In a statement published October 30, the Dutch Institute for Vulnerability Disclosure (DIVD) said ARTEX was used in an attack against the institute. DIVD reported more than 450,000 requests, more than 2,500 scripts and a no-expiry administrative API token, along with activity across email, the internal network and credentials. DIVD’s account describes an incident-specific footprint, not a general performance measure for ARTEX.

DIVD’s account of the activity

ARTEX is an open-source, agentic penetration-testing framework: software that can use a chosen AI model to plan and carry out security-testing tasks. DIVD said the framework was used in its attack and described several activities running at once. The agent read a mailbox nine times, scanned the internal network, contacted other internal systems, attempted password resets for DIVD addresses at its hosting provider and accessed login tokens in a database.

The reported totals were more than 450,000 requests and more than 2,500 scripts. DIVD compared the script count with its estimate that a human attacker would need 20 to 30 scripts. Those numbers describe DIVD’s incident; they are not standardized measurements of ARTEX.

DIVD also said the agent created an administrative API token for itself with no expiration. The institute said the token could preserve access without relying on the exploit.

The reported route to root

DIVD said the attack went from initial access to root privileges in 12 minutes by chaining two zero-day vulnerabilities in Zammad, including one used for local privilege escalation. It put the privilege-escalation step at about one minute.

Other ARTEX reports describe separate activity

DIVD cautioned that ARTEX appearing in other reported attacks did not mean those incidents were connected. Separately, Unit 42 reportedly observed intrusion attempts against multiple targets that likely used ARTEX or a framework derived from it between September 24 and October 27, 2026.

Unit 42 also tracked CL-UNK-1211, a distinct campaign against government-associated Linux infrastructure, during October 2025 through April 2026. NeoTeo’s earlier coverage of the Linux campaign describes that separate activity.