More than 800 copies of an AI-powered hacking tool are sitting exposed on the open internet, ready for anyone to use. Security researchers at Censys found deployments of ARTEX, an open-source autonomous penetration testing framework, accessible from the web with no password required, and the same tool has already been linked to major cyberattacks against banks and a large IT provider.

Censys reported on November 5 that it observed 1,465 hosts running an exposed ARTEX console as of November 4. About 650 of those hosts sit in two blocks of identically configured hosting, which leaves roughly 815 distinct-looking deployments. The console does not need to be reachable from the public internet, so every one of those exposures is a misconfiguration, not a requirement of the software.

What Is ARTEX?

ARTEX is an open-source, LLM-driven autonomous penetration testing framework. It was published on GitHub on July 26, 2026 by a developer using the handle Autumn-27, under the AGPL-3.0 license. The same developer built ScopeSentry, a widely used Chinese asset-discovery platform, and ARTEX works as an AI agent layer on top of it.

The tool works by splitting a break-in into jobs for several AI agents. A Planner agent turns the operator’s goal into attack intents, Worker agents claim those intents and run real tools such as nmap, and an event-driven engine repeats the explore, decide and execute loop until the goal is met. It works with Anthropic, OpenAI or any OpenAI-compatible model endpoint. Microsoft has described ARTEX as a system of AI agents that can conduct cyberattacks “from reconnaissance through data exfiltration with little needed human interaction”.

How ARTEX works: a Planner agent turns a goal into attack intents and Worker agents run real tools until the goal is met.

How ARTEX works: a Planner agent turns a goal into attack intents and Worker agents run real tools until the goal is met. Image: Censys.

Linked to Real Attacks

Two threat intelligence reports in October tied ARTEX to active campaigns.

On October 7, CrowdStrike reported that an unattributed actor used ARTEX to target the South Korean finance industry from late September to early October. The actor, assessed with moderate confidence to be a financially motivated Chinese speaker, breached a broker-facing loan inquiry service at one bank and an employee mobile system at another, and exfiltrated data. The actor ran ARTEX with DeepSeek v4.1-flash as its main model, and CrowdStrike found the activity because the actor had left an open directory exposing its configuration files, prompts and session histories. Censys said its scan history shows that directory had been publicly exposed since August 18, seven weeks before CrowdStrike published its report.

On October 21, Microsoft attributed the ConnectWise Cloud Backup supply chain compromise to Storm-0940, a China state-aligned actor active since 2021. The group used ARTEX to automate scanning, password spraying and OAuth application abuse, attempting sign-ins to more than 2,250 tenants and peaking at 2,900 attempts per minute. In one password spray campaign alone, Microsoft recorded more than 151,000 failed logons against 327 accounts across eight organizations. Microsoft said some victims saw privileged cloud access in under three hours, and that it has seen multiple actors across regions using ARTEX. GPTOnline previously covered that attack in detail.

Many of the attacks linked to ARTEX exploited simple weaknesses, TechCrunch noted, such as weak or known passwords and a lack of multi-factor authentication.

Why the Exposure Matters

The exposed consoles are dangerous on their own, but Censys found the problem runs deeper. Of the 1,465 ARTEX hosts, 155 (10.6%) also run at least one other threat that Censys detects, including the command-and-control tools Vshell and Cobalt Strike, the Adaptix C2 listener, and the AI attack framework CyberStrikeAI, which shares hosts with ARTEX on 70 machines. Operators appear to be stacking multiple agent frameworks side by side.

Censys also found 32 open directories on ARTEX hosts, exposing post-exploitation kits, stagers and implants, including Windows lateral movement tools, a public sudo exploit, implant builds and reverse shell scripts. In one case, an operator’s entire home directory was exposed, including its SSH keys, shell history and the ARTEX install itself. Most of these directories stay up only for hours or a couple of days, but Censys keeps scan history, so the file listings remain available after the operator takes a directory down.

The exposed hosts are concentrated in a few countries. The United States hosts the most, with 726, followed by Hong Kong with 387 and China with 177. Japan, Singapore and South Korea account for 51, 38 and 21 hosts respectively.

Exposed ARTEX consoles by country, as observed by Censys on November 4, 2026.

Exposed ARTEX consoles by country, as observed by Censys on November 4, 2026. Chart: GPTOnline, using Censys figures.

What Happens Next

Not every exposed ARTEX instance is operated with malicious intent. Silas Cutler, principal security researcher at Censys, told TechCrunch that many are used for authorized testing. But he added that it is unclear why hundreds of these systems are exposed to the web at all, since the software does not require public access.

On October 8, the day after CrowdStrike published its report, the ARTEX author posted a statement saying he was not involved in the attacks and that the tool was meant for authorized testing. He said the project would go closed-source with no further releases, and the repository has since been taken down. Archived copies, translations and rebrands such as ScopeWeaver are still circulating, however, and TechCrunch reported that dozens of copies of the code remain available on code sharing sites.

The findings underline a pattern defenders keep running into: the same AI agent frameworks that automate legitimate security testing can be picked up, left exposed and turned against new targets with almost no human effort. For organizations, the lesson is the oldest one in security: an AI tool left open to the internet is an invitation.

Why It Matters

ARTEX shows how quickly offensive AI tooling moves from a public release to real-world attacks. Within about ten weeks of its July release, the framework had been used against financial institutions and in a supply chain compromise affecting thousands of cloud tenants. The Censys findings add a second layer: the tools themselves are now left exposed in the hundreds, giving anyone with a browser a working AI hacking kit and, in dozens of cases, the implants and credentials to go with it.

Sources