ARTEX: How AI-Driven Attacks Work and How Runtime Protection Stops Them

TL;DR

1. ARTEX uses autonomous AI agents to find vulnerabilities, exploit applications, steal credentials, and expand access.

2. Oligo researchers identified 15 distinct attack techniques across documented ARTEX campaigns.

3. These attacks rely on familiar exploitation techniques, but AI agents can chain them together and adapt in real time.

4. Oligo detects these techniques at runtime, including those used to exploit previously unknown vulnerabilities, without relying on CVE signatures.

Attackers no longer need a human at the keyboard for every step of an intrusion. ARTEX is a clear example: a framework of AI agents that probes a target, picks the right tool, and changes course based on what it finds.

Researchers at Check Point, CrowdStrike, DIVD, Google and Microsoft have documented ARTEX in real campaigns. Across those reports, we identified 15 distinct attack techniques. This post explains what ARTEX is, how those techniques fit together, and how Oligo's runtime protection detects the underlying exploitation and post-exploitation behaviors.

What makes ARTEX significant isn't that it introduces entirely new ways to compromise applications. It's that AI agents can combine familiar techniques, move between them, and adapt without requiring an operator to direct every step. For defenders, that makes relying on indicators of individual attacks or known vulnerabilities increasingly difficult. The underlying attack behaviors, however, remain recognizable.

What is ARTEX?

ARTEX is an offensive framework built on AI agents. The agents investigate a target, run security tools against it, and adapt their next move to the results.

Operators point ARTEX at a goal rather than scripting every step. That goal might be exploiting an exposed application, stealing credentials, or expanding access after an initial compromise.

This makes ARTEX useful to very different actors. Google and other researchers have documented its use in both financially motivated criminal operations and state-linked espionage. Check Point observed ARTEX agents using command injection and template injection to gain code execution and then harvest credentials.

The documented techniques span the full intrusion lifecycle: command injection, template injection, XXE, exposed credentials, abuse of legitimate APIs, tunneling, cloud resource abuse and supply-chain tampering.

How an ARTEX attack unfolds

There is no single ARTEX attack. Each campaign looks different because the agents choose their path based on what they find. Across the documented campaigns, however, three recurring patterns emerge.

Turn application input into code execution. Agents probe web applications for injection points such as command injection, template injection, XXE and SSRF, then use them to run code or reach internal services. In one case CrowdStrike documented, an unsigned SAML assertion was chained with XXE to reach the cloud instance metadata service.

Collect credentials. Once inside, the agents hunt for anything that grants more access: signing keys in a certificate database, plaintext passwords left in a web root, or cloud metadata credentials. Often the credentials are the point of the operation, not just a step toward it.

Turn one foothold into many. With credentials in hand, the agents can expand their reach. Documented campaigns include downloading payloads with curl and netcat, opening tunnels with tools like Chisel, probing cloud permissions and escalating to root. In one case Check Point documented, leaked credentials were used to modify S3-hosted distribution content, turning one victim into a channel to reach others.

Quick reference: ARTEX techniques and Oligo coverage

The significance of ARTEX isn't any single vulnerability it exploits. It's the ability to chain different techniques together and continuously adapt based on the results. But whether an agent exploits a known CVE or discovers a new path into an application, the resulting behavior can still be identified at runtime.

That's where Oligo's approach comes in. By connecting application call stacks with process, file and network activity, Oligo identifies the exploitation techniques behind an attack rather than relying on signatures tied to individual vulnerabilities.

The table below maps 15 attack techniques documented in ARTEX campaigns to Oligo's corresponding detection capabilities.

The bottom line

ARTEX is a preview of what happens when attackers can automate exploitation, credential theft and lateral movement using AI agents. The individual techniques aren't necessarily new. What's changing is how quickly they can be combined, tested and adapted.

Defenders can't afford to rely solely on identifying every vulnerability or tracking every new offensive framework. They need to recognize exploitation as it happens. That's the advantage of runtime protection: identifying the behaviors behind attacks, even as attackers change their tools, targets and techniques.

Across the techniques documented in ARTEX campaigns, Oligo provides runtime detections for the exploitation and post-exploitation behaviors attackers rely on, from command injection and credential theft to malicious dependency execution.

Want to see how Oligo would detect ARTEX-style activity in your environment? Talk to our team.