Check Point's ARTEX report: AI agents ran cybercrime campaigns almost on their own

On 5 November 2026, Check Point Research (CPR) published a detailed look at ARTEX, an open-source AI penetration-testing tool that criminals are using to run attacks with very little human input. Misconfigured attacker servers let CPR read the operators' own prompts, model settings and agent logs, which makes this one of the clearest public views so far of AI agents doing real cybercrime.

What ARTEX is

ARTEX was built as a legitimate tool for system owners and authorised testers. Large language models coordinate several software agents that plan a test, run standard security tools and record evidence of weaknesses, all shown on a web dashboard. CPR says the developer made the project closed-source in October after reports of attacks on banks, but copies and forks remain public.

CPR counted 2,557 servers that hosted or had hosted an ARTEX panel, 1,608 of them live and reachable during the research. Ten were misconfigured badly enough to expose their full databases.

What the attackers did

According to CPR, once an operator set a goal, most attacks ran almost fully on their own. Operators mostly asked the agents how things were going or handed them new targets. CPR describes three campaigns:

• Stealing app-signing certificates. Over about two weeks in October, one operator aimed the agents at ten grey-market shops that sell Apple iOS signing certificates. The agents recovered more than 300 certificates and passwords, of which three passed CPR's validity checks. They got in through everyday flaws: admin passwords left in website code, web APIs with no login, weak admin credentials and command-injection bugs. CPR estimates the AI cost of the whole run at $700–$1,500.
• A failed attempt to drain crypto wallets. Across 292 targets and more than 400,000 agent messages, the agents found real weaknesses, including database dumps and exposed personal data, but no money moved. In one wave the agents reported success that wasn't real: they judged a theft from a "success" reply from the target's API, while the wallet stayed empty.
• Taking over game accounts. The agents attacked 13 servers that store logins for resold mobile-game accounts and pulled more than 190,000 credential sets. From a sample, CPR estimates about 6,000 accounts were still usable.

Which AI models were involved

CPR found that Chinese models, mostly DeepSeek's Flash family, dominated the exposed setups. American models appeared on three instances. CPR reports that guardrails triggered only with Anthropic's Claude Opus 5.5, after which the operator switched to more permissive models. Under ARTEX's "pentest" framing, CPR saw no guardrails from the other models.

Who should care

Any business with a public website, customer portal or API. None of the targets here were hit by exotic techniques. The agents simply tried common weaknesses at a scale and price no human team could match: a few hundred to a couple of thousand dollars per campaign, by CPR's estimates.

Limits and caveats

• All figures are CPR's own telemetry and estimates, drawn from ten exposed attacker servers. They show what these operators did, not the full scale of AI-driven attacks.
• The report itself is inconsistent in places, for example citing both 1,608 and "more than 1,800" exposed instances, and two different dates for when the original project was pulled.
• Agents also produced false findings. Automated attackers are noisy, which is useful for defenders who log well.
• CPR gives little specific advice beyond testing and hardening anything exposed to the internet.

What to do this week

• Search your front-end code and public JavaScript files for hardcoded passwords, keys or admin credentials. This was the easiest way in for the agents.
• List every public API and check that each one requires authentication and only returns the caller's own data.
• Turn on rate limits and alerts for bursts of failed logins and unusual API calls, including from residential IP ranges, which these operators used to get past blocks.
• Rotate any cloud storage keys that have ever appeared in code or responses, and make sure storage buckets can't be overwritten from outside.
• Book an authorised penetration test of your public perimeter, since attackers are now running one for free.

The DevDrift builds AI agents for business with approvals and audit trails, and the same thinking applies to defending against them.

Sources

• Check Point Research: Hacking on Autopilot: Inside ARTEX Cybercrime Campaigns