More than 800 copies of an AI hacking tool are sitting exposed on the open internet, with no password in front of them. The tool is called Artex, an open-source system that uses AI agents to probe computer systems for weaknesses on its own. Censys, the firm that scans the internet for exposed systems, reported on November 5, 2026, that it found 1,465 hosts running an exposed Artex console, and that about 815 of them look like distinct deployments. The same tool was already linked to two attacks in October: one against South Korean financial firms, and one that let hackers spy on thousands of organizations through ConnectWise.
What Artex is
Artex was published on GitHub on July 26, 2026, under the AGPL-3.0 license, by a developer known as Autumn-27, who also wrote ScopeSentry, a widely used asset-discovery and vulnerability-scanning platform with more than 2,000 GitHub stars. It is best understood as an AI agent layer on top of that reconnaissance foundation: it syncs the domains, subdomains, IP addresses, ports, and endpoints ScopeSentry finds into its own asset graph, then sets agents loose on them. A planner agent turns a goal, such as gaining admin panel access, into attack intents. Worker agents claim those intents, run tools like nmap, which ships in the Docker image, and write results back. An event-driven engine repeats the explore, decide, and execute loop until the goal is met. It works with Anthropic, OpenAI, or any OpenAI-compatible model endpoint. Microsoft describes it as able to run from reconnaissance through data exfiltration with little human interaction. The project grew to an estimated 1,500 to 2,000 GitHub stars within ten weeks of release.
The exposure count, honestly counted
The headline number needs reading carefully, because Censys did the careful reading itself. As of November 4, 2026, it observed 1,465 hosts running an exposed Artex console. About 650 of those sit in two blocks of identically configured hosting, 493 hosts on PEG Tech and 157 on Yancy Limited, which suggests a provisioning template repeated across many addresses rather than hundreds of individual operators. Excluding them leaves roughly 815 distinct-looking deployments. The console does not require public-facing access at all, and overall global deployment is likely higher than what is visible. The most common console port is 8787, the Artex default, with 1,931 endpoints, followed by 8790, 443, and 80. The United States hosts nearly half of the exposed systems, 726 of 1,465, or 49.6 percent by ByteHerald's arithmetic, followed by Hong Kong with 387 and China with 177.
What sits alongside Artex on those hosts is the more alarming half of the finding. Of the 1,465 hosts, 155, or 10.6 percent, also run at least one other threat Censys detects. The most common companion is another AI pentesting tool: CyberStrikeAI shares hosts with Artex on 70 of them, and PentAGI, HexStrike AI, and RedAmon also appear. A smaller set pairs Artex with established command-and-control tools, including Cobalt Strike teamservers, Adaptix C2 listeners, and Vshell. And 32 open directories run on Artex hosts today, exposing post-exploitation kits, stagers, and implants: a Windows lateral-movement kit, a public sudo exploit with heap dumps, three Linux implant builds with reverse-shell scripts, a compiled Windows stager, about 18 HTA droppers with a man-in-the-middle root certificate private key, and one operator's entire home directory, including the .ssh folder and shell history. Most of these directories stay up for hours to a couple of days. Between November 3 and November 5, 10 closed and 15 new ones appeared. That is about 1 in 26 distinct deployments leaking its toolkit, by ByteHerald's arithmetic from 32 open directories against 815 deployments.
| Measurement | Observed | Source |
|---|---|---|
| Exposed Artex consoles | 1,465 hosts | Censys, November 4, 2026 |
| Distinct-looking deployments | About 815 | Censys, after excluding two template blocks |
| Hosts with another detected threat | 155 (10.6 percent) | Censys |
| Open directories leaking tools | 32 | Censys |
| Hosts in the United States | 726 (49.6 percent) | Censys |
Two attacks already used it
Not every exposed instance is operated maliciously, and some are likely run by authorized testers. The two October campaigns show what the malicious ones do. On October 7, 2026, CrowdStrike reported that an unattributed actor used Artex against South Korean financial institutions from late September to early October. The actor ran Artex on a host at 38.244.50.120 with DeepSeek v4.1-flash as its main model, bought through an API reseller, breached a broker-facing loan inquiry service at one bank and an employee mobile system at another, and exfiltrated data. CrowdStrike found the activity because the actor left open directories exposing a .claude folder, prompts, session histories, and Artex configuration files. Censys found those directories had been exposed since August 18, 2026, seven weeks before CrowdStrike's report, and that the file names showed targets well beyond South Korean banks, including payment and gaming companies.
On October 21, 2026, Microsoft attributed the ConnectWise Cloud Backup supply-chain compromise to Storm-0940, a China state-aligned actor active since 2021. The group used Artex to automate scanning, password spraying, and OAuth application abuse, attempted sign-ins to more than 2,250 tenants, peaked at 2,900 attempts per minute, and reached privileged cloud access in under three hours for some victims, letting the hackers spy on thousands of organizations whose data sits in Microsoft's cloud. Microsoft noted it has seen multiple actors across regions using Artex. Many of the attacks linked to the tool exploited simple weaknesses: guessing weak or known passwords, and a lack of multi-factor authentication.
What happens next, and how to check
The author posted a statement on October 8, the day after CrowdStrike's report, saying they were not involved in the attacks, that Artex was meant for testing within authorized asset scopes, and that the project would go closed-source with no further releases. The repository has since been taken down, but archived copies, translations, and rebrands such as ScopeWeaver are still circulating, and dozens of copies of the code remain available on code-sharing sites. Going closed-source stops new releases. It does not recall the copies already out.
For defenders, the check is straightforward and Censys publishes it: look for consoles matching the Artex page title together with Next.js static assets, watch the default port 8787 and the common alternates 8790, 443, and 80, and pivot from any hit to co-located open directories, Vshell or FRP listeners, and unfamiliar LLM proxy software such as CLIProxyAPI and New API, which appeared on 43 Artex hosts. The deeper lesson is the one our 2026 security report card keeps returning to: the breach rarely starts with a novel exploit. It starts with something left open, something left with a weak password, or something left without multi-factor authentication, and an automated tool that never gets tired of trying the door.
By ByteHerald Staff. Censys, November 5, 2026, reported 1,465 hosts running an exposed Artex console as of November 4, 2026, with about 815 distinct-looking deployments after excluding two identically configured hosting blocks. CrowdStrike, October 7, 2026, reported an unattributed actor used Artex against South Korean financial institutions, with the tool running DeepSeek v4.1-flash on host 38.244.50.120. Microsoft, October 21, 2026, attributed the ConnectWise compromise to Storm-0940, which used Artex to attempt sign-ins to more than 2,250 tenants at up to 2,900 attempts per minute.
Comments
Post a Comment