Amazon says its MadPot decoy sensors, set up to look like popular AI model APIs, received requests from attackers’ AI agents that carried the agents’ own records of their campaigns. The capture ran from 3 October to 5 November 2026, 34 days by our count, according to a post on the AWS Security Blog published on 13 November.
Amazon Threat Intelligence says the agents ran on ARTEX, which it describes as “an open-source agentic AI penetration testing framework”, and that the records describe two campaigns: large-scale theft of credentials for AI models, and attempts to beat identity checks at two cryptocurrency exchanges with deepfakes.
Business Pill · Multi-agent systems
An evergreen Business Engineer explainer on multi-agent systems: how several AI agents split one job between them. It explains the general idea only and does not discuss any attack, tool or company in this story.
The key insight: By our count, Amazon’s decoys captured AI agents’ requests over 34 days, and the agents’ own records describe a credential operation in which, Amazon says, stolen AI keys paid for the inference that hunted for more keys.
Amazon says the MadPot sensors “presented popular LLM-compatible chat-completions interfaces on various ports”, and the agents treated them as model backends. Because agent frameworks send their history to the model with each request, the telemetry contained “the persistent task context, system prompts, tool histories, knowledge-graph state, and reported findings”.
Amazon adds a limit: it “did not observe that activity as it happened and cannot verify the outcomes the agents reported”. It says it notified potentially affected AWS customers and is publishing indicators so other organisations can check their own systems.
Indicators of compromise Amazon Threat Intelligence listed for the two ARTEX campaigns, by first-seen date, from the AWS Security Blog (13 November 2026). Counts are our arithmetic.
Campaign One: Stolen Keys Paying for More Theft
According to Amazon, the agents searched for internet-exposed AI applications, pulled the provider keys stored in them, validated the keys and kept them in a managed pool, and the records show stolen keys being fed into the framework’s own model gateway to power the agents hunting for more keys. Amazon calls it “a self-sustaining operation”.
Amazon lists the targets as LLM gateways and proxies, including One API, New API, Veloera, Sub2API and LiteLLM, and AI app builders, including Dify, FastGPT, Langflow, RAGFlow, Open WebUI, LobeChat and Ollama. The playbook it describes included default administrator credentials, such as the LiteLLM default master key, CVE-2025-3248 in Langflow and CVE-2026-28797 in RAGFlow.
Amazon says operators graded each credential L1 for a lead, L2 for a confirmed working API call and L3 for quantified impact, and told the agents to treat keys exposed publicly for more than 30 days as low-value inventory.
Campaign Two: Deepfakes Against Identity Checks
Amazon says the records show agents building real-time deepfake video for live selfie checks and forged ID photos at two cryptocurrency exchanges. The best recorded attempt completed the liveness movement sequence with the face within 7 pixels of the target, but Amazon says “the vendor’s server-side verdict rejected the deepfake in every attempt the agents recorded”.
A separate session, it says, built a deepfake video pipeline on a single consumer-grade GPU that reached 11.5 frames per second, and at least four agent sessions ran at once, covering cash-out, balance clearing, the deepfake pipeline and the verification bypass.
Who Amazon Says Was Behind It
Amazon assesses “with moderate confidence” that ARTEX was used, based on prompt references and other artifacts, and, also with moderate confidence, that the campaigns came from “disparate Chinese-nexus threat groups”, citing simplified Chinese in prompts, China time-zone settings, targeting and tooling. It says the instructions excluded mainland China targets and government domains.
The post lists 11 IP addresses as indicators, 5 for the credential campaign and 6 for the deepfake campaign, with first and last sightings between 14 October and 2 November.
A Different Tool From CyberStrikeAI
ARTEX is a different framework from CyberStrikeAI, the tool that four security reports named in 17 days, including Elastic’s account of 56 AWS calls in 141 milliseconds. Amazon concludes: “None of the techniques in these campaigns were new. What AI agents change is the speed and persistence of the attacker.”
The Structural Read
As we read Amazon’s post, the agents’ memory became the evidence: because the frameworks send their history with each request, Amazon says single requests often held a campaign’s full operational history.
As we read the target list, the weak point Amazon describes is the gateway that aggregates many keys: Amazon says one weak management interface can expose many downstream accounts.
Amazon Threat Intelligence, 13 November 2026
“None of the techniques in these campaigns were new”
Three Implications
FOR TEAMS RUNNING AI GATEWAYSAmazon lists One API, New API, Veloera, Sub2API, LiteLLM and AI app builders such as Dify, Langflow and RAGFlow among the targets, and names the LiteLLM default master key and CVE-2025-3248 in Langflow.
FOR CRYPTO EXCHANGESAmazon says the agents reverse-engineered one vendor’s liveness protocol, and that the vendor’s server-side verdict rejected the deepfake in every attempt the agents recorded.
FOR DEFENDERS GENERALLYAmazon says organisations should assume exposed secrets and misconfigurations will be found quickly and should watch for unexpected AI spend.
The framework argues that “The surface, not the model, governs autonomy”, meaning the harness around a model decides what an agent can do.
As we read it, ARTEX fits that view from the attacker’s side: Amazon describes planner, worker, verification and compression agents sharing a knowledge graph; the framework does not discuss ARTEX or these campaigns.
What Is Not Established
Amazon does not name any individual or group, gives no count of victims beyond “hundreds of targets” in the agents’ own records, and says it cannot verify the outcomes the agents reported. The attribution to ARTEX and to Chinese-nexus groups is Amazon’s assessment at moderate confidence. We found no response from ARTEX’s maintainers and have not contacted Amazon for this piece.
This Week In The AI Supercycle
AI Lost Its Central Banker, the Lab Oligopoly, and the Future of Open Source
This week’s issue: the Nvidia leadership change, read as the AI build-out losing its central banker: who now finances the GPU landlords, backstops the data centres and sponsors open models, and why two labs are becoming the bank.
Amazon says its decoys posing as AI model APIs captured attackers’ AI agents sending their own campaign records for 34 days, from 3 October to 5 November. It says the records show stolen AI keys paying for more theft, and deepfake identity checks that the vendor rejected in every attempt the agents recorded.
A note on sourcing. Every campaign detail comes from Amazon Threat Intelligence’s post on the AWS Security Blog of 13 November 2026, read in full; the behaviour described is the agents’ own records as Amazon reports them, which Amazon says it cannot verify. The CyberStrikeAI context comes from our earlier reporting. The 34-day window and the indicator counts are our arithmetic from the post. Amazon was not contacted for this piece.
Gennaro Cuofano is a CRO and tech executive who has worked in AI since late 2015, starting with bringing NLP, natural-language generation, voice and chatbot products to the marketing industry. His background is in law and finance: he holds a Master's degree in Law and an International MBA with an emphasis on corporate finance (LUISS Business School and the University of San Diego, 2012), and worked as a financial analyst at a real-estate investment firm in San Diego and as an assistant controller. His work focuses on business model strategy, business engineering and, more broadly, structural analysis: how companies make money, read from their own filings. He created FourWeekMBA and leads research there and at The Business Engineer, his newsletter on AI and business strategy, with over 95,000 subscribers and more than 1,000 published analyses. His writing has also appeared on Entrepreneur (for example, How to Digitize a Family Business in Europe) and HackerNoon. Find him on LinkedIn and Substack. See how we source.
