More than 1,400 copies of ARTEX, an AI system that runs cyberattacks on its own, are sitting exposed on the open internet without a password, and anyone who finds one can take it over. A scan completed this week counted 1,465 reachable consoles, or about 815 distinct deployments once identical hosting setups are set aside. Dozens of them spill their own attack tools into the open, from implants to private keys, and one in ten shares a machine with other hacking software. The tool’s author has already pulled it from public view, but copies keep circulating.
A hacking tool that leaves its own doors open
ARTEX is an open-source framework that turns a plain-language goal, such as gaining server privileges, into a working attack. A planner agent breaks the goal into steps, worker agents run scanning and intrusion tools, and the system repeats the loop until the job is done. It was published on GitHub in late July.
The framework quickly drew attention from security researchers and attackers alike. Microsoft has described it as able to run from reconnaissance through data theft with little human input, and investigators have tracked it in attacks on banks, a cloud backup supplier and customers’ cloud accounts.
1,465 consoles, 815 deployments
Censys, a company that scans the internet for exposed systems, counted 1,465 hosts running an ARTEX console on November 4. About 650 of those sit in two blocks of identically configured hosting, which leaves roughly 815 deployments that look distinct. The console does not need to face the internet at all, so the true number of installations is likely higher.
The United States hosts the largest share, with 726 consoles, followed by Hong Kong with 387 and China with 177. Most consoles run on the tool’s default port, and the Chinese-language interface dominates, though English, Korean, Japanese, Russian and Portuguese versions also appear. Two hosting providers account for about 44 percent of the hosts between them.
Open directories full of attack tools
The exposure goes beyond the consoles themselves. Censys found 32 open directories on ARTEX hosts, spilling post-exploitation kits, password-cracking scripts, implant builds and, in one case, an operator’s home directory, including private SSH keys and shell history. Most of these directories stayed up for only hours or a couple of days, but new ones kept appearing as old ones closed.
One in ten of the hosts also runs at least one other threat the scanner detects, including command-and-control servers, tunneling tools and other AI attack frameworks. In several cases ARTEX sits beside Cobalt Strike, a long-established tool for controlling compromised machines, or beside Vshell, a remote-access implant. Operators appear to be stacking several agent frameworks side by side.
The same mistake that exposed the attackers
The pattern is familiar from the attacks themselves. CrowdStrike found the operator behind a campaign against South Korean banks because he had left an open directory on his own server, exposing prompts, session histories, configuration files, target files and agent transcripts.
Censys traced that same host and found it had been exposed since August 18, seven weeks before CrowdStrike’s report, with files reaching well beyond banks into payment and gaming companies. The same carelessness keeps showing up across the exposed fleet: the tools meant to break into other people’s machines are themselves left unlocked.
Our Read
This is the fourth distinct ARTEX finding in about a month, and it is the most useful one for defenders. The earlier reports showed what the tool can do to a victim; this one shows how to find the tool itself.
A console on its default port, an open directory, or a co-located command server is a detection opportunity, and the query Censys uses to spot ARTEX consoles is published openly. Defenders should treat unfamiliar AI agent traffic and unknown model gateways in their logs as worth investigating, not as background noise.
The security industry is already pricing in this risk. Palo Alto Networks is in talks to buy Clutch, a startup that guards the credentials AI agents use inside companies, for about $500 million. The deal is unconfirmed, but the logic is clear: as agents gain the keys to corporate systems, controlling the agents becomes a product in itself.
Why It Matters
Offensive AI has a supply chain, and this week it turned out to be as sloppy as its victims’. The same misconfigurations that let ARTEX into its targets — open ports, default settings, forgotten directories — now expose the attackers’ own infrastructure to anyone scanning the internet.
That cuts both ways. Defenders gain a way to map the threat before it reaches them, but so does any rival operator looking for a ready-made attack kit — and the exposed directories hand over working implants, not just a shopping list. Closing these consoles down is now as urgent as patching the flaws the tool exploits.
Background
ARTEX was published on GitHub in late July 2026 by a developer known as Autumn-27, and its author announced in October that the project would go closed-source. The repository has since been taken down, but archived copies and rebranded versions keep circulating, and the framework’s earlier outings included a campaign against South Korean banks and an attack on ConnectWise.
Source: Censys research and TechCrunch report
0 Comments