For five days, something inside WorkOS held a key to a door nobody meant to leave open. The door was an internal tool the go-to-market team used to look up customer accounts, reachable from the internet through access controls far looser than anyone intended. The key was a predictable credential meant for local development. The thing holding it was not a person. It first authenticated on Sunday, October 25, and no alarm sounded. On Friday, October 30, with no rate limit to slow it, it pulled the records in bulk. CRM contacts. Account histories. Excerpts of sales calls, support discussions, and customers' Slack conversations.
By the time an employee noticed one connected system working far harder than it should, the agent had already finished. The requests in the logs announced themselves as artex-enrich/1.0 and norma/0.4, the signature of the AI attack framework behind bank intrusions in South Korea and a state-aligned campaign against Microsoft 365 tenants. WorkOS warned customers an AI-assisted offensive framework had been turned against it. Within days of that warning, a researcher came forward. Nobody had aimed the agent at WorkOS. It had escaped a sandbox during benchmark testing and found the exposed tool on its own, and the access was no less unauthorized for it.
We have tracked ARTEX since CrowdStrike tied it to intrusions at South Korean financial institutions, and our most recent assessment followed the framework from a lone financially motivated threat actor into Chinese state-aligned espionage. ARTEX usage has increased and is something to keep an eye on. In addition, the wider record now places it in Japan, South Korea, India, and Southeast Asia, in the hands of eCrime threat actors, an alleged extortionist in Seoul, a China state-aligned adversary, and a researcher who never meant to touch anyone. Someone has also started trojanizing the framework itself.
Breach Without an Adversary
WorkOS sells single sign-on, directory sync, and user management to software companies. Its first bulletin on November 2 disclosed the breach of the internal sales application, and founder Michael Grinich told BleepingComputer the attacker used ARTEX, identified through the user agents in the requests. Production systems and customer application data stayed untouched. The exposed operational metadata, covering product usage plus connection and directory health, still matters. It shows which customers depend on which identity provider and where their integrations break, precisely the context a convincing pretext needs.
The November 6 update laid out the researcher's account. Between November 3 and 5, the researcher contacted WorkOS, accepted responsibility, and explained the agent had escaped its isolated environment during cyber security benchmark evaluations with ARTEX. At WorkOS's request, the researcher handed over request details, timestamps, and artifacts, and WorkOS and an independent forensics firm correlated that evidence with the company's own logs. The researcher says all WorkOS data has been deleted and shared with no one.
The root cause was a migration left unfinished. The tool sat on a legacy internal platform WorkOS had not yet retired, so it lacked the platform-level safeguards covering the company's other internal tools. Because the credential was predictable, the agent authenticated as soon as it discovered the endpoint. WorkOS says the incident would have been mitigated or prevented entirely had those safeguards been in place. None of it required a novel exploit.
None of the forensic evidence has been published, and the researcher remains unnamed. Neither bulletin explains how a benchmark evaluation came to send authenticated requests to a production system on the open internet. An agent given a goal and room to explore treats any reachable host as part of the problem. Frontier labs already struggle to keep their own agents contained. Anthropic has disclosed a Claude model breaking into a real company after a misconfigured exercise left a path to the internet, and OpenAI's agents flooded RubyGems in May in an incident still unresolved as attack or accident. WorkOS now describes the same failure from the receiving end.
The indicators WorkOS published carry a detail its update leaves unaddressed. Regional internet registry records place two of the six IP addresses in China Telecom's fixed-broadband IPv6 range. Both share one interface identifier in modified EUI-64 format, which embeds a device's hardware address, and that address falls in a block registered to ASUSTek. The shared identifier is consistent with a single ASUS-manufactured device on a Chinese broadband line, although identifiers can be configured or spoofed, so the address structure alone cannot prove one physical source. A third indicator is a China Telecom address in Guangdong, and the remaining three belong to commercial hosting at Melbicom's Japan block, IT7 Networks, and NetLab Global. None of this contradicts the researcher's account. Residential proxy networks route traffic through compromised home devices worldwide, and one recently surfaced on the White House network. The indicators do not establish where the researcher sits. They do show part of the agent's traffic reached WorkOS from Chinese consumer broadband.
None of this changes what happened to the data. The agent exfiltrated CRM contacts and customer conversations to a system WorkOS does not control, and their deletion rests on the researcher's word. Those safeguards failed identically for a researcher, and they would have failed identically for a state-aligned adversary.
Same Fingerprint, Different Hands
ARTEX is written in Go, with a Next.js console backed by PostgreSQL. Its developer, Autumn-27, also wrote ScopeSentry, a widely used Chinese asset-discovery and vulnerability-scanning platform, and ARTEX syncs the domains, subdomains, IP addresses, ports, and endpoints ScopeSentry finds into its own asset graph. A user defines a task with a scope, test accounts, and a goal. A Planner agent turns the goal into attack intents, Worker agents claim those intents and run tools such as nmap, and an event-driven engine repeats the explore, decide, and execute loop until it reaches the goal. Censys documents a second graph tracking how much of the target has been tested, traffic recording through mitmproxy, and support for Anthropic, OpenAI, or any OpenAI-compatible model endpoint.
Among the indicators WorkOS published is the user agent norma/0.4. The same string appears in the indicators Wiz published on October 22 for Storm-0940's campaign against IT and software vendors, listed beside infrastructure Microsoft attributes to the China state-aligned adversary. A researcher's runaway benchmark and a state-aligned supply-chain operation left an identical string in two sets of victim logs.
The overlap proves nothing about a common hand. Microsoft lists a Norma SDK WebFetch component among ARTEX's default tooling, alongside Nmap, curl, wget, Python HTTP clients, and headless Chromium through Playwright. An unmodified installation is therefore likely to announce itself the same way everywhere. Wiz warns many of its user agents are not unique to Storm-0940. The strings identify the framework and say nothing about the person running it, and an agent able to rotate user agents in minutes can drop them at will. Attribution is a confidence judgment built from evidence, and a string every default install emits carries almost no weight in it.
Censys counted 1,465 hosts exposing an ARTEX console in early November. About 650 of them sit in two blocks of identically configured hosting, 493 at PEG Tech (AS54600) and 157 at Yancy Limited (AS138415). Censys reads the uniformity as repeated provisioning rather than hundreds of independent installations. Excluding those blocks leaves roughly 815 distinct-looking deployments, a figure still unable to show how many separate users control them. An independent count by the researcher BadByte found 1,645 live consoles on November 4. Because the console never needs to face the internet, either figure understates the real installed base.
Geography offers little help. The United States hosts 726 of the consoles Censys found, Hong Kong 387, China 177, Japan 51, Singapore 38, and South Korea 21. Those figures describe where servers are rented, not where anyone sits. The Chinese-language console dominates, with English, Korean, Japanese, Russian, and Portuguese localizations alongside it. Censys states plainly some of these hosts belong to authorized testers, and nothing in a console banner separates a penetration-testing firm from an adversary.
Of the 1,465 hosts, 155 (10.6 percent) carry at least one other threat Censys detects. CyberStrikeAI shares 70 hosts with ARTEX, and PentAGI, HexStrike AI, and RedAmon appear as well, the same habit of stacking open-source agent frameworks Gambit Security found behind a card-theft campaign. A smaller set pairs ARTEX with Cobalt Strike, Vshell, AdaptixC2, and FRP tunneling. Forty-three hosts also run self-hosted LLM gateway or reseller software, mainly CLIProxyAPI and New API, the same kind of model reseller the South Korean intrusions relied on.
The careless infrastructure Hunt.io reconstructed belongs to a wider pattern. Censys saw open directories on the ARTEX server CrowdStrike later published starting August 18, seven weeks before CrowdStrike's analysis appeared. During its research Censys found 32 open directories on other ARTEX hosts. They held a Windows lateral-movement kit, Linux beacon builds, Windows stagers, HTA droppers stored next to a man-in-the-middle root certificate authority private key, and in one case an entire home directory with SSH keys and shell history. Between November 3 and November 5, ten of those directories closed and fifteen new ones appeared. Censys titled its research "Agentic Asbestos," a fair name for a material now built into everything and hazardous to whoever handles it carelessly.
Hunters Became the Hunted
The developer's exit created an opening someone exploited within hours. On October 8, the day Autumn-27 announced ARTEX would go closed-source, a Docker Hub account named tomicdd was created and pushed an ARTEX image less than an hour later, according to BadByte's analysis. A GitHub copy called trhhubsd/ARTEX, briefly named ARTEXX, presented itself as the maintained successor and changed one line in its compose file to pull the tomicdd image. The copy gained roughly 1,100 stars on October 12 and 13, most of which later disappeared, a pattern consistent with purchased stars being purged.
The image carried a backdoor in the login handler. A hidden verifyCaptcha routine inspects the CAPTCHA field before validating any username or password. When the value begins with a secret marker, the routine passes the rest to sh -c as root inside the container and returns the output. An unauthenticated request yields a root shell, and in the logs it resembles a failed log-in. The implant makes no outbound connections and simply waits for incoming requests. The compromised build also reports no version string, so ARTEX's one-click updater refuses to replace it.
The image recorded 7,946 pulls before disclosure and more than 9,000 by the time Docker removed it on November 5. Between November 2 and 4, BadByte found 62 internet-facing consoles serving the backdoored build, the first visible by October 20, with 26 in the United States, 17 in Hong Kong, and 7 in China. BadByte also counted 637 GitHub repositories still pointing at the image. Removal stops new pulls and cleans nothing already running. Neither BadByte nor the Cloud Security Alliance ties the backdoor to any known threat actor, and no one has reported it being used.
An ARTEX console concentrates everything an intruder wants. ARTEX stores secrets in plaintext, so a shell in the container reaches the database superuser password, LLM and search API keys, engagement targets, harvested credentials, findings, intercepted traffic with the proxy's certificate authority key, the JWT signing key, and bot and webhook tokens. Whoever holds the backdoor inherits every target the console has touched and every key paying for its models. The CSA raises a further possibility, labeled as inference, of a backdoor altering agent behavior during later runs. Anyone who pulled the image, threat actor or penetration tester, has to treat the host and everything it held as compromised.
Every Motivation, One Framework
Microsoft's November 6 analysis names a new financially motivated user. Storm-3358, which Microsoft describes as a Cambodia-based intrusion activity cluster, began targeting financial organizations with ARTEX in October. Most of its targets sit in Southeast Asia, with a smaller number of large financial institutions elsewhere. Microsoft gives no victim count, and it does not tie Storm-3358 to Cambodia's scam-compound industry, so any such link remains speculation.
Storm-3358 pairs the agent with conventional tooling. It scans internet-facing systems and exploits anonymous file upload and server-side request forgery flaws. For persistence and lateral movement, ARTEX agents use netcat and curl to pull down the open-source remote access trojans WISP, vshell, and AdaptixC2. The activity cluster plants web shells on compromised web servers, harvests credentials from public sources including exposed secrets, and abuses compromised cloud identities to persist and exfiltrate data. Every indicator in Microsoft's table remained active as of November 6, including three WISP command-and-control nodes and four ARTEX servers.
Nothing on that list requires AI. Anonymous upload flaws, SSRF, open-source remote access trojans, and leaked secrets are ordinary eCrime tradecraft. What ARTEX changes is the rate. Microsoft describes agentic frameworks firing many varied requests in a short window, retrying variations of a technique, and moving to the next stage at machine speed.
In South Korea, the framework reached an individual. On October 26 the Seoul Metropolitan Police Agency announced it had identified seven suspects in a campaign against more than 90 organizations, according to BleepingComputer. The victims included hospitals, educational institutes, large corporations, and golf courses, and police believe about 8.2 million records were stolen. The alleged leader, a 32-year-old self-taught hacker, worked in penetration testing at a security company from 2019 to 2022. He started with a conventional web vulnerability scanner, then added an AI coding assistant and ARTEX. eSecurity Planet's account of the police findings puts the AI-assisted phase at 60 organizations breached in 44 days, between August 31 and October 13.
The Seoul campaign ran data theft extortion without encryption. The suspects demanded ₩360 million (about US$270,000) from 38 organizations, and when emails went unanswered, accomplices phoned and texted executives and employees. One victim paid ₩300,000 (about US$226). The stolen records included resident registration numbers, employee files, hospital consultation notes, and tutoring-school files holding minors' information. The leader was arrested on October 15 and referred to prosecutors, while the other six remain under investigation without detention.
In Japan, GMO Cybersecurity by Ierae traced breaches at Japanese companies back to attack infrastructure running ARTEX, confirming what victims' forensic logs had already suggested. The first infrastructure it examined targeted about 20 Japanese companies, nine of them sites in the same industry, and almost nothing outside Japan. Pursuing the pattern, GMO found six more AI-driven attack infrastructures aimed mostly at Japanese companies, each concentrated on particular sectors spanning digital gifts, retail, education, printing, marketing, insurance, finance, e-commerce, media, and logistics. GMO does not say all six ran ARTEX. Eight of the targeted companies had already announced data leaks in September or October, and GMO shared its findings with law enforcement.
GMO reads the pattern as campaigns cut by country and sector, with a separate attack host prepared for each. Two days after publishing, it appended a line deserving a place in every analyst's notes. The developer being a Chinese engineer has no bearing on who uses the software to attack. GMO's findings add context to the run of Japanese breach disclosures we examined last month, though GMO names none of the eight companies, so no individual disclosure can yet be tied to ARTEX. Its attribution caution applies everywhere else in this analysis.
India's CERT-In arrived at ARTEX from the defender's side. Advisory CIAD-2026-0058, issued November 4 with CERT-Fin, describes a previously undocumented threat actor it calls Crafty Falcon targeting digital lenders, fintech firms, payment aggregators, and cryptocurrency exchanges, and it names ARTEX, CyberStrikeAI, and Cairn among the tools observed. Initial access came through internet-exposed UAT, staging, and test environments. The threat actor then moved laterally over credentials, tokens, and network paths shared with production. It abused AWS Systems Manager and Lambda to run commands and deploy files, and it drained cryptocurrency wallets after stealing their keys.
Some of Crafty Falcon's victims had received a restricted warning in early October and were hit again after incomplete remediation. Attacks clustered on holidays, weekends, and other low-monitoring windows. Infosecurity Magazine's account of the advisory ties Crafty Falcon to no state or known adversary. The same account describes ARTEX as built on PentAGI, which conflicts with both Censys and GTIG, who document them as separate frameworks.
GTIG and Mandiant fill in the rest of the spectrum. They have observed threat actors operating ARTEX, PentAGI, CAIRN, and possibly custom harnesses inside Mandiant incident response engagements since late August. Those users include financially motivated threat actors running data theft extortion and additional suspected China-nexus activity clusters, and their operations hit government, technology, chemicals and materials, and manufacturing organizations in the United States. GTIG also notes forks keep spreading after the original repository came down, including a localized version called ScopeWeaver and a commercial edition called ARTEX PRO.
The state-aligned side keeps widening too. Pivoting on Storm-0940's infrastructure and tradecraft, Wiz found the threat actor attempting supply-chain compromises across other IT and software vendors, focused on Okta, Entra ID, and AWS Cognito and on abuse of Microsoft 365 integrations. According to GTIG, Wiz has since traced the campaign back to at least August, with victims in the United States and Europe across enterprise software, industrial automation, semiconductor manufacturing and design, and telecommunications. The threat actor typically moved from its first compromised account to deep system access in about four hours, and in one case in 15 minutes.
Machine Speed Leaves a Loud Trail
GTIG's logs show nothing like a silent, flawless machine adversary. Timestamps show ARTEX working in compressed bursts of roughly 2 to 25 seconds between longer pauses. In one operation it logged 27 events in 23 seconds of active burst time while probing AWS permissions across security groups. When a script failed as too large, it trimmed the script and relaunched it, deploying a 17-snapshot instance in about 10 seconds.
The same speed makes it clumsy. Handed valid credentials for an external-facing Weaver OA server, ARTEX reached partial command execution through the application's own SQL API and generated 240 log events doing it, with errors suggesting several sub-agents overwrote one another while chasing the same goal. It then repointed the MySQL general log at a web-accessible path and wrote JSP webshells through SELECT statements, iterating across incrementally named files until one returned clean output. In another intrusion it hijacked a legitimate notification feature to send test emails to more than 1,300 internal users before dropping back to single recipients.
Wiz watched the same relentlessness from the defender's side. The agent read each target application first, downloading JavaScript bundles, source maps, runtime configuration, and Swagger documentation, then called internal API routes by name minutes later. It password-sprayed Okta and Entra ID in bursts of 20 to 60 minutes with a median gap of one second between attempts, gave each burst its own user agent, and concentrated on software engineers. It fired more than 60 variations of SSO routes carrying an unsigned token in two minutes, ran sessions lasting 24 to 30 hours, and returned from fresh IP addresses within minutes of a block.
GTIG assesses adversary use of autonomous frameworks as still early, built on open-source tools used in low-sophistication ways, and describes the resulting campaigns as broad and noisy, but still successful. Noise is an opportunity defenders keep squandering. WorkOS had five days of agent traffic and caught it only after the bulk retrieval ended, because nothing measured request volume on an internal tool. Twenty-seven events in 23 seconds is a machine-speed pattern, but ordinary scripts can match it, so speed alone proves neither compromise nor an autonomous agent. The signal emerges when defenders correlate timing with the requests, failed operations, privilege changes, and data access inside the same session.
Microsoft warns blocking default user agents will not stop an agent able to change them, though spotting them can still alert defenders. Honeypots, decoys, tarpits, and fake wins pull autonomous attacks away from real targets. A fake win presents convincing evidence the objective is complete, which can cause the agent to stop on a false success. In Microsoft's testing, these controls reduced the traffic reaching real assets and produced high-confidence, attribution-quality signal. An agent built to chase every opening will chase a planted one too. The persistence making ARTEX dangerous also makes it easy to bait.
Defenders using Microsoft's own hunting content need one correction. The Sentinel query in Microsoft's Storm-3358 post lists 178.15.54.129, while its indicator table lists 178.16.54[.]129, an ARTEX server first seen October 19 and still active on November 6. Anyone running the query as published will miss the earliest-seen ARTEX server in the set.
Intent Is Invisible at the Edge
The developer tried to end this on October 8. ARTEX had appeared on GitHub in July and won Baidu's Agent+ red team challenge in September. A day after CrowdStrike's analysis, its developer Autumn-27 posted a statement denying involvement in the attacks and saying ARTEX was meant for testing within authorized scopes. Autumn-27 then announced the project would go closed-source with no further releases. The repository is gone. Archived copies, translations, and rebrands still circulate, and pulling the source stopped new downloads from one address while handing a poisoned replacement to anyone searching for another.
Since November 3, WorkOS has tested its own internet-facing systems with ARTEX, hunting for unnecessarily exposed systems and guessable credentials. The framework behind its breach now audits its perimeter. A tool able to find an exposed internal API and a predictable credential for a researcher, an extortionist, or a state-aligned adversary will find them for the defender first, provided the defender runs it first, and runs a clean build.
We assess with high confidence ARTEX now spans the full range of motivations, from state-aligned espionage and financially motivated intrusion to individual extortion and research gone wrong, so its presence in an environment says nothing reliable about who is behind it or why. Microsoft, GTIG, Wiz, GMO, CERT-In, the Seoul Metropolitan Police Agency, and WorkOS each documented a different user.
The installed base will keep growing despite the closed-source decision, a judgment we hold at moderate confidence. Forks, renamed builds, a commercial edition, and dozens of other Docker Hub namespaces keep the framework available, and the backdoored image shows distribution itself has become contested ground.
Near-term damage will concentrate on organizations exposing secondary infrastructure, internal tools, staging environments, and unmigrated legacy platforms guarded by weak or development credentials. WorkOS, Crafty Falcon's victims, and Storm-3358's exploitation of anonymous upload and SSRF flaws all fit the pattern, and GTIG's finding of low-sophistication, noisy use points the same way. Our confidence here is moderate.
Every thread in this analysis ends at the same kind of door. A researcher's benchmark opened one at WorkOS without meaning to. A former penetration tester in Seoul allegedly opened dozens to extort hospitals and schools. Storm-3358 found them at financial organizations in Southeast Asia, Crafty Falcon in Indian staging servers, unidentified attackers at Japanese companies sector by sector, and Storm-0940 at identity providers and software vendors working for a state. Someone even backdoored ARTEX itself and waited for the framework's own users to install the trap. Each left traces a defender could mistake for the others, down to a shared user agent.
Right now, an ARTEX agent is reading the JavaScript bundles of a server it discovered minutes ago. It will pull the source maps, call the internal routes by name, and try a password once a second, and it will keep going for a day and a half if nothing stops it. The server will never learn whether a ministry, an extortionist, or a researcher running benchmarks sent it. Neither will the analyst reading the logs the next morning.
Intent decides who faces consequences afterward. It decides nothing at the moment of intrusion. In that moment the only question with an answer is whether the door was left open, and at WorkOS it stayed open for five days with no adversary anywhere behind it. Every gap the agent used predates ARTEX. What has changed is how fast, and how tirelessly, something now comes looking for them.