The Pulse

Cisco Talos warns AI pentesting tools can speed intrusions

Cisco Talos says AI-enabled penetration testing frameworks can automate chains of intrusion activity with limited operator input. Its report examines ARTEX and other tools, alongside reported campaigns against organizations in multiple sectors.

AI.info Team · · fact-checked · against 1 source ↓ · Published 13 Nov 2026

AI-enabled penetration testing tools can automate chains of intrusion activity and lower the skills needed to carry them out when misused, Cisco Talos warned in a report published Friday. The security research group said it has observed frameworks that automate the full attack chain, drawing on security tools and outside services.

The report focuses on ARTEX, an open-source framework designed for authorized security testing, and describes how it has been associated with criminal and targeted intrusion campaigns. Talos also identified other frameworks that connect AI agents to tools for reconnaissance and vulnerability testing.

How the tools operate

ARTEX was published on GitHub in July 2026 by a developer using the pseudonym Autumn-27. An operator gives the framework a target and an objective; a planner agent divides the work into tasks, while worker agents use security tools and record findings and progress in a shared graph.

The framework can use different large language models and requires relatively little operator input once a task begins, according to Talos. It does not come bundled with a traditional command-and-control framework, although operators can add compatible tools through its Model Context Protocol extensibility layer.

Talos said it had observed ARTEX deployed alongside tools including VShell, GoPhish and AdaptixC2. The group also described frameworks using internet mapping, CAPTCHA bypass, credential leak management, residential proxy and hash-cracking services.

Other frameworks work through different interfaces. Hephaestus is a command-line tool that can be deployed with a single script on a virtual private server and controlled through Telegram, while PentAGI has a web interface for monitoring agent activity and attack chains.

Talos found more than 700 currently reachable PentAGI instances on the internet. HexStrike AI integrates with clients including Claude Code and VS Code, as well as other clients supporting the Model Context Protocol.

Campaigns and limits of the evidence

According to Talos, CrowdStrike attributed an espionage campaign beginning on October 17 to the China-nexus actor VAPOR PANDA and said the group used ARTEX against more than 200 organizations in at least 14 countries. Targets included government ministries and organizations in telecommunications, defense, pharmaceuticals, semiconductors, nuclear and financial services.

CrowdStrike confirmed post-compromise activity at nine organizations and reported credential-scanning and password-spraying activity against at least 12 others, Talos said. The target count therefore encompasses more than confirmed compromises.

Microsoft attributed another ARTEX-driven campaign to Storm-0940, which it assesses as a China-state-aligned actor, according to the report. After ConnectWise application credentials were compromised, the actor used ARTEX to accelerate sign-in attempts against more than 2,250 downstream Microsoft 365 tenants, with follow-on activity involving Microsoft Graph, application credentials and privilege changes.

Talos also examined actor-associated directories used in a campaign against South Korean financial organizations that CrowdStrike reported as unattributed; CrowdStrike assessed with moderate confidence that the actor was Chinese-speaking and financially motivated. The directories contained ARTEX-related artifacts, including references in prompt history, but not the executable or source tree.

Those artifacts support an association with an ARTEX environment but do not by themselves prove that the complete framework was present or used in a successful attack, Talos said. It cautioned that observed behaviors vary between campaigns rather than forming a single fixed playbook.