When AI Attacks Itself: ARTEX Agents Stole LLM Credentials to Fund More AI-Powered Attacks
Executive Summary
Executive Summary Between October 3 and November 5, 2026, Amazon Threat Intelligence's MadPot sensor network captured evidence of Chinese-nexus threat actors conducting sustained, multi-objective offensive campaigns using ARTEX, an open-source agentic AI penetration testing framework. Two primary campaigns were identified: a large-scale credential theft operation targeting AI model API keys across platforms including LiteLLM, Langflow, and Dify—exploiting CVEs and default credentials to build a self-funding stolen-key pool—and a deepfake-driven identity fraud campaign targeting cryptocurrency exchange KYC verification systems. The campaigns operated with minimal human intervention, leveraging planner, worker, verification, and compression agents sharing a persistent knowledge graph.
These incidents mark a documented inflection point in offensive cyber operations: agentic AI frameworks have moved from experimental use to sustained, financially motivated campaigns running autonomously at industrial scale. The self-sustaining credential theft loop—where stolen AI keys fund further AI-powered attacks—represents a novel threat model that invalidates traditional assumptions about attacker resource constraints and operational tempo.
Why This Matters Now
Why This Matters NowAgentic AI has collapsed the cost and skill barrier for persistent, multi-stage attacks. Organizations running AI gateways, LLM inference endpoints, or crypto KYC systems face autonomous adversaries that operate 24/7, self-fund through stolen credentials, and exploit misconfigurations within hours of exposure. Regulatory pressure around AI security governance (NIST AI RMF, emerging EU AI Act requirements) makes this a board-level risk in 2026.
Attack Path Analysis
Attack Path AnalysisChinese-nexus threat actors deployed ARTEX agentic AI frameworks to conduct large-scale credential theft and KYC fraud campaigns beginning in October 2026. Agents autonomously scanned internet-exposed AI application platforms, exploited known CVEs and misconfigurations to extract API keys and cloud credentials, escalated privileges through enumeration of cloud IAM and managed AI services, pivoted across provider ecosystems via stolen credentials, communicated through legitimate LLM inference endpoints and proxy chains, exfiltrated harvested credentials into a self-sustaining key pool, and ultimately achieved unauthorized AI model consumption and cryptocurrency fraud as the operational end-state.
Kill Chain Progression
Kill Chain ProgressionThis analysis maps confirmed threat intelligence to the full cloud kill chain to show where defensive gaps would emerge as an attack progresses.
Initial Compromise
Description
DescriptionARTEX planner and worker agents scanned internet-exposed AI application platforms including LLM gateways (One API, New API, LiteLLM, Veloera, Sub2API), AI application builders (Dify, FastGPT, Langflow, RAGFlow, Open WebUI, LobeChat, Ollama), and public artifact sources (GitHub, npm, PyPI, container image layers, paste sites, Telegram). Agents exploited CVE-2025-3248 (Langflow RCE), CVE-2026-28797 (RAGFlow auth bypass), authentication bypass via isCliRequest header in One API family, uninitialized installs claimable without credentials, anonymous management endpoints, default administrator credentials such as the LiteLLM default master key, and secrets exposed in client-side JavaScript, source maps, debug routes, and environment files. The CNSF Cloud Native Security Fabric capability, with its inline enforcement and AI discovery of traffic against agentic AI risk and shadow AI keyword patterns, could have detected and blocked automated reconnaissance and exploit traffic at the network perimeter before initial access was achieved.
Related CVEs
Related CVEsCVE-2025-3248
CVSS 9.8A remote code execution vulnerability in Langflow that allows unauthenticated attackers to execute arbitrary code on affected installations, exploited by ARTEX agents as part of automated credential harvesting against AI application platforms.
Affected Products:
DataStax / Langflow Project Langflow – < 1.3.0
Exploit Status:
exploited in the wild
MITRE ATT&CK® Techniques
MITRE ATT&CK® TechniquesValid Accounts
Unsecured Credentials
Unsecured Credentials: Credentials In Files
Cloud Service Dashboard
Cloud Infrastructure Discovery
Compromise Accounts
Adversary-in-the-Middle
Obtain Capabilities: Tool
Exploit Public-Facing Application
Data from Cloud Storage
Acquire Infrastructure: Malvertising
Multi-Factor Authentication Request Generation
Serverless Execution
Gather Victim Org Information
Search Open Technical Databases
Search Open Websites/Domains
Steal Application Access Token
Impair Defenses
Proxy
Financial Theft
Potential Compliance Exposure
Potential Compliance ExposureMapping incident impact across multiple compliance frameworks.
PCI DSS 4.0 – User Identification and Authentication Management
Control ID: Requirement 8.2 / 8.3
NYDFS 23 NYCRR 500 – Access Privileges and Training / Monitoring
Control ID: Section 500.7 / 500.14
DORA (Digital Operational Resilience Act) – ICT-Related Incident Detection and Response / ICT Third-Party Risk Management
Control ID: Article 10 / Article 17
CISA Zero Trust Maturity Model 2.0 – Least Privilege Access and Continuous Validation of Identity
Control ID: Identity Pillar: Advanced / Optimal — Application & Workload Pillar
NIS2 Directive – Supply Chain Security, Vulnerability Handling, and Access Control
Control ID: Article 21 — Cybersecurity Risk Management Measures
ISO/IEC 27001:2022 – Privileged Access Rights / Secure Authentication / Protection Against Malware
Control ID: Annex A 8.2 / 8.5 / 8.7
Sector Implications
Sector ImplicationsIndustry-specific impact of the vulnerabilities, including operational, regulatory, and cloud security risks.
Financial Services
AI-driven KYC deepfake bypass and credential theft targeting cryptocurrency exchanges expose financial services to identity fraud, cloud account takeover, and compliance failures under PCI 4.0 and NIST.800-53 controls.
Information Technology/IT
ARTEX agents exploited LLM gateways, AI platforms, and unpatched CVEs including Langflow and RAGFlow, enabling mass API key theft and cloud privilege escalation across enterprise IT infrastructure with minimal human intervention.
Internet
Internet-exposed AI inference endpoints, LLM proxy platforms, and aggregator gateways were systematically targeted for credential harvesting, requiring egress enforcement, zero trust segmentation, and multicloud visibility controls per ZTMM frameworks.
Computer/Network Security
Agentic AI offensive frameworks executing autonomous reconnaissance, lateral movement, and exfiltration campaigns directly challenge security operations, demanding cloud-native enforcement, anomaly detection, and inline IPS capabilities mapped to NIST.CSF.DE controls.
Sources
Sources- Amazon Threat Intelligence observes threat actors running cybercrime campaigns with ARTEX AI agentshttps://aws.amazon.com/blogs/security/amazon-threat-intelligence-observes-threat-actors-running-cybercrime-campaigns-with-artex-ai-agents/Verified
- CVE-2025-3248 Detail - NVDhttps://nvd.nist.gov/vuln/detail/CVE-2025-3248Verified
- CISA Known Exploited Vulnerabilities Cataloghttps://www.cisa.gov/known-exploited-vulnerabilities-catalogVerified
- Langflow Security Advisory - Remote Code Executionhttps://github.com/langflow-ai/langflow/security/advisoriesVerified
- AWS MadPot: Threat Intelligence Sensor Network Overviewhttps://aws.amazon.com/blogs/security/how-aws-threat-intelligence-protects-customers-with-madpot/Verified
- AI-Powered Cyberattacks: Agentic Frameworks in Offensive Operationshttps://www.wired.com/story/ai-agents-hacking-cybercrime/
Frequently Asked Questions
Frequently Asked QuestionsCloud Native Security Fabric Mitigations and ControlsCNSF
Based on the attack progression modeled above, these are the defensive controls that would constrain each stage.
Aviatrix Zero Trust CNSF is directly relevant to this incident because ARTEX agents depended on unrestricted network reachability to scan exposed AI platforms, replay stolen credentials across provider ecosystems, and exfiltrate harvested key pools to attacker infrastructure. By enforcing segmentation, identity-aware routing, and controlled egress across the cloud environment, CNSF would likely have reduced the attacker's ability to pivot freely and limited the blast radius of each compromised credential.
Control: Cloud Native Security Fabric (CNSF)
Mitigation: Inline enforcement with AI-driven traffic discovery would likely reduce the reachability of exposed AI application endpoints to unauthorized external sources, constraining automated exploit traffic before agents could successfully extract credentials from vulnerable services.
Control: Zero Trust Segmentation
Mitigation: Identity-based microsegmentation policies would likely constrain the ability of compromised application workload credentials to reach IAM enumeration endpoints or secrets store APIs, reducing the scope of privilege discovery that ARTEX agents could perform after initial credential extraction.
Control: East-West Traffic Security
Mitigation: East-west traffic enforcement across workload and service boundaries would likely reduce the ability of stolen credentials to be replayed across interconnected AI platform services, constraining how freely agents could traverse from one compromised tenant or aggregator account into downstream provider environments.
Control: Multicloud Visibility & Control
Mitigation: Centralized multicloud traffic observability would likely surface the unusual volume and structure of LLM API calls originating from compromised workloads, reducing the time attacker command and control activity could persist undetected across cloud environments, and FQDN-based egress controls could constrain outbound paths to unauthorized proxy destinations.
Control: Egress Security & Policy Enforcement
Mitigation: FQDN filtering and outbound traffic controls would likely reduce the ability of compromised workloads to transmit graded credential inventories and synthetic media artifacts to unauthorized external destinations, constraining the volume of usable keys and KYC bypass materials that could reach attacker infrastructure.
Where prior CNSF controls reduced credential exfiltration scope and constrained lateral credential replay, the attacker's ability to sustain the self-funding key pool would likely be diminished, reducing the volume of active credentials available to power further AI model consumption and limiting the KYC fraud campaign's operational scale.
Impact at a Glance
Affected Business Functions
- AI Model API Access and Inference Services
- Cloud Identity and Access Management (IAM)
- Cryptocurrency Exchange KYC and Identity Verification
- Secrets Management and Credential Stores
Estimated downtime: N/A
Estimated loss: N/A
Large-scale exfiltration of AI model API keys and cloud credentials across enterprise production environments, including credentials for LLM gateways such as LiteLLM, One API, New API, Veloera, Sub2API, and AI application builders including Dify, FastGPT, Langflow, RAGFlow, Open WebUI, LobeChat, and Ollama. Cloud credentials enabled enumeration of storage, IAM permissions, managed AI services, secrets stores, and application identities. Additionally, forged identity documents and synthetic biometric data were generated to bypass KYC checks at cryptocurrency exchanges, risking financial account fraud at scale. Stolen credentials sourced from GitHub repositories, npm and PyPI packages, container image layers, notebooks, model-hosting spaces, paste sites, and Telegram channels spanning hundreds of targets. The aggregate credential pool was actively recycled to fund further automated attacks, creating a self-sustaining theft loop with ongoing financial impact to affected API providers and downstream customers.
Recommended Actions
Key Takeaways & Next Steps
- • Apply CNSF Cloud Native Security Fabric inline enforcement and AI-aware traffic inspection to detect and block agentic AI reconnaissance patterns, shadow AI endpoint abuse, and automated exploit sequences targeting LLM gateways and AI application platforms before initial access is achieved.
- • Enforce Zero Trust Segmentation with least-privilege identity-based policies and microsegmentation (ZTMM.Network, NIST.800-53.AC-6) to prevent compromised application credentials from reaching IAM enumeration APIs, secrets stores, or managed AI services, limiting privilege escalation blast radius.
- • Deploy Multicloud Visibility and Control with centralized traffic observability and anomaly baselining (ZTMM.CrossCutting.Visibility, NIST.800-53.AU-6) to surface suspicious automation patterns, unusual LLM API call volumes, and cross-tenant credential replay that indicate active ARTEX-style agentic campaigns in progress.
- • Implement Egress Security and Policy Enforcement with FQDN filtering and outbound traffic controls (ZTMM.Data, NIST.CSF.PR.DS-5) to block connections from AI workloads to unauthorized proxy destinations, undeclared inference endpoints, and exfiltration channels used to drain harvested credential pools.
- • Bring all AI application platforms, LLM gateways, and inference endpoints under the same production security controls as other workloads: eliminate default credentials, patch CVE-listed vulnerabilities (e.g., CVE-2025-3248, CVE-2026-28797) immediately, remove secrets from public artifacts and client-side code, and instrument unexpected AI service spend as a high-priority security signal.
