# On the hunt for ARTEX: understanding agentic attacks in AWS environments

Source: [Datadog Security Labs](https://securitylabs.datadoghq.com/articles/artex-agentic-attacks-aws-environments/) · 2026-11-09 · Security
Page: https://themorning.dev/story/on-the-hunt-for-artex-understanding-agentic-attacks-in-aws-environments-f6c3d72a857cd75c
Kind: security · Impact: high

## In brief

- Datadog Security Labs reports in-the-wild activity from ARTEX, an AI-native penetration framework, against AWS environments.
- The observed activity includes CloudWatch log hunting using compromised access keys.
- The activity also includes abuse of public Cognito user pools.

## Why it matters

Teams running workloads on AWS should check whether access keys are exposed and whether CloudWatch logs and Cognito user pools are configured in ways this activity exploits.

## Timeline

- 2026-11-09: Datadog Security Labs published its report on ARTEX agentic attacks in AWS environments

## Coverage

- [On the hunt for ARTEX: understanding agentic attacks in AWS environments](https://securitylabs.datadoghq.com/articles/artex-agentic-attacks-aws-environments/) — Datadog Security Labs, 2026-11-09

Tags: security, aws, penetration-testing, cloudwatch, cognito, ai-attacks

---

Brief generated by AI (claude-haiku-5-5) from the reporting listed under Coverage. Headlines belong to their publishers. The Morning Dev – https://themorning.dev