Amazon captures AI agents’ records of credential theft and deepfake fraud attempts

The agents’ records described a self-feeding attack: steal access to AI models, then use that access to hunt for more credentials. Amazon Threat Intelligence published the findings on November 13, alongside evidence of deepfake identity-fraud attempts. But its researchers captured the agents’ accounts of their work—not independent proof that their reported attacks succeeded.

Between October 3 and November 5, 2026, Amazon’s MadPot network of decoy threat sensors posed as AI model interfaces. Agents treated those interfaces as services that could process their requests, sending prompts containing working memory from offensive campaigns.

Those requests exposed instructions, tool histories, reported discoveries and shared operational memory. Individual requests could carry a campaign’s full history, including activity on systems outside MadPot’s view. That gave Amazon a detailed window into the operators’ goals and workflows, rather than a verified tally of compromised victims.

Amazon attributed the campaigns with moderate confidence to ARTEX, an open-source framework for testing systems for security weaknesses. It also assessed, with moderate confidence, that separate Chinese-linked groups were involved, citing language, time-zone settings, targeting and tooling.

Stolen keys as the operating budget

The credential campaign followed a repeatable process: locate exposed AI applications, extract keys granting access to their model providers, check whether the keys worked, and collect them in a managed pool. The records described feeding stolen keys into the framework’s own model gateway to power further searches.

Applications holding credentials for several providers were especially attractive: one weak management interface could expose multiple downstream accounts. The recorded playbook covered default passwords, unprotected management endpoints, unpatched software and secrets left in code or public files. Discovery also drew on internet scanning services, software packages and container images.

Human operators supplied standing instructions, including country order, targeting priorities and restrictions. One operation favored enterprise production sites over personal projects and graded credentials from an initial lead to working access and measurable impact. Planner, worker, verification and compression agents divided tasks, using a shared memory store to pass findings between them.

Deepfakes met a server-side rejection

The second campaign targeted identity checks at two cryptocurrency exchanges. Its records described real-time deepfake video for live selfie checks and forged identity-document images. Agents examined how one verification vendor tracked faces and instructed users to move during a check designed to establish that a living person was present.

The best recorded attempt completed the movement sequence with the face within seven pixels of its target. Yet the vendor’s server-side check rejected every deepfake attempt recorded by the agents. Another session recorded a deepfake pipeline running at 11.5 frames per second on one consumer-grade graphics processor.

The document work targeted file-level signs of editing, including camera metadata and compression details. At least four agent sessions worked concurrently on cashing out, clearing balances, video generation and verification bypass, sharing findings through cross-session tools.

The immediate work for defenders

• Secure AI applications, model gateways and inference endpoints under the same controls as other production systems. Address exposed secrets, default credentials, unauthenticated interfaces and missing patches.
• Monitor unexpected AI-service spending and unusual usage, which Amazon recommends watching for signs of misuse.

Amazon notified potentially affected AWS customers where its assessment warranted it. It also published indicators of compromise so organizations running the targeted technologies can check their own environments.