Hunt: how to spot ARTEX and other AI pentest agents by behavior, from Unit 42's intrusion cases

vendor research (Palo Alto Networks Unit 42, Nov 11, 2026)2026-11-11 7:41 PM ET

Think-then-act cadence: bursts of 1 to 14 requests about a second apart, then 25 to 31 second pauses (waiting on model inference).
Machine speed: pivots within about a minute of a credential download; 200+ client secrets validated in about three minutes.
Spec-driven: routes from downloaded OpenAPI specs and source maps hit almost immediately; failed HTTP 422 requests fixed and retried moments later.
Self-checks and canaries: a GET after nearly every successful write, write-then-delete tests on storage buckets, bogus usernames before real ones, placeholders like evil[.]com, test@example[.]com, deadbeefdeadbeefdeadbeef12.
Breadth and loops: ADC, a dozen VPN appliances, NAS, workforce identity and cloud ports hit within the same hour; polling every 48 seconds for days.
Fixes Unit 42 lists: pull OpenAPI specs, source maps and token-bearing config off public apps; require auth on every write endpoint including dev and staging; rate-limit and bot-protect registration and password reset; never let a reset unlink a federated identity; replace long-lived cloud keys with roles.