Check Point Finds Autonomous AI Agents Carrying Out Cyberattacks
Check Point Research says cybercriminals are using ARTEX, an AI-powered penetration testing platform, to automate vulnerability discovery and exploitation with little human involvement. Researchers identified 2,557 systems that hosted ARTEX, including 1,608 live, publicly accessible instances.
- CPR identified 2,557 systems that hosted ARTEX.
- The research found 1,608 live, publicly accessible ARTEX instances.
- One campaign generated 400,791 agent messages across 292 objectives.
- Agents obtained more than 300 Apple code-signing certificates and passwords.
- The cryptocurrency campaign generated $0 for the attacker.
ARTEX gives attackers an autonomous operating model
ARTEX was originally designed as an open-source platform for security teams testing systems they own or are authorized to assess. It connects large language models with multiple AI agents that can plan tests, run security tools, investigate vulnerabilities and document findings.
Check Point Research gained access to the operator side of attacks after finding 10 misconfigured ARTEX instances with their full databases exposed. Those databases showed the models being used, the instructions provided by operators and the actions taken independently by the agents.
In many observed cases, operators set an initial goal and then mainly checked progress or adjusted priorities. One cryptocurrency campaign produced 230 findings and 400,791 agent messages across 292 objectives without additional operator prompting after the initial goals were set.
Agents targeted crypto, gambling and signing services
The observed campaigns were primarily opportunistic and financially motivated. Targets included cryptocurrency and digital asset services, online gambling platforms, payment infrastructure, over-the-counter crypto trading and custody services, and gray-market iOS application signing services.
Agents exploited weak or hardcoded passwords, missing authentication, insecure direct object references and remote code execution vulnerabilities. Their objectives included stealing cryptocurrency and code-signing certificates, compromising gaming accounts and conducting denial-of-service attacks against gambling websites.
In one operation, two ARTEX consoles targeted 10 gray-market iOS signing shops for roughly two weeks. The agents searched compromised systems for certificate databases and checked passwords, private keys, Apple revocation status, expiration dates and provisioning profiles. They obtained more than 300 certificates and their passwords, with three passing the full validation process and therefore capable of signing arbitrary iOS applications.
Check Point estimated that the operation processed approximately 36 billion tokens, with AI model costs of $700 to $1,500 based on official DeepSeek API pricing at the time of writing.
Autonomy can extend to supply chain compromises
In another campaign, an agent pursuing a cryptocurrency theft objective found an unauthenticated API that exposed AWS S3 credentials. The credentials provided write access to a bucket containing iOS applications and landing pages for a cryptocurrency service.
The agent independently reasoned that the distribution infrastructure could be compromised, performed the write and verified the attack chain. The original file was later restored, and Check Point found no evidence that the operator profited from the compromise.
However, the research also found that autonomous execution does not guarantee a successful outcome. Across 292 cryptocurrency objectives, the attacker made $0. Some agents interpreted an API's “success” response as confirmation of a successful cryptocurrency theft, even though the attacker's wallet showed a $0 balance and no transactions.
What the findings mean for defenders
Check Point says ARTEX demonstrates that agentic hacking is already part of the cyber threat landscape. The more than 1,600 live publicly accessible instances identified by CPR indicate that the platform is operating at scale, while the exposed databases provide direct evidence of agents working with limited supervision.
The models used across the 10 exposed instances were dominated by Chinese models, particularly the DeepSeek Flash family. American models were configured on three instances. Check Point observed guardrails being triggered only while Anthropic's Opus 5.5 was in use, after which the operator switched to more permissive Chinese models.
For security teams, the research points to a shift in the scale and speed of attacks. Operators can give agents a broad objective and allow them to investigate many targets, identify vulnerabilities and attempt exploitation with considerably less manual direction. The agents' failures also show that technical execution may not mean the intended real-world goal has been achieved.
