Hackers use AI agents to get deep access in four hours

Google Threat Intelligence Group and its Mandiant unit say that hackers use ARTEX. This tool lets AI agents test networks and attack them. They have seen it since the end of August 2026. The hit firms work in software, industrial automation, semiconductors and telecom, in the US and Europe. Operators usually went from a first account to deep access in about four hours, and once in 15 minutes.

How it works

ARTEX divides a goal into tasks for six AI helpers. The helpers show user accounts, find cloud permissions, collect logins and write webshells (small tools for remote control). Each task is a few seconds long.

The numbers

On one web server, ARTEX made 240 log events, and many were errors. Wiz, a cloud security firm, saw sessions of 24 to 30 hours. Most tries did not work.

What is not known

The developer closed ARTEX on 8 October, but copies and forks stay. Google says the data shows noisy automation. It does not show an attack that is hard to see.

Insight: Closing a tool does not close the threat

Zscaler says one operator used ARTEX with Claude Code, Codex and Grok. The developer has closed ARTEX, but copies stay. This reads as a free tool that hackers can copy. Only the speed of defense stays with the target. Think about all agent tools, not one name.