AI Agents Steal AWS Credentials

Attackers are renting Alibaba Cloud servers to run AntiFox, an open-source AI penetration-testing platform, against web services and the AWS accounts behind them. In some cases they walked away with production secrets. BleepingComputer reported on November 11, 2026 that the infrastructure was used for vulnerability exploitation, webshell deployment, credential validation, configuration discovery and AWS secret harvesting.

The finding matters because it shows agentic attack software doing real work in live cloud intrusions, not just in demos. Arctic Wolf, whose researchers documented the activity, put it this way in a statement quoted by The Hacker News: "Agentic frameworks such as these make penetration testing techniques more accessible to threat actors, while increasing the speed and consistency with which these techniques can be applied in live attacks."

How Did the Attackers Get From a Web Server to AWS?

There was more than one route. In some intrusions, according to The Hacker News, an ASPX web shell was created by "w3wp.exe", the IIS worker process, and used to run operating-system commands. The attacker then tried to connect to an internal production database using a credential pulled from the application configuration. The precise vulnerability that gave the attackers code execution on the IIS server is not known, The Hacker News reported.

In other attacks, the threat actor appears to have started with a valid AWS credential obtained through means that remain undetermined. Arctic Wolf observed the Alibaba Cloud-hosted AntiFox infrastructure using valid AWS identities, including IAM users and, in some cases, assumed EC2 roles, to make authenticated requests to AWS APIs, BleepingComputer reported.

Arctic Wolf Labs summarized the pattern in a report shared with The Hacker News: "In several recently observed intrusions, Alibaba Cloud systems hosting AntiFox interfaces were associated with confirmed malicious actions against internet-facing web services and associated AWS environments."

What Did the Agent Do Once It Had an Identity?

It went looking. The Hacker News reported that valid IAM identities were abused to enumerate dozens of services, among them IAM, EC2, S3, Lambda, Secrets Manager, KMS, RDS, ECS, EKS, Redshift, Athena, Glue, Systems Manager, API Gateway, CloudWatch, CloudFormation, DynamoDB and Amazon Bedrock.

Speed was the signature. In one intrusion, the attacker cycled through multiple identities and made hundreds of API requests in about 30 minutes, the researchers noted. GitGuardian, in a blog post dated 11 Nov 2026, described the same burst of probing.

Most of it failed. According to Arctic Wolf, many of the authenticated cross-service requests ended in an "AccessDenied" error. But some discovery and secret-access operations went through. In at least some instances, the activity progressed past Secrets Manager enumeration to a successful GetSecretValue request against a production secret, The Hacker News reported. In a separate incident, BleepingComputer said, the attackers used a valid AWS identity to read, copy and delete S3 objects.

What Is AntiFox, and What Stops Misuse?

Very little, on the technical side. AntiFox's GitHub README describes it as an "AI-Driven Autonomous Penetration Testing Platform". Given an authorized target, the README says, a planner, worker and main-agent multi-agent system runs the engagement from recon through exploitation to report delivery.

The same README says the tool must not be used to test any online system or website, and the project is licensed under AGPL-3.0. BleepingComputer noted, however, that the publishers do not describe any technical controls that enforce those restrictions. According to BleepingComputer, the project remains available on GitHub and has been updated to version 2.0. At the time of The Hacker News' writing, it had been forked 251 times and starred 474 times.

Where Does ARTEX Fit In?

AntiFox is a fork of ARTEX, GitGuardian said, and ARTEX has a longer and busier history. BleepingComputer reported that CrowdStrike linked ARTEX to a cyberespionage campaign in which the Chinese hacking group Vapor Panda targeted more than 200 organizations across 14 countries.

Check Point Research (Nov 5, 2026) identified 2,557 systems that hosted ARTEX, including 1,608 live, publicly accessible instances at the time of its research. Censys data cited by The Hacker News counted 1,465 hosts running an exposed ARTEX console as of November 4, 2026.

Taking the code down did not remove it. CERT-EU said the original ARTEX author made the repository unavailable in October 2026, and the publicly available versions are now independent forks. Check Point Research said the developer closed the source after ARTEX was observed in attacks against South Korean banks, but maintained forks and backups have kept the platform available.

CERT-EU also pointed to a design gap. ARTEX relies on configurable rules and the model itself to respect scope and avoid destructive actions, with no hard technical enforcement. Tools like AntiFox and ARTEX belong to a broader set of about 45 open-source agentic attack frameworks built to connect to an LLM and act on its outputs autonomously, The Hacker News reported.

How Autonomous Are These Agents, Really?

Check Point Research offered a measured picture. One cryptocurrency campaign it studied produced 292 objectives, 230 findings and 400,791 agent messages without additional operator prompting after the initial goals were set. In one case an ARTEX agent discovered an unauthenticated API exposing AWS S3 credentials, which gave write access to a bucket holding iOS applications and landing pages for a cryptocurrency service.

Yet the same campaign generated $0 for the attacker, Check Point said, with agents sometimes mistaking successful API responses for successful cryptocurrency theft. The cost of running such an operation was modest. Check Point estimated AI model costs of $700 to $1,500 for an operation that processed approximately 36 billion tokens, based on official DeepSeek API pricing.

Can Defenders See It Coming?

GitGuardian's testing suggests the agents do not need much help. Its researchers found that only four of about 45 examined agentic attack frameworks shipped with a working secrets scanner integrated into the agent. Even so, in a controlled experiment, an ARTEX build with no dedicated scanner found eight of nine planted credentials using ordinary commands such as git and grep. The agent began searching for secrets within 6 to 13 seconds.

GitGuardian also said Microsoft Threat Intelligence reported attackers using ARTEX to find exposed credentials on GitHub and abuse them to access cloud environments, less than a week before the AntiFox reports.

For defenders, GitGuardian advises reviewing CloudTrail for successful API calls within bursts of denied requests, and revoking affected AWS sessions and access keys. It also cautioned that removing an exposed secret from a repository, or deleting a compromised file, does not invalidate the credential.

CERT-EU assessed that ARTEX's public availability will likely accelerate adoption by threat actors, resulting in more frequent, faster and scalable automated attacks with a higher success rate.

What Changed This Week

AntiFox moved from a published pentesting project to a documented tool in live intrusions, with Arctic Wolf tying Alibaba Cloud-hosted instances to confirmed malicious actions against web services and AWS environments. Many of the agent's AWS requests were denied, but some secret-access calls succeeded, including a request for a production secret. The tool's lineage points back to ARTEX, which researchers at Check Point, CERT-EU and GitGuardian have all tracked through forks that survived the original author's retreat.

What to Watch

Two gaps in the public reporting stand out: the vulnerability used to execute code on the IIS server, and the source of the valid AWS credentials in the other intrusions. Neither has been identified. Further updates to AntiFox, which BleepingComputer said has already reached version 2.0, are worth tracking, as is the count of exposed ARTEX consoles that Censys and Check Point have been measuring. On the defensive side, the CloudTrail pattern GitGuardian describes, successful calls hidden inside bursts of denied ones, is the concrete signal security teams can search for now.

Reporting based on coverage from BleepingComputer, The Hacker News, GitGuardian, Check Point Research, CERT-EU and GitHub, November 4-11, 2026.