---
format: "aidr-story-markdown/v1"
id: "986160d986e660b62ca4f4f6a479165289e919981b629b9aa91c996602a61630"
canonical_url: "https://aidr.today/986160d9?lang=en"
title: "Amazon's Decoy Servers Capture Memory Logs of China-Linked AI Hacking Agents"
lang: "en"
requested_lang: "en"
available_langs: ["en","vi"]
translation_fallback: null
fallback_fields: []
published_at: "2026-11-14T21:38:45.000Z"
category: "Agents"
topics: ["amazon","agent"]
source_urls: ["https://marketbrief.now/cybersecurity/amazons-decoy-servers-capture-memory-logs-of-china-linked-ai-hacking-age-c8139b2d","https://x.com/TheHackersNews/status/2118263059991134550","https://x.com/mrbcyber/status/2117568362733883643","https://x.com/FBICyberBranch/status/2121317398305186287","https://x.com/cantinasecurity/status/2121641064675279142","https://x.com/Zaddyzaddy/status/2117706637754409335","https://x.com/blackroomsec/status/2118103866394775661","https://x.com/p_misirov/status/2117676598866714972"]
summary: "Decoy servers captured the operating memory and attack logs of autonomous hacking agents between Oct. 3 and Nov. 5. Amazon has moderate confidence the agents were operated by several separate China-linked groups using the open-source ARTEX framework. The agents attempted to bypass identity checks of two cryptocurrency exchanges by injecting real-time deepfakes into selfie authentication requests."
---

# Amazon's Decoy Servers Capture Memory Logs of China\-Linked AI Hacking Agents

> [Open the canonical story](<https://aidr.today/986160d9?lang=en>)

**Published:** 2026-11-14T21:38:45.000Z
**Category:** Agents
**Topics:** amazon, agent

## Summary

Decoy servers captured the operating memory and attack logs of autonomous hacking agents between Oct\. 3 and Nov\. 5\. Amazon has moderate confidence the agents were operated by several separate China\-linked groups using the open\-source ARTEX framework\. The agents attempted to bypass identity checks of two cryptocurrency exchanges by injecting real\-time deepfakes into selfie authentication requests\.

## Sources

- [Story source](<https://marketbrief.now/cybersecurity/amazons-decoy-servers-capture-memory-logs-of-china-linked-ai-hacking-age-c8139b2d>)
- [Story source](<https://x.com/TheHackersNews/status/2118263059991134550>)
- [Supporting source](<https://x.com/mrbcyber/status/2117568362733883643>)
- [Story source](<https://x.com/FBICyberBranch/status/2121317398305186287>)
- [Supporting source](<https://x.com/cantinasecurity/status/2121641064675279142>)
- [Supporting source](<https://x.com/Zaddyzaddy/status/2117706637754409335>)
- [Supporting source](<https://x.com/blackroomsec/status/2118103866394775661>)
- [Supporting source](<https://x.com/p_misirov/status/2117676598866714972>)