Amazon: ARTEX agents drain API keys from exposed AI gateways
Amazon's decoy inference APIs recorded ARTEX agents stealing and grading LLM provider keys for a month.
· Amazon Web Services · Research by Amazon Threat Intelligence, CJ Moses
Amazon Threat Intelligence captured ARTEX agents in its MadPot decoy sensors between 3 October and 5 November 2026, hunting internet-exposed AI gateways to steal, validate and pool upstream provider keys.
01What happened
Amazon Threat Intelligence published its observations of ARTEX activity on 13 November 2026. Decoy sensors in Amazon's MadPot network, which imitate LLM inference APIs, captured requests from ARTEX agents between 3 October and 5 November 2026, and those requests carried the agents' own campaign records. Amazon assesses with moderate confidence that disparate Chinese-nexus groups ran the activity, citing simplified Chinese prompts, China time-zone settings, targeting and tooling.
02How it works
The credential theft campaign searched the internet for exposed AI gateways and app builders, pulled upstream provider keys out of them, validated the keys, then pooled them to pay for further key hunting. Agents split the work between planner, worker, verification and compression roles sharing a persistent knowledge graph, and graded captured credentials L1 to L3, treating keys exposed publicly for more than 30 days as low value. Entry points included known CVEs, an authentication bypass using the isCliRequest header in One API-family systems, SSRF against cloud metadata services, default LiteLLM master keys, and secrets left in client-side JavaScript, source maps and environment files.
03Who is affected
Self-hosted AI gateways, app builders and inference endpoints reachable from the internet are the exposed surface, and Amazon names twelve of them in the list below. A separate campaign targeted two cryptocurrency exchanges, where agents ran real-time deepfake video against selfie liveness checks and submitted forged identity photos.
04What to do
Require authentication on every AI application, model gateway and inference endpoint, and remove default or hardcoded credentials such as unset LiteLLM master keys. Rotate any provider key that has been reachable from the internet, patch the named CVEs, and monitor for unexpected spend or unusual AI service usage.
Questions people ask
- How did the ARTEX agents find exposed AI gateways?
- Amazon Threat Intelligence reports that discovery ran through internet scanning, certificate transparency logs, GitHub, npm and PyPI, container layers, paste sites and Telegram. Once a gateway answered, the agents extracted upstream provider keys, checked whether each key still worked, and added the working ones to a pool that funded further key hunting across more targets.
- Which stolen credentials did the agents treat as valuable?
- Amazon reports that the agents graded captured credentials from L1 to L3 and treated any key exposed publicly for more than 30 days as low value. Keys taken directly from private deployments were the prize, because they still carried spendable quota at the upstream provider. The campaign records also show cloud privilege expansion and attempts to cash out.
- Did the deepfake identity verification bypass succeed?
- No, on Amazon's account. Agents targeted two cryptocurrency exchanges with real-time deepfake video for selfie liveness checks and forged identity photos, running a deepfake pipeline at 11.5 frames per second on one consumer GPU with at least four agent sessions in parallel. Amazon reports that the liveness vendor's server rejected every recorded deepfake attempt.
Sources 2 links, all fetched
- 1aws.amazon.comAmazon Threat Intel
- 2ic3.govFBI FLASH (PDF)