In an AWS Security Blog post on November 13, Amazon CISO CJ Moses wrote that from October 3 to November 5, 2026, Amazon's global decoy sensor network MadPot, configured to present as popular LLM chat-completions interfaces, received requests from attack agents running on ARTEX, an open-source agentic penetration testing framework. Because agent frameworks send their system prompts, tool histories and knowledge-graph state to the "model", single requests often carried a campaign's full record. Amazon assesses with moderate confidence that the activity came from disparate Chinese-nexus groups. The largest campaign stole AI model credentials at scale, with stolen keys paying for the inference behind further key hunting; another tried to beat KYC checks at two crypto exchanges with real-time deepfake video and forged ID photos, but the vendor's server-side verdict rejected every recorded deepfake attempt. Amazon stresses that none of the techniques were new and that it cannot verify the outcomes the agents reported.
Key Takeaways
- ✓Observation window October 3 to November 5, 2026: MadPot sensors emulated popular LLM chat-completions interfaces on various ports, ARTEX agents treated them as model backends, and requests carried system prompts, tool histories, knowledge-graph state and reported findings (AWS Security Blog)
- ✓Campaign 1, industrial-scale AI credential theft: targets included LLM gateways such as One API, New API, Veloera, Sub2API and LiteLLM, plus apps such as Dify, FastGPT, Langflow, RAGFlow, Open WebUI, LobeChat and Ollama, via unclaimed installs, anonymous admin endpoints, the LiteLLM default master key, CVE-2025-3248 (Langflow) and CVE-2026-28797 (RAGFlow)
- ✓Keys were graded L1 (lead), L2 (confirmed working call) and L3 (quantified impact); keys public for more than 30 days were treated as low-value inventory, and stolen keys were fed into the framework's own model gateway to power more hunting
- ✓Campaign 2, deepfake KYC bypass at two crypto exchanges: the best attempt finished the liveness movement sequence within 7 pixels of the target, yet the vendor's server-side verdict rejected every recorded attempt; a separate session built a real-time face-animation pipeline on one consumer GPU at 11.5 fps, with at least four agent sessions working in parallel
- ✓Attribution is moderate confidence (prompt references to ARTEX tooling, simplified Chinese prompts, China time-zone settings); Amazon did not observe the activity live, cannot verify the agents' reported outcomes, notified potentially affected AWS customers, and published 11 IOC IP addresses
Key Decision Metrics at a Glance
Turn your technical choice into a development budget
Compare 40 dev plans & simulate token costs vs $20/mo subscriptions
Project Links & Resources
Direct AccessIn-Depth Technical Analysis
Background
Over the past month ARTEX, an open-source agentic penetration testing framework, has shown up in CrowdStrike reports and in the FBI's November 13 FLASH alert. Amazon's report adds a new angle: instead of reconstructing attacks from victim logs, it reads the attack agents' own working memory. For developers the pain point is direct: self-hosted LLM gateways and AI app platforms hold many upstream model keys, and one unauthenticated admin interface can expose many downstream accounts.
How the decoys worked
Agent frameworks rely on an external model to decide what to do next, so they send their persistent task context, system prompts, tool histories and knowledge-graph state to the "model API". MadPot dressed its decoys up as popular chat-completions endpoints, and ARTEX agents sent over full campaign records. The report describes ARTEX as planner, worker, verification and compression agents sharing a persistent knowledge graph as memory; operators set objectives, country sequences and red lines (such as excluding mainland China targets and government domains, and routing all outbound traffic through proxies) through standing instructions.
Numbers from the report
This is not a benchmark story; all figures are Amazon's own: observation from October 3 to November 5; keys graded L1/L2/L3, with keys exposed for more than 30 days treated as low value; the best deepfake liveness attempt landed within 7 pixels of the target but every recorded attempt was rejected server-side; real-time face animation on one consumer GPU reached about 11.5 fps; at least four sessions ran in parallel; 11 IOC IP addresses are listed. Amazon says it cannot verify the outcomes the agents reported, and attribution is moderate confidence.
What developers should do
If you run LiteLLM, One API/New API, Dify, Langflow, RAGFlow, Open WebUI, Ollama or similar: make sure no instance sits uninitialized and claimable, require auth on admin and provider-configuration endpoints, change the LiteLLM default master key, and patch Langflow CVE-2025-3248 and RAGFlow CVE-2026-28797. Check client-side JS, source maps, debug routes and env files for leftover keys, revoke any key found in GitHub, npm/PyPI packages or container layers right away, set alerts for unexpected model spend, and match the report's IOCs against your logs.
Benchmark side-by-side against alternatives, or calculate monthly token cost vs subscription break-even.
Discussion & Comments
0Sign in to join the discussion
Connect with AI developers to exchange benchmark insights.