Security
FBI ARTEX Warning: Five Checks for Your IT This Week
The FBI ARTEX warning means attackers can now find your weakest system in hours, not weeks. Five checks on your IT, your vendors and Microsoft 365 close most of the doors it uses.
Capital Cyber. Sources are listed at the end of the article.
What did the FBI ARTEX warning say?
On November 13, 2026, the FBI put out a flash alert on ARTEX. It is an AI tool built for security testing that criminals have turned into a weapon.
ARTEX is an open source program that runs attacks with AI agents. A person types a goal, and the agents scan, test and break in on their own.
The FBI says criminals have used it since at least August 2026. Victims span finance, health care, manufacturing, legal work, energy and more.
Some attacks reached admin access in under three hours. The FBI also says the tool lets people with little skill run attacks on many targets at once.
Why should a small business care about an AI attack tool?
Because it hunts for the things small firms forget. The FBI says ARTEX is very good at finding side systems that get less attention.
Think of an old supplier portal, a test website or a remote login nobody tracks. Those are the doors it tries first.
It also goes through trusted vendors. In one case reported by Microsoft and cited by the FBI, attackers used a backup provider's access. That reached more than 2,250 customer tenants.
Your IT vendors, backup tools and apps connected to Microsoft 365 are part of your attack surface. Most owners never look at them.
What are the five checks to run this week?
These follow the FBI's own advice, in plain terms.
- List everything you have online. Include old portals, test sites and any app a vendor set up for you.
- Lock down admin pages. Remote access, firewall and backup consoles should not be open to the whole internet.
- Review apps connected to Microsoft 365. Remove any you do not use, and check what the rest are allowed to read.
- Watch for new keys and admins. Get an alert when someone adds a password to an app or makes a new admin.
- Clean secrets out of code. Passwords left in website code or scripts are one of the ways in the FBI saw.
How do I know if my Microsoft 365 is exposed?
Look at the apps and service accounts that can sign in without a person. The FBI asks firms to review Microsoft Entra audit records.
Check for new app passwords, new owners, new admin roles and changes to sign-in rules. Review both successful and failed sign-ins by those apps.
If you used ConnectWise cloud services, the FBI asks you to review activity from at least October 1, 2026. Keep the logs before you change anything.
What if we find something?
Save the evidence first. Then remove the access that should not be there.
The FBI says not to delay urgent steps while you wait for log exports. But do not delete apps as your first move, because that can erase what you need.
Report it to your local FBI field office or to ic3.gov. Tell your cyber insurer too.
Write down what you found, when you found it and who you told. Your insurer and the FBI will both ask. Notes made in the moment are far better than memory a week later.
Can a managed security provider help with this?
Yes. Most small firms do not have a person who checks these logs every day. That gap is exactly what a fast AI attack uses.
A managed security team watches sign-ins and alerts around the clock. It also tracks your vendors' access and runs these checks on a schedule, not once after a scare.
A pen test adds proof. It shows which doors an attacker can really open, so you fix the right ones first.
Want a second set of eyes on these five checks? Book a 30 minute call with us below.
Frequently Asked Questions
5 QUESTIONSWhat does the FBI ARTEX warning mean for my business?
It means AI tools now let attackers find and use simple gaps in hours. Small firms are on the target list. List your online systems, lock down admin pages, review Microsoft 365 apps, watch for new admins and remove passwords from code.
What is ARTEX?
ARTEX is an open source AI attack platform that runs a penetration test on its own. It was built for approved testing. The FBI says criminals have used it since at least August 2026, and copies still spread after its creator took it down.
Does antivirus stop ARTEX attacks?
Endpoint protection helps but does not stop them alone. The FBI saw endpoint tools block some moves inside networks. ARTEX often gets in through web apps, weak admin logins and vendor access, which antivirus on a laptop does not see.
How fast can an AI attack tool break in?
The FBI says some ARTEX attacks went from first contact to admin access in under three hours. That leaves little time to react, so alerts need someone watching them every day.
Who do I report an ARTEX attack to?
Report it to your local FBI field office or the FBI Internet Crime Complaint Center at ic3.gov. Save your logs first. Tell your cyber insurer and your IT provider the same day.
Sources
READ 2026-11-13- FBI FLASH-20261113-001, Threat Overview of ARTEX Autonomous Penetration Testing Framework (PDF)
- Infosecurity Magazine, ARTEX Offensive AI Tool Activity Far Exceeds Reported Campaigns, Censys Finds
- Help Net Security, ARTEX goes from pentesting tool to attacker staple in three months
This article explains the regulations and is not legal advice.
Talk it through in 30 minutes.
A call is a conversation, not a pitch. Tell us how your business runs and we will tell you what we would manage.
Looking for CMMC? Our Compliance Division, Capital Cyber Compliance, delivers it.
Under 25 people? Apply for an in-kind cybersecurity grant from Cyber Grants Alliance, a nonprofit. No cost to you.