Datadog Security Labs tied in-the-wild ARTEX activity to AWS control-plane abuse in October and November 2026—anonymous S3 reads, FilterLogEvents searches for financial strings and long-lived access keys, and noisy self-registration on public Amazon Cognito user pools. On November 12, Dark Reading's expert roundup reached the same conclusion defenders already heard from Unit 42, Arctic Wolf's AntiFox pack, and GitGuardian's framework catalog: the frameworks are loud, the playbook is mostly credential and workflow abuse, and blocking scanner user agents alone does not end the risk.
If you run Claude Code, Codex, or MCP-heavy workflows on laptops that also hold AWS keys, staging OpenAPI maps, or Cognito test pools, this post is about what attackers automate once a key leaks—the same secrets your agent might read during a refactor.
TL;DR
| Question | Answer |
|---|---|
| Am I affected? | Yes if you operate AWS accounts with long-lived IAM keys, public Cognito sign-up, or S3-hosted app configs—ARTEX and forks like AntiFox hunt those paths at machine speed. |
| Is there a fix? | No product patch. Rotate exposed keys, disable unneeded public Cognito pools, scope IAM, and hunt CloudTrail for ARTEX user agents and FilterLogEvents bursts. |
| Does data leave my machine? | ARTEX consoles and AntiFox hosts are attacker-controlled; compromised keys and logs are queried in your AWS account. Local coding agents do not cause that—leaked material in repos and configs does. |
| What is new in Datadog's post? | AWS-specific hunting detail: anonymous S3 prelude, constant FilterLogEvents limit of 1000, Cognito PreSignUp error strings, and a published IOC table (artex-pentest/1.0, Mozilla/5.0 ARTeX, hosting ASNs). |
| What did Dark Reading add on November 12? | Vendor quotes reinforcing hygiene: GitGuardian's Guillaume Valadon on SIEM coverage, Arctic Wolf's reminder to revoke not just rotate assumptions, and researchers noting ARTEX's noise where EDR exists—not new exploits. |
| What should I run today? | CloudTrail queries for IOC user agents, review Cognito pool policies, cross-check Mandiant's five layers, and audit local agent access to credential files. |
Why another ARTEX post now
Beam already covered Unit 42's exposure counts and behavioral table, AntiFox IIS-to-AWS chains, and Wiz's agentic fingerprints. Datadog's November 9, 2026 article is the missing AWS telemetry slice: what shows up in CloudTrail after ARTEX—not just identity-provider abuse, but log hunting inside your account once a long-term key works.
Dark Reading's November 12 piece is not a primary technical source—the site returned 403 to automated fetch during this run—but its reporting paraphrases Arctic Wolf, GitGuardian, and A Security benchmark claims that align with published primaries. We cite it for defender consensus timing, not for versions or IOCs.
Inside the ARTEX platform (per Datadog)
Datadog describes ARTEX as a hosted console where operators supply LLM API keys (OpenAI-compatible, Responses API, or Anthropic-shaped endpoints) and a target. A planner dispatches workers—three at a time by default—while a blackboard graph records tasks, goals, intents, facts, and findings. Operators can set allow/deny command interception rules and asset blocklists (Datadog notes default exclusions for .gov and .edu zones in some builds).
Relevant API surface for hunters includes routes such as /tasks, /exploration/findings, /exploration/graph, /traffic, /llm/pool, and /mcp. Datadog found hundreds of internet-facing consoles sharing Chinese-language login titles and English renames (ScopeWeaver, LUCK, Guanlan SEC). That matches Unit 42's internet exposure denominators and Censys ARTEX console research from earlier in November.
Image: Datadog Security Labs
Datadog also documents operator provider failover: when one inference key is cut off, ARTEX moves to the next provider in the pool—meaning a single intrusion can touch multiple model vendors in one campaign. That is a procurement and API-key hygiene problem for blue teams running authorized red-team stacks, not only for criminals.
Attack chain 1: Long-term keys and CloudWatch hunting
After compromise of a long-term IAM access key, Datadog saw ARTEX's most frequent action as FilterLogEvents against CloudWatch Logs. Search strings combined cryptocurrency and hedge-fund naming conventions with terms like Fund, Invoice, Billing, and LLC—a direct financial-data objective.
On October 20, Datadog tied the same key to traffic from 103.54.154[.]40 (associated with zeofast[.]cn in the post). The session widened to hunt S3 URLs, presigned links, spreadsheets, mongo connection hints, internal RFC1918 addresses, passwords, and AKIA patterns, plus error emoji strings in logs—behavior consistent with automated secret triage rather than human browsing.
Every FilterLogEvents call in reviewed sessions used limit: 1000, below the API maximum of 10,000—a stable fingerprint defenders can aggregate across accounts.
Prelude behavior: Before key abuse, Datadog saw unauthenticated S3 GetObject / ListObjects with CloudTrail userIdentity.type AWSAccount and accountId anonymous. ARTEX also probes with placeholder object keys (zzz_nonexistent_abc.txt, Notexist-xyz) to learn 404 versus 403 shapes—the same pattern Wiz documented on web apps.
What developers should query
Run organization-standard CloudTrail analytics (SIEM, Athena, or vendor rules) for:
userAgentvalues from Datadog's IOC appendix:artex-pentest/1.0,artex-readonly/1.0,Mozilla/5.0 ARTeX,ARTEX-worker/1.0, and related strings—knowing operators can rename them, but many campaigns do not bother.- High-volume
AccessDeniedacross services from a single principal—Arctic Wolf's AntiFox guidance warns that successfulGetSecretValuecalls hide inside denied bursts. FilterLogEventswith limit 1000 spikes on financial orAKIAsearch terms from non-console IPs.- Anonymous S3 reads immediately before authenticated enumeration.
Datadog links its own Cloud SIEM rules for AccessDenied anomalies, S3 enumeration, and Secrets Manager retrieval—including rules such as AWS Cloudtrail possible secret enumeration in multiple regions and secret retrieval and Enumeration from multiple regions using a long-term access key failed. Treat those as examples, not endorsements; any SIEM with CloudTrail ingestion can encode the same logic.
Attack chain 2: Public Cognito pools
Where no long-term key existed, Datadog observed ARTEX self-registering against public Cognito user pools. Wiz's earlier reporting covered account-recovery abuse; Datadog adds SignUp iteration noise when a PreSignUp Lambda enforces tenant domains—errors like Invalid tenant domain: api.github.com and malformed custom:isAdmin attributes litter the trail.
On October 26–27, traffic from 154.64.252[.]77 included SignUp calls with user agents such as Mozilla/5.0 ARTeX. After registration, ARTEX walked InitiateAuth, RespondToAuthChallenge, GetUser, GetTokensFromRefreshToken, then attempted nearly every read-only discovery API (ListBuckets, ListSecrets, DescribeLogGroups, ListFunctions20150331, and more). In the cited session, all calls failed because the identity pool role lacked permissions—but the attempt pattern is the detection story.
For application teams, the mitigation is blunt: do not expose self-service Cognito sign-up to the open internet unless a human-reviewed business case requires it. Pair with rate limits, CAPTCHA, and MFA on privileged roles—the same controls Mandiant's ARTEX defense layers emphasize for exposed workflows.
Image: Datadog Security Labs
What Dark Reading's experts emphasized (November 12)
Dark Reading's "Cyber Experts Weigh In: How to Fight Artex & AntiFox" piece—sourced from Nate Nelson, November 12, 2026—does not introduce a new fork or CVE. It synthesizes what primaries already prove:
- GitGuardian's Guillaume Valadon argues blue teams need a SIEM and strong detection to catch ARTEX's volume—matching GitGuardian's point that blocking scanners does not revoke leaked keys.
- Arctic Wolf's public guidance on AntiFox, already detailed in our AntiFox breakdown, repeats IOC hunts, session revocation, and credential rotation rather than exotic appliance purchases.
- A Security CTO Yuval Itzchakov told Dark Reading ARTEX chained eight benchmark vulnerabilities in ~45 minutes in their lab—a vendor anecdote useful for leadership briefings, not a substitute for CloudTrail evidence in your tenant.
Dark Reading also quotes researchers describing ARTEX as "stopping at the front door" without built-in lateral movement in some configurations, while Datadog's captured demo engagement on exposed consoles still walks external-to-AD paths in sample data. Treat marketing consoles' demo graphs as capability advertisements, not proof every criminal campaign achieves domain compromise.
Microsoft's October 2026 Storm-0940 analysis—cited by Datadog—links ARTEX to China-aligned activity beyond AWS alone. Your hunt scope should include Okta, Entra, and app-layer logs, not only AKIA patterns.
What this means if you run AI coding agents
ARTEX does not install inside Claude Code or Codex. The overlap is credential adjacency:
- Long-lived keys in git,
.env, orweb.configare what ARTEX and AntiFox automate against once a web tier or leaked clone exposes them—the same files agents read when you ask for "fix AWS deploy" or "rotate secrets in repo." - Agent speed amplifies blast radius on the defender side too—Railway's October incident showed how fast stolen keys move when attackers run agent loops; your benign agents can accidentally copy those keys into tickets, logs, or branches if policy is loose.
- Cognito and S3 misconfigurations in apps you maintain are in scope even if you never run ARTEX yourself—ARTEX is one consumer of mistakes your coding agent might also discover during an audit task.
Concrete checks today:
# Keys your laptop agent can read—rotate if exposed anywhere public
aws iam list-access-keys --user-name "$(aws sts get-caller-identity --query Arn --output text | awk -F/ '{print $NF}')"
# npm/pip agents do not need production AKIA in project roots
grep -r 'AKIA[0-9A-Z]{16}' . --exclude-dir=node_modules 2>/dev/null | head
Replace grep with your org's secret scanner in CI; the point is find long-term material before an ARTEX operator does.
On Cognito, audit pools with self-registration enabled and no MFA on privileged downstream roles. On CloudTrail, enable data events for sensitive buckets if your budget allows—anonymous S3 reads are easy to miss on management events alone.
How Beam handles this
Datadog Cloud SIEM and misconfiguration rules watch AWS control planes from the cloud. Beam is local observability for coding agents on your workstation: it records tool proposals, heuristically scans skills and MCP configs (11 patterns plus MCP version-pin checks per Beam docs), and with enforce policy can emit PreToolUse denies for Claude Code and Codex—not a verified block on every harness.
Where the products meet: Beam helps when your agent tries to cat a production .env, pipe curl | bash from a skill, or paste a key into chat. It does not see ARTEX hitting Cognito in another account or FilterLogEvents in CloudWatch. Use cloud SIEM for ARTEX IOCs, Beam for local agent behavior on the machine that holds clone credentials. Beam is heuristic, not kernel sandboxed, and fail-open when cached policy is missing—see policy behavior.
Frequently asked questions
What did Datadog publish about ARTEX in AWS on November 9, 2026?
Datadog Security Labs described in-the-wild ARTEX activity in October and November 2026: unauthenticated S3 reads, post-exploitation CloudWatch FilterLogEvents searches for financial terms and AKIA-style secrets using compromised long-term IAM keys, and self-registration against public Amazon Cognito user pools followed by broad read-only AWS enumeration.
Which CloudTrail signals did Datadog tie to ARTEX?
Datadog highlights anonymous S3 GetObject and ListObjects with userIdentity type AWSAccount and accountId anonymous, bursts of FilterLogEvents with limit 1000, placeholder S3 keys like zzz_nonexistent_abc.txt before guessing, Cognito SignUp errors from PreSignUp Lambda domain checks, and user agents such as artex-pentest/1.0 and Mozilla/5.0 ARTeX.
How does this relate to AntiFox?
AntiFox is an ARTEX v0.1.1 fork Arctic Wolf tied to IIS webshells and hundreds of AWS API calls in about 30 minutes. Datadog focuses on the AWS control-plane view once keys or Cognito tokens exist—the same credential material coding agents often copy from web.config or .env files during refactors.
Do defenders need a new CVE to stop ARTEX-style agents?
No. Datadog, Unit 42, Arctic Wolf, and GitGuardian frame defenses around credential lifetime, edge auth on identity workflows, and behavioral detection in SIEM—not patching a single framework binary.
What should teams running Claude Code or Codex do after these reports?
Rotate and scope any long-lived AWS keys in repos or local agent configs, block public Cognito self-sign-up unless required, alert on artex-* user agents and AccessDenied storms, and keep local hook observability on agents that read cloud credential files.
Can Beam replace CloudTrail hunting for ARTEX?
No. Beam records tool use on the developer machine and scans skills and MCP configs locally. It does not ingest AWS CloudTrail or block ARTEX operators hitting your SaaS control plane.
Update (November 13, 2026): FBI FLASH and Cloudflare context
The FBI has since released FLASH 20261113-001 on weaponized ARTEX, with TTPs and IOCs that overlap with the cloud-credential patterns above; see our FBI FLASH summary. Cloudflare also published its own view of AI pentest orchestrator traffic in the Modern Security Model post.
Related reading
- Unit 42: ARTEX behavioral hallmarks and exposure counts
- AntiFox: Arctic Wolf IIS and AWS intrusion pack
- Google and Mandiant: five defense layers
- GitGuardian: ~45 agentic pentest frameworks
- FBI FLASH on ARTEX TTPs and IOCs
- Cloudflare Modern Security Model for LLM pentest orchestrators
- November 2026 attacks timeline
- Beam: what we watch on-device
Primary sources: Datadog Security Labs (2026-11-09) · GitGuardian AntiFox post · Microsoft Storm-0940 / ARTEX · Arctic Wolf AntiFox pack (2026-11-10)
CloudTrail field names, IOCs, and Datadog rule IDs reflect the November 9, 2026 Datadog publication unless vendors update them. Dark Reading expert quotes are paraphrased from its November 12, 2026 article; confirm operational claims against primary advisories before exec reporting.