An open-source pentest agent goes to work in the wild
Reviewing ARTEX in the Wild: Storm-0940 Expands Targeting of IT and Software Vendors · Sapir Federovsky
Researchers tracked an attacker using an autonomous open-source penetration-testing agent to map vendor applications, probe OAuth and single sign-on flows, spray passwords and abuse account recovery across Okta, Entra and Cognito. Most attempts failed, but the agent iterates patiently until a single weakness gives way.
An attacker downloads a web app's JavaScript bundles and source maps, reads the leftover env and config files, and scrapes its Swagger definitions. Minutes later it calls the internal API routes those files revealed, by name. No human is driving. An autonomous agent is reading the map and walking the building.
Researchers at Wiz reconstructed this picture from access logs and identity provider telemetry. The tool is ARTEX, an open-source penetration-testing agent, and its operator shares infrastructure and habits with a group Microsoft tracks as Storm-0940. The targets were IT and software vendors, whose credentials can open doors into every customer downstream. Identity was the focus: Okta, Entra and Cognito, the sign-in layer the rest of the supply chain trusts.
Source maps and OpenAPI definitions are meant to help developers; here they hand the attacker a list of internal endpoints. Then come the login flows. The agent injects malformed state values and fabricates authorisation codes. Unsigned web tokens get tested too, the tickets an app should check for a valid signature before trusting who you claim to be. Single sign-on (SSO) endpoints, the shared login pages many apps rely on, are flooded with crafted tokens. If one slips through, the attacker is inside as whoever the token names.
A password spray ran alongside, large, coordinated and indifferent to which identity provider sat in front of it. Software engineers were singled out because their accounts usually carry more access. Attempts arrived in tight bursts, about one second apart at the median. Account recovery got the same treatment. Wherever a proprietary app or Cognito exposed password-reset, username-recovery or sign-up endpoints, the agent hit them repeatedly, hoping to create an identity or recover someone else's.
The autonomy is the new part, not the techniques
None of these moves is novel. What is new is the chaining: the tool uses the output of one step to decide the next. Sessions ran for up to a day. When blocked, the agent rotated IP addresses; when rate-limited, it switched endpoints and cycled user agents, some of which openly named themselves. Boredom never sets in. The agent simply iterates until one weakness gives.
In my view, the paper shows something narrower than the threat model around it suggests. It demonstrates persistence at scale, not success, and nothing here proves an agent can find a weakness a skilled human would miss. What it does show is that the cost of trying everything has fallen sharply, and that probably matters more.
And most of it failed, as Wiz says plainly. Attribution rests on shared infrastructure and behaviour, not proof. Wiz could only see what its own logs captured, so other victims or variants may exist. Many listed user agents are noisy and not unique, which makes them poor signals on their own.
Behaviour is the better signal. If you run an identity provider or a vendor app, check your logs for requests to Swagger and OpenAPI files, reads of env and config files, repeated hits on sign-in and password-reset pages, and sessions that change IP address and user agent unusually fast. The techniques are old. The patience is new.
