Censys Finds 800+ Passwordless Artex AI Pentest Deployments
Censys found more than 800 Artex deployments accessible from the internet without passwords, according to TechCrunch; TechRadar reported an updated scan of 1,465 exposed hosts. Artex is an open-source autonomous penetration-testing tool that combines AI agents with reconnaissance, and some exposed instances also ran offensive tools such as Cobalt Strike, Vshell, or Adaptix C2. Microsoft and CrowdStrike have linked Artex use to attacks involving South Korean financial institutions and ConnectWise Cloud Backup customer environments, while Censys said not every exposed instance was malicious.
The findings show that misconfigured AI-assisted offensive-security deployments can expose attack infrastructure, sensitive files, and operational data to anyone who discovers them online.
Security researchers have discovered hundreds of copies of a Chinese-made AI hacking tool publicly exposed to the internet for anyone to access, potentially allowing outsiders to launch cyberattacks against unsuspecting targets.
The hacking software, called Artex, is an open-source autonomous penetration testing tool, meaning software that automatically probes computer systems for weaknesses, and it’s been linked to several cyberattacks since its public release in July. As open-source software, it’s free for anyone to download and run on their own servers, making it a popular tool for those who cannot access Anthropic or OpenAI’s most advanced cybersecurity AI models for discovering security vulnerabilities. Microsoft has previously described Artex as a system of AI agents that can conduct cyberattacks “from reconnaissance through data exfiltration with little needed human interaction.”
In a blog post, cybersecurity firm Censys, which scans the internet for exposed or vulnerable systems, said that it identified more than 800 distinct deployments of Artex that were accessible from the web without needing a password to log in.
Silas Cutler, principal security researcher at Censys who wrote the blog post, said that not every instance of Artex is operated maliciously and many are used for authorized testers. But it’s unclear why hundreds of these Artex systems are exposed to the web, as the software does not require them to be accessible from the internet.
#Artex#Censys#ScopeSentry#Autumn-27#Cobalt Strike#Vshell#Adaptix C2#Microsoft#CrowdStrike#ConnectWise Cloud Backup#Storm-0940#DeepSeek v4.1-flash