CERT-EU warns that Artex-style agent frameworks are speeding up attacks
As of Nov. 11, 2026, CERT-EU is warning that attackers are using AI agent frameworks to automate large parts of multi-stage operations. The agency says this is producing attacks that are more frequent, faster, more scalable and more likely to succeed. Microsoft has reported Artex campaigns against financial organizations, according to Heise.
Artex was developed for authorized penetration testing, Heise reported. After reports that attackers were abusing it, its original author removed the repository in October 2026. Independent forks continue to circulate, and other frameworks such as Cairn are also available.
These frameworks allow a human operator to assign a broad objective, such as finding internet-facing weaknesses that could expose critical data or obtaining Domain Admin rights. An orchestrator agent divides the objective among other agents, which load and run tools, return their findings and receive the next tasks.
Heise described a workflow in which agents use BloodHound to map attack paths in Active Directory. They can then use tools such as Rubeus for Kerberoasting in an attempt to obtain Domain Admin rights. If one route fails, the orchestrator can search for alternatives and direct agents to evaluate them.
CERT-EU said the individual techniques are not new. The change is the speed at which the framework can carry them out and the number of operations attackers can coordinate at once. Heise reported that this can reduce the specialist knowledge required to run an attack and leave defenders struggling to keep pace.