AI attackers are already here: Why layered defense wins

Debrup GhoshPrincipal Product Manager | F5

James LeeSenior Solution Architect | F5 (Asia Pacific)

Muhammad AbidSr. Director, Product Marketing, F5

Twelve minutes. That is how long it took an automated, AI-driven attacker to move from initial access to full administrator root control of a target network in a recent European cybersecurity simulation. Twelve minutes is shorter than your security team’s morning stand-up, let alone a standard security operations center (SOC) triage cycle.

CISOs are rapidly losing the luxury of time. When an autonomous AI agent can scan, pivot, exploit, and exfiltrate credentials before a human analyst can even open an alert ticket, the strategic mandate for security leaders is undeniable: you must fight machine-speed threats with machine-speed defenses.

The catalyst behind this dramatic compression of time is Artex, an offensive multi-agent framework originally developed in China and released on GitHub as open-source software. Although its author removed the public repository following widespread abuse, the code had already amassed thousands of forks, leaving hundreds of active installations openly reachable across the Internet.

Attackers of all profiles have weaponized it. In South Korea, cybercriminals automated breaches across seven financial institutions affecting roughly 67,000 individuals and 2,200 organizations to demand ransoms. Globally, state-aligned groups deployed Artex against more than 200 telecommunications, pharmaceutical, and government targets across 14 countries, while campaigns in India used it to call fund-transfer banking APIs directly.

To defend your enterprise, we need to cut through the industry hype. Artex is not a standalone super-intelligent model. It is an orchestration harness written in Go that pairs commercial large language models (LLMs)—such as DeepSeek, Claude, and Grok—with command-line tools, scripts, and Model Context Protocol (MCP) servers.

The LLM acts as the cognitive brain—analyzing responses, planning multi-step campaigns, and generating custom exploit scripts on the fly. The automated tools act as the hands. This architecture puts hacking within everyone’s reach. Elite, multi-stage attacks that once required a sophisticated team days to coordinate can now be executed in minutes by low-skill actors against everyday vulnerabilities like weak passwords, missing multi-factor authentication (MFA), and exposed APIs.

Why single-layer controls fail at machine speed

When F5 security researchers connected Artex to leading AI models and ran it against a deliberately vulnerable application in our lab, the results were unequivocal. The more capable the underlying LLM, the faster and more aggressively Artex executed.

Crucially, we observed how the agent behaved when confronted by traditional point defenses. Most existing security architectures inspect incoming requests in isolation. When we placed F5 Web Application Firewall for Distributed Cloud in front of the application, existing signatures immediately blocked Artex’s initial wave of recognizable web injection payloads. Furthermore, by pairing signature detection with machine learning through AI-powered risk scoring, the WAF evaluated the broader context of incoming requests, giving teams the confidence to enforce active blocking rather than passively monitoring.

Yet stopping the first wave did not end the attack. As soon as Artex detected that its standard web exploits were blocked, the LLM shifted tactics in real time. It began mapping the application’s application programming interfaces (APIs) and hunting for flaws in business logic—such as manipulating customer ID parameters to access other users’ private accounts. To a single-point firewall inspecting one packet at a time, those requests look like normal application traffic.

Defeating an adversary that pivots dynamically across vectors requires operational connective tissue across your security stack. Within F5 Distributed Cloud, malicious user detection provides that link by tracking the actor behind the requests rather than evaluating each request in a silo. It aggregates WAF violations, forbidden access attempts, failed logins, bot telemetry, and rate-limit triggers into a continuous threat score, escalating enforcement proportionally from a JavaScript challenge to a CAPTCHA to a complete block.

For a CISO, continuous tracking solves three critical operational blind spots. First, Artex campaigns rotate proxy infrastructure relentlessly; in one analysis of an exposed attacker server, a proxy service generated 79 exit IP addresses from the first 100 identities tested. By augmenting IP tracking with JA4 TLS fingerprints, JWT claims, cookies, and session headers, Malicious user detection maintains visibility over the same attacker as IP addresses shift.

Second, it stitches together faint reconnaissance probes that look harmless individually. Third, because Artex generates novel scripts on the fly with no existing signature, tracking behavioral momentum over time stops zero-day attack sequences automatically. In our lab simulations, pairing malicious user detection with AI-powered WAF reduced attack success by more than 70%.

Establishing continuous trust at the edge

Because agentic AI attacks are executed through scripts, headless browsers, and automation frameworks carrying out the LLM’s commands, static rules alone cannot survive. Security leaders must establish continuous runtime trust—verifying whether the entity interacting with your applications and APIs is genuinely human or an automated machine. F5 Distributed Cloud Bot Defense exposes agentic automation at the edge by inspecting client telemetry across four distinct vectors:

• Virtual machine hardware fingerprinting: Automated agents often perform heavy execution inside data-center virtual machines while routing through residential proxies to mimic consumer traffic. Advanced fingerprinting probes client hardware characteristics—revealing server-grade CPUs, memory limits, and GPUs that distinguish data center virtual machines from consumer laptops or mobile devices.
• Navigational site traversal: Human users navigate websites with erratic, unpredictable patterns. Automated agents follow uniform, predetermined paths to accomplish tasks with maximum efficiency. Patented sequence detection evaluates these navigational journeys to isolate automated traversal from human behavior.
• Form interaction cadence: Whether creating accounts, testing credentials, or submitting forms, agents optimize for speed. Telemetry monitoring catches faster-than-human field entry and unnatural page scrolling that human hands cannot replicate.
• User biometrics and mouse dynamics: Even when agents attempt to mimic human cursor movements, their telemetry reveals mathematical perfection—straight trajectories, smooth arcs, and clicks centered precisely on button targets that stand in stark contrast to natural human imprecision.

When automated agents attempt to bypass perimeter defenses and target exposed interfaces, F5 Distributed Cloud API Security provides the decisive protection layer. Continuous API discovery automatically uncovers all endpoints, including undocumented shadow APIs. Strict OpenAPI schema enforcement then defines the exact data structures and authentication requirements allowed for every transaction, automatically rejecting the non-compliant, malformed payloads Artex generates during reconnaissance and ID manipulation.

Together, AI-powered WAF, malicious user detection, bot defense, and API schema enforcement cut Artex’s overall attack success by more than 90% in our lab testing. (Note: These results represent specific laboratory configurations and testing scenarios. Actual performance and mitigation rates will vary based on individual network environments and application architectures.)

Crucially, the few attempts that still succeeded in our lab involved endpoints that returned sensitive data without validating whether the requester was authorized—a stark reminder that CISOs must monitor what applications send back, not just what comes in.

Defending against the proliferation of hacking (that results from publicly available tools not designed for that purpose) requires asking hard questions: Do we have complete visibility into every exposed API and require authentication for each? Have we tested for business-logic parameter tampering? Can our systems track attackers across rapid IP rotations, and are our red teams running vetted tools in isolated environments—especially with researchers finding 62 Internet-facing Artex installations already compromised by backdoors?

AI attackers move at machine speed and adapt on their own. The enterprises that stay resilient will be those with integrated, layered defenses that adapt simultaneously across web, bot, user behavior, and API estates.

Ready to strengthen your defenses against adaptive AI threats? Explore F5 Distributed Cloud or contact F5 to schedule an AI-attack readiness assessment for your application and API estate.

About the Authors

Debrup GhoshPrincipal Product Manager | F5

More blogs by Debrup Ghosh

James LeeSenior Solution Architect | F5 (Asia Pacific)

More blogs by James Lee

Muhammad AbidSr. Director, Product Marketing, F5

Muhammad Abid is Senior Director of Product Marketing for Application Security and WAAP at F5. With over 20 years of experience scaling networking and cybersecurity businesses at Netskope, Cisco, Juniper, and Fortinet, Muhammad oversees F5’s unified WAAP portfolio, spanning WAF, API Security, Bot Defense, and Post-Quantum Cryptography.

More blogs by Muhammad Abid