Amazon Threat Intelligence has identified that the ARTEX agentic AI framework is now being leveraged in real‑world cyber‑crime operations that systematically steal AI model access keys and cloud credentials. Engineers who expose inference APIs or manage cloud identities must recognize that these autonomous agents can discover, validate, and reuse exposed secrets without direct human involvement.
How the Campaigns Operate
ARTEX agents are organized into distinct roles—planner, worker, verification, and compression—each reading from and writing to a shared knowledge graph that acts as the operation’s memory. The agents issue prompts to services that appear to be standard LLM inference APIs; MadPot decoy sensors, which mimic popular chat‑completion endpoints, captured these interactions. The telemetry recorded by MadPot includes the full prompt history, system instructions, tool usage logs, and the agents’ reported findings, effectively exposing the end‑to‑end workflow of the campaigns.
Within the captured prompts, threat actors set mission objectives, targeting rules, and operational constraints. For example, one credential‑theft campaign instructed agents to traverse a predefined list of countries, prioritize enterprise production environments, and downgrade any credential that had been publicly exposed for more than 30 days. The agents then used the harvested keys to power further inference calls, creating a self‑sustaining loop where stolen credentials fund additional hunting.
Observed Attack Surface and Indicators
The campaigns focused on publicly reachable AI application endpoints that aggregate provider keys. Specific platforms mentioned include One API, New API, Veloera, and Sub2API. Agents extracted upstream provider keys from these services, validated them against the respective cloud token and identity services, and stored successful keys in a managed pool for reuse.
Beyond AI model keys, the agents enumerated cloud storage, inspected permission scopes, and targeted secrets and parameter stores. They also attempted privilege escalation within cloud environments and pursued cryptocurrency fraud by injecting deepfakes into KYC verification flows. Attribution signals—simplified Chinese language in prompts, China‑centric time‑zone settings, and proxy‑centric outbound traffic—suggest involvement of Chinese‑nexus threat groups.
Implications for Architecture and Operations
These observations raise several considerations for practitioners:
- Public exposure of inference endpoints: Any LLM‑compatible API that is reachable from the internet can become a lure for autonomous agents. Reducing the attack surface may involve restricting inbound traffic, employing network‑level allowlists, or moving inference workloads behind authenticated gateways.
- Credential lifecycle management: The campaigns demonstrate that even short‑lived or publicly disclosed keys are harvested and reused. Regular rotation, short token lifetimes, and strict validation of token scopes can limit the value of compromised credentials.
- Telemetry and decoy deployment: MadPot’s ability to capture full agent histories highlights the value of controlled honeypot services that mimic production APIs. Deploying similar decoys can provide early warning of automated probing.
- Proxy and outbound traffic controls: Threat actors required all outbound traffic to flow through proxies. Enforcing proxy usage for outbound calls from AI workloads can provide an additional observation point and help enforce egress policies.
Related CloudNinjas coverage: AWS.
What This Means For Practitioners
Engineers should audit any publicly advertised AI inference endpoints and consider moving them behind authenticated front‑ends or zero‑trust gateways. Review credential issuance practices to ensure tokens have minimal privilege and short validity periods. Implement or augment decoy services that emulate LLM APIs to surface automated probing activity. Finally, monitor outbound traffic from AI workloads for unexpected proxy usage or anomalous request patterns that match the agentic workflow described above.
