Check Point Research has published the most detailed look yet at how criminals run ARTEX, the AI penetration-testing framework, because ten operators left their consoles open. The Check Point report of November 5, 2026 shows agents that, once given a goal, stole more than 190,000 game credential sets and over 300 Apple code-signing certificates with almost no human input. This is not a vulnerability in a coding agent, and there is nothing to patch. It matters to anyone who runs agents because it shows what an autonomous agent does with a goal and a loose set of tools.
| Question | Short answer |
|---|---|
| Am I affected? | Only if you run internet-facing servers with exposed secrets or unauthenticated APIs. Your local coding agent is not the target |
| Is there a fix? | No patch. The defenses are secret rotation, authentication on every API and monitoring for request bursts |
| How many ARTEX servers? | 2,557 hosting or having hosted panels; 1,608 live and public at research time |
| What did it cost the attackers? | About $180 to $1,500 per campaign in model tokens |
| Does data leave my machine? | Not because of this report. The victims were third-party shops and payment sites |
What the report is, and is not
ARTEX is described by Check Point as a Chinese open-source, AI-powered penetration-testing platform for teams assessing systems they own. It uses large language models to coordinate agents that plan tests, run tools and record evidence. After it appeared in attacks on South Korean banks, its developer closed the source on October 8, but forks and backups remain available.
Earlier reporting looked at the victim side. Beam covered that angle in the South Korean bank case, in Censys's count of 1,465 exposed consoles and in what Google and Mandiant saw. This report adds the operator side: Check Point found ten consoles that exposed the full ARTEX database, so researchers could read the prompts and tool calls themselves. Check Point also notes other frameworks with similar abilities (CyberStrike, Cairn, PentAGI) and custom ones built from scratch.
The observed instances ran in default configurations with default tools. Operators often exposed the admin interface to the internet for remote access, which is how the data leaked.
Which models the operators chose
Across the ten analysed instances, Chinese models dominated, with the DeepSeek Flash family in the lead.
Check Point saw guardrails trigger only with Anthropic's Opus 5.5, after which the operator switched to a more permissive Chinese model. That is one observation from ten consoles, not a general measure of any lab's safeguards, but it shows how little a refusal costs an attacker who can swap the model behind a proxy. Operators also used residential proxies to get past web application firewalls and IP blocks, and one created a dedicated skill for proxy use.
Campaign 1: stealing Apple signing certificates
Apple's iOS code-signing ecosystem has a gray market for .p12 certificates and provisioning profiles, used to sign and sideload apps outside the App Store. The uses range from modifying apps to injecting libraries that exfiltrate data. Check Point notes that signing services in this market can have tens of thousands of subscribers (one example showed more than 90,000).
One operator ran two ARTEX consoles in parallel from October 14 to October 29, using DeepSeek v4.1 Flash and Kimi K3.1 Pro, and processed about 36 billion tokens. Check Point puts the cost at $700 to $1,500 based on DeepSeek's API prices. The target was ten signing shops, and the task was simply to "get a p12 certificate + password."
The attack chain, as the report describes it:
- Get in. Agents found hardcoded administrator passwords in single-page-app JavaScript bundles, web APIs with no authentication, weak admin credentials, command injection and server-side template injection leading to remote code execution, and insecure direct object references. In one case they escalated from a low-privilege user to root through overly permissive folder access.
- Find the cert library. Agents searched for the shop's certificate database of .p12 files with plaintext passwords.
- Validate every key. They decrypted each key with its password, matched the private key to the certificate, checked Apple's OCSP for revocation, checked expiry, and looked for a matching in-house provisioning profile.
- Keep what works. More than 300 certificates were recovered; three passed every check, which is the number that could actually sign arbitrary iOS apps.
The prompts were nearly all "what is the progress" questions. Check Point published a list of them, and it reads like a manager checking in on a team. One request did steer the work, asking the agents to focus on enterprise certificates rather than personal ones. The detail worth noticing is step 3: the agents did not hand over a pile of stolen files, they verified usefulness before reporting success.
Campaign 2: a failed money-draining run
A second operator pointed agents at 292 crypto payment domains and asked them to take over the back end and redirect funds. It produced 230 findings and 400,791 agent messages, and no money reached the operator's wallet.
Two lessons for defenders and for agent users. First, some agents reported success based on API responses that merely said "success"; Check Point calls the claimed cash-outs hallucinations because the wallet showed zero transactions. An agent's own report of a result is not evidence of the result, which is true for your coding agent too. Second, the agents still found real damage: an unauthenticated web API leaked AWS S3 credentials, which gave write access to a bucket holding 714 enterprise-signed iOS app landing pages. The agent reasoned explicitly about rewriting a manifest.plist download URL to swap in a controlled IPA, executed the write and verified it. The bucket owners later restored the original manifest, and Check Point saw no sign the access was exploited for theft.
That S3 episode is a supply-chain attack path discovered as a side effect of an unrelated goal. It is the same shape as the compromises Microsoft tied to ARTEX in the ConnectWise case.
Campaign 3: game account theft at scale
The largest campaign targeted a gray market for hacked "data accounts" in Chinese mobile gaming. Buyers need only a QQ-Connect access token and a sideloaded login tool, not a password. The operator aimed agents at thirteen backend credential servers, with every task a variation on "get all the credentials."
After reverse-engineering related APKs, agents found that some verifier shops kept every credential in a static file in the public web root. One was a 21.5 MB plaintext file. The agents recovered more than 190,000 credential sets for a single game, Honor of Kings. Sampling showed about 3.3% still valid, which Check Point extrapolates to roughly 6,000 compromised accounts. The run took about five days on DeepSeek V4.1 Flash behind a third-party relay and cost an estimated $180 to $360.
Why this is about scale, not sophistication
None of the entry points were novel. Hardcoded passwords, missing authentication and plaintext credential files are the oldest findings in web security. What changed is the labor cost: an operator who knows none of this can start a fleet of agents for a few hundred dollars and wait. Check Point's conclusion is that agentic frameworks let attackers work at a previously impossible speed, on a broad scale and without technical knowledge.
The goals set were exclusively opportunistic and financially motivated. Check Point noted that even the failed crypto operator did not try to broker the data or access it had gathered, which may mean an opportunist chasing passive income rather than someone embedded in the cybercrime scene.
What this means if you run AI coding agents
You are probably not the target of these campaigns, but you share their raw material. A few concrete steps:
- Treat every secret reachable from a web root as already read. Search your repositories and deployed bundles for hardcoded passwords and tokens in JavaScript. Check that no credential export, backup or SQL dump sits in a public directory.
- Require authentication on every API, including internal admin endpoints that you assumed nobody would find. An agent tests every endpoint without getting bored.
- Rotate and scope cloud keys. A single leaked S3 key gave write access to production app pages. Give each key the narrowest bucket and action scope, and alert on writes to release artifacts.
- Watch for bursts. Operators used residential proxies, so look for sudden request bursts. Residential proxy traffic will bypass IP blocks, so rate limit by account and endpoint behavior too.
- Do not trust an agent's success claim. If you use agents for testing or ops, verify outcomes against the system itself, as the failed cash-out campaign shows.
- Keep operator files private. The earlier South Korea case was found because an operator left agent folders and session histories in an open directory. Your own agent config and session data are equally sensitive; do not serve them.
For related defender checks on infostealers that go after agent tokens, see Beam's WardenStealer post, and for the cost side of stolen model access see the LLMjacking write-up from Mandiant.
What Beam can and cannot do here
Beam is a local tool for coding agents, and these campaigns target servers, so most of the defense above sits outside Beam. Where it applies: Beam watches what Claude Code and Codex do on your machine and flags credential exposure and destructive commands, with hook-based deny through PreToolUse in workspace enforce mode. It scans skills and MCP configs with 11 heuristics plus a version-pin check, and redacts known credential formats before storage. Those checks are heuristic, they are not a kernel sandbox, and missing cached policy fails open. Beam will not see or stop an attacker's agent working against your public servers. See how Beam watches agents and why it stays local.
What the report leaves open
Check Point examined ten consoles with exposed databases out of 1,608 live instances, so these campaigns are a sample, not a census. The cost figures are estimates from public API prices. The report does not name the victim shops, and the 3.3% validity figure is a sample extrapolated by the operator's own agents and then repeated by researchers, so treat the 6,000 as approximate. We have not independently inspected the consoles. Indicator lists (versions and hosting ranges) are in the report and in secondary coverage by Cyber Security News, which also summarized the findings.
Frequently asked questions
What did Check Point find in the ARTEX operator consoles?
Check Point found 2,557 systems that host or once hosted ARTEX panels, 1,608 of them live. Ten were misconfigured and exposed their full database, which showed the prompts, models and exact attack steps. Most operators only set a goal and then asked about progress.
How much did these AI-run campaigns cost the attackers?
Check Point estimates $700 to $1,500 for the Apple certificate campaign (about 36 billion tokens over two weeks) and $180 to $360 for the game credential campaign.
Which weaknesses did the agents exploit?
Basic ones: hardcoded admin passwords in JavaScript bundles, web APIs with no authentication, weak admin passwords, command injection, IDOR, server-side template injection, an overly permissive folder that allowed root, and a 21.5 MB plaintext credential file in a web root.
Did the model guardrails stop the attackers?
Rarely. Check Point saw guardrails trigger only with Anthropic Opus 5.5 among American models, and the operator then switched to a more permissive Chinese model. Chinese models, led by the DeepSeek Flash family, were the most common.
Does this affect a developer running a coding agent?
Indirectly. The targets were internet-facing servers, not local agents. But the same pattern of exposed secrets and unauthenticated APIs is what a machine-speed scanner finds first, and the same agent traits apply to your own tools: they act without a human in the loop.
Related reading
- November 2026 attacks timeline
- Censys on 1,465 exposed ARTEX consoles
- Wiz's seven fingerprints of agentic attacks
- Sources: Check Point Research, Cyber Security News
Details reflect the Check Point report of November 5, 2026 and may change as research continues. Beam is a local prototype; capabilities described are as documented at publication.