well advised to focus on secrets management. Artex and AntiFox have proven adept at finding secrets, in part because they use ordinary commands like “git” and “grep” to find what they’re looking for, instead of shipping a more easily identifiable and blockable secret scanner.

“Defenders need to be looking for exposed and dormant keys, checking Git repos for exposed secrets, and heavily implementing a defense-in-depth posture,” Justin Moore, Arctic Wolf’s director of adversary operations adds. “What makes these frameworks so effective is not that they’re conducting novel attacks, they’re just doing what we already know, just faster than we have seen before. Good cyber hygiene is exactly what prevents these types of attacks from being so successful, whether they’re agentic or not.”

Despite all of the positive steps organizations can take, Valadon thinks, “If I’m being negative, I would say that it’s too late.”

“For years we have been telling people that they should not output secrets — that we’re finding really important hardcoded secrets everywhere, publicly. On Docker, GitHub, and so on. Now, because we have these tools that can go fast from nothing to discovery to weaponization, that makes it more difficult for blue teams,” he says.

“The agentic capacity for the attacker is already here, and they’re going faster and faster and faster,” he notes. “So if you didn’t do the right stuff before, it will be difficult for you to catch up.”

Are Agentic Cyberattacks For Real Now?

The cybersecurity industry has been waiting for artificial intelligence (AI)-driven cyberattacks for years now. Product marketing campaigns have hinged on agentic attacks being right around the corner. Stories of lightly AI-influenced tactics, techniques, procedures (TTPs), and malware have kept food on cyber reporters’ plates. Most of the discourse has been, at best, theoretical, at worst, misleading.

A meaningful, if incomplete, turning point seems to have occurred around midway this year, if not among the most sophisticated attackers than at least in the world of middling cybercriminals.

“When we all started using ChatGPT, at that time, we were just asking it simple questions. It was fun, but it was not possible to code,” Valadon explains. “And then we had agents that were more capable at coding, and syncing. This year you can do it all, from end to end. You just give [an agent] a rough idea, and it will do some planning, syncing, it will build the code for you, and deploy it for you. It’s getting better and better at doing the whole cycle.”

He also points to Anthropic and OpenAI’s warnings about open source (OSS) AI earlier this fall: “Some people are saying that we are seeing these [attack] frameworks because of Chinese open-weight models. Because if you have a big GPU, you are able to run your own offensive models with Artex.”

“It’s getting more and more dangerous,” he says. “It’s all fitting into the HuggingFace, OpenAI, Anthropic narrative [warning against attackers] having access to real offensive tools.”

Originally published on Dark Reading