# Amazon: ARTEX agents drain API keys from exposed AI gateways

> Amazon's decoy inference APIs recorded ARTEX agents stealing and grading LLM provider keys for a month.

- **Severity:** Medium: Real and reproducible, but needs unusual setup, user help or a narrow audience. Plan a fix.
- **Category:** Incident, Attack
- **Published by:** Amazon Web Services
- **Disclosed:** 2026-11-13
- **Affects:** LiteLLM, Dify, Langflow, RAGFlow, Open WebUI, Ollama, One API, FastGPT
- **Research by:** Amazon Threat Intelligence, CJ Moses
- **Primary source:** https://aws.amazon.com/blogs/security/amazon-threat-intelligence-observes-threat-actors-running-cybercrime-campaigns-with-artex-ai-agents/
- **Page:** https://theinjection.dev/items/amazon-artex-ai-gateway-key-theft/

Amazon Threat Intelligence captured ARTEX agents in its MadPot decoy sensors between 3 October and 5 November 2026, hunting internet-exposed AI gateways to steal, validate and pool upstream provider keys.

## What happened

Amazon Threat Intelligence published its observations of ARTEX activity on 13 November 2026. Decoy sensors in Amazon's MadPot network, which imitate LLM inference APIs, captured requests from ARTEX agents between 3 October and 5 November 2026, and those requests carried the agents' own campaign records. Amazon assesses with moderate confidence that disparate Chinese-nexus groups ran the activity, citing simplified Chinese prompts, China time-zone settings, targeting and tooling.

## How it works

The credential theft campaign searched the internet for exposed AI gateways and app builders, pulled upstream provider keys out of them, validated the keys, then pooled them to pay for further key hunting. Agents split the work between planner, worker, verification and compression roles sharing a persistent knowledge graph, and graded captured credentials L1 to L3, treating keys exposed publicly for more than 30 days as low value. Entry points included known CVEs, an authentication bypass using the isCliRequest header in One API-family systems, SSRF against cloud metadata services, default LiteLLM master keys, and secrets left in client-side JavaScript, source maps and environment files.

## Who is affected

Self-hosted AI gateways, app builders and inference endpoints reachable from the internet are the exposed surface, and Amazon names twelve of them in the list below. A separate campaign targeted two cryptocurrency exchanges, where agents ran real-time deepfake video against selfie liveness checks and submitted forged identity photos.

## What to do

Require authentication on every AI application, model gateway and inference endpoint, and remove default or hardcoded credentials such as unset LiteLLM master keys. Rotate any provider key that has been reachable from the internet, patch the named CVEs, and monitor for unexpected spend or unusual AI service usage.

## Quick facts

- **Observed:** 3 October to 5 November 2026
- **Sensor:** Amazon MadPot decoys imitating LLM inference APIs
- **Targets named:** One API, New API, Veloera, Sub2API, LiteLLM, Dify, FastGPT, Langflow, RAGFlow, Open WebUI, LobeChat, Ollama
- **CVEs used:** CVE-2025-3248 in Langflow and CVE-2026-28797 in RAGFlow
- **Attribution:** Disparate Chinese-nexus groups, moderate confidence
- **Second campaign:** Deepfake selfie liveness bypass at two cryptocurrency exchanges
- **Found by:** Amazon Threat Intelligence

## Questions

### How did the ARTEX agents find exposed AI gateways?

Amazon Threat Intelligence reports that discovery ran through internet scanning, certificate transparency logs, GitHub, npm and PyPI, container layers, paste sites and Telegram. Once a gateway answered, the agents extracted upstream provider keys, checked whether each key still worked, and added the working ones to a pool that funded further key hunting across more targets.

### Which stolen credentials did the agents treat as valuable?

Amazon reports that the agents graded captured credentials from L1 to L3 and treated any key exposed publicly for more than 30 days as low value. Keys taken directly from private deployments were the prize, because they still carried spendable quota at the upstream provider. The campaign records also show cloud privilege expansion and attempts to cash out.

### Did the deepfake identity verification bypass succeed?

No, on Amazon's account. Agents targeted two cryptocurrency exchanges with real-time deepfake video for selfie liveness checks and forged identity photos, running a deepfake pipeline at 11.5 frames per second on one consumer GPU with at least four agent sessions in parallel. Amazon reports that the liveness vendor's server rejected every recorded deepfake attempt.

## Sources

1. [Amazon Threat Intel](https://aws.amazon.com/blogs/security/amazon-threat-intelligence-observes-threat-actors-running-cybercrime-campaigns-with-artex-ai-agents/)
2. [FBI FLASH (PDF)](https://www.ic3.gov/CSA/2026/261113.pdf)