In our tests, Arkose Titan rated default sessions from ARTEX, an open-source agentic AI attack framework, at the highest risk level: 100 out of 100. What matters next is how organizations act on that verdict. The answer is to enforce it on every authentication path, mobile included.
Overview
In November 2026, a financial institution asked Arkose Labs to assess ARTEX, an open-source agentic offensive framework. Overnight, the Arkose Cyber Threat Intelligence Research unit (ACTIR) searched Arkose Labs telemetry for the reported indicators, ran both public forks in the Arkose Labs detection lab and checked every browser-level trait against production traffic.
ARTEX is not a person or a crew. It is software that gives an AI model a team of eight roles, a reconnaissance toolkit and a browser, then lets the model decide how to attack. That last part is what makes it worth a dossier. The tool does not pick its disguise. The model does, and the choice changes from run to run.
Out of the box, ARTEX's browser is stock Playwright, an automation library widely used for legitimate testing. Nothing in the browser layer names ARTEX. In Arkose Labs' tests, how stock Playwright behaves is what gave it away.
In Arkose Titan's agent classification, ARTEX falls in the malicious agent population. (Other categories are self-disclosing good agents and non-disclosing good agents.) It is automation built to pass as a normal browser, and it is classified by what it does, not by what it claims.
ARTEX by the Numbers
Source: Arkose Labs Threat Research, ARTEX assessment (testing completed Nov. 5, 2026)
Note: Findings reflect testing completed on Nov. 5, 2026 against publicly available ARTEX forks. ARTEX and its forks change frequently, and Arkose Labs will update this assessment as new variants are tested.
Meet ARTEX
ARTEX is an LLM-driven agent platform. It ships with 8 built-in agent roles, including planner, worker, penetration tester and report writer, plus a reconnaissance toolchain (subfinder, httpx, katana, nuclei and others) and a Playwright browser. In Arkose Labs' runs, it was driven by an inexpensive hosted model through a public LLM router. Any compatible model can be configured.
The original developers closed-sourced the project in the weeks before Arkose Labs' testing, and many forks have appeared since, of mixed provenance. Arkose Labs recommends running any copy only in an isolated sandbox, and all ARTEX execution for this assessment took place on Arkose Labs-controlled, isolated infrastructure.
The Model Picks the Disguise
Six ARTEX sessions reached Arkose Titan production scoring from an Arkose Labs cloud test server. The browser setup changed from run to run because the AI model chose it each time, even with an identical prompt and no detection to react to. The graphic shows the three default stacks. In a fourth, the model chose a non-default setup that Arkose Labs is reviewing.
A fourth, non-default setup is under review.
Source: ACTIR, testing completed Nov. 5, 2026
How the model reasoned
“The tool doesn't choose the disguise. The model does, and it varies between runs. That is why no single browser fingerprint gives ARTEX away.”Mitch Davies, Security Research Manager, ACTIR
How ARTEX Works a Protected Site
ARTEX works in phases: recon, app mapping and auth probing, then a split. The graphic shows each step and what happens next.
Source: ACTIR, testing completed Nov. 5, 2026
“ARTEX looks for the quietest route first. A browser session is the last thing it reaches for.”Mitch Davies, Security Research Manager, ACTIR
Mobile is the first pivot
ARTEX's recon and JavaScript-bundle analysis surfaces mobile app and partner API routes quickly, and its instructions explicitly direct it to try mobile logins when the web flow is protected. The Arkose Mobile SDK extends the same protection to mobile app APIs.
How to Catch ARTEX
Nothing in the browser layer names ARTEX. In Arkose Labs' tests, Arkose Titan identified it by how it behaves, not by what it is called, and that held on every run. Good agents that don't announce themselves and malicious ones can look alike on the surface. Behavior and intent are what separate them.
“ARTEX can change what it looks like from run to run. How it behaves is what gives it away.”Mitch Davies, Security Research Manager, ACTIR
What Companies Can Do Now
Conclusion
ARTEX shows what an AI-driven attacker looks like in practice. It reads the defense, picks its own browser setup and goes looking for the quietest route in. In Arkose Labs' tests, default configurations scored 100, High. Plan for an attacker that tries every route, not just the browser.
See how Arkose Agent Trust Manager classifies each AI agent.Contact
press@arkoselabs.com