Chinese-Nexus Hackers Use Stolen LLM API Keys to Fuel ARTEX AI Agents in Credential Theft Campaign
Between October and November 2026, Chinese-nexus threat actors leveraged the ARTEX open-source agentic penetration-testing framework to steal large language model (LLM) API credentials. These stolen keys were used to power the ARTEX AI agents, creating a self-sustaining inference loop that enabled continued credential theft without requiring additional operator resources. Targets included multiple AI gateway platforms and cloud services, exploiting default keys, misconfigurations, and vulnerabilities such as CVE-2025-3248 and CVE-2026-28797. Operations involved extensive reconnaissance, exploitation, and validation steps, with specific geographical and operational indicators pointing to China. In parallel, a related campaign employed deepfake injections targeting cryptocurrency exchange KYC liveness checks, though without successful bypass. The campaign underscores the need for patching, credential rotation, and endpoint restriction to mitigate risks associated with exposed LLM API keys and management interfaces.
Entenda a falha
A vulnerabilidade
The story covers two named CVEs plus several misconfigurations in AI gateway and LLM platforms. CVE-2025-3248 is a remote code execution flaw in Langflow. CVE-2026-28797 is a flaw in RAGFlow, and the articles give no detail on its type or impact. The attackers also abused default master keys, uninitialized installs, anonymous configuration endpoints, an authentication bypass through the isCliRequest header in One API-family systems, and cloud metadata SSRF via URL-fetch features. The goal was to take upstream model-provider credentials. The articles do not list affected or fixed versions. Amazon says the operations relied on known weaknesses, not new techniques.
Como funciona
ARTEX runs planner, worker, verification and compression agents that share a knowledge graph. The agents scan exposed AI gateways and LLM platforms, then follow a product-specific playbook. It covers default keys, open configuration endpoints, the isCliRequest bypass, the Langflow and RAGFlow CVEs, and URL-fetch features that reach cloud metadata. They also search JavaScript, source maps, debug routes and environment files for secrets. Credentials found are validated and graded L1 to L3. Working provider keys then go into the framework's model gateway and pay for more agent inference, which closes the loop.
Por que é vulnerável
The articles point to common weaknesses: default or unset master keys, uninitialized installations, anonymous configuration endpoints, secrets left in client-side code and environment files, exposed management interfaces and unpatched software. These platforms hold many upstream provider keys in one place, so one exposed interface yields a lot. The articles do not explain the root cause of CVE-2025-3248 or CVE-2026-28797, nor what the fixes change.
Como foi descoberta
Amazon Threat Intelligence found the campaign. Its MadPot decoy network, with sensors posing as LLM inference APIs, received requests carrying the agents' operational memory (system prompts, tool histories, knowledge-graph state and campaign records) between October 3 and November 5, 2026. Amazon attributes the use of ARTEX and the Chinese-nexus link with moderate confidence and could not independently verify the outcomes in the agent-generated records. It published indicators including 104.28.225[.]223 for credential theft.
PoC existente, privada
O exploit existe, mas quem o tem não o publicou.
The articles show these flaws being exploited in the wild: the ARTEX playbook incorporates the Langflow and RAGFlow CVEs and was used against exposed platforms. ARTEX itself is described as open source, but no article says a standalone exploit for either CVE was published. Treat exposed instances as at real risk and patch, rotate keys and restrict endpoints now.
Explicação gerada por IA a partir da matéria e dos artigos, em 14/11/2026 06:16.
2 exploits públicos
Há código de exploração publicado no Exploit-DB para CVE-2025-3248. O código não é reproduzido aqui: o link leva à fonte, e a explicação foi escrita pela IA a partir do arquivo publicado.
-
Langflow 1.2.x - Remote Code Execution (RCE)
This script targets Langflow 1.2.x and earlier through its code-validation API endpoint, which evaluates submitted Python code on the server. An unauthenticated attacker with network access to the Langflow web service can make it run arbitrary operating system commands with the privileges of the Langflow process. The script sends one crafted request and prints the command output returned in the error field of the response. It matches CVE-2025-3248 and looks like a working, simple exploit, though Exploit-DB has not verified it. Upgrading Langflow and not exposing it to untrusted networks mitigates it.
-
Langflow 1.3.0 - Remote Code Execution (RCE)
This is a small Python script for CVE-2025-3248 in Langflow, the AI workflow builder. It abuses the web API's code validation feature, which reaches the Python interpreter without requiring login, so an attacker only needs network access to a Langflow server running a version before 1.3.0. The script sends a crafted function definition that makes the server run an operating-system command chosen by the attacker, then reads the output back from the error message. It looks like a working, simple exploit that matches the CVE, though Exploit-DB has not verified it.
Linha do tempo
-
Chinese-Nexus Hackers Use Stolen LLM API Keys to Fuel ARTEX AI Agents in Credential Theft Campaign
ler a análise desta fonte ocultar
Between October and November 2026, Chinese-nexus threat actors leveraged the ARTEX open-source agentic penetration-testing framework to steal large language model (LLM) API credentials. These stolen keys were used to power the ARTEX AI agents, creating a self-sustaining inference loop that enabled continued credential theft without requiring additional operator resources. Targets included multiple AI gateway platforms and cloud services, exploiting default keys, misconfigurations, and vulnerabilities such as CVE-2025-3248 and CVE-2026-28797. Operations involved extensive reconnaissance, exploitation, and validation steps, with specific geographical and operational indicators pointing to China. In parallel, a related campaign employed deepfake injections targeting cryptocurrency exchange KYC liveness checks, though without successful bypass. The campaign underscores the need for patching, credential rotation, and endpoint restriction to mitigate risks associated with exposed LLM API keys and management interfaces.