Hundreds of Artex AI hacking tools found publicly exposed to the web

Security researchers have found hundreds of servers running Artex, a Chinese-made open-source autonomous penetration testing tool, exposed to the public internet without a password. Censys, which scans for exposed systems, identified more than 800 distinct Artex deployments reachable from the web with no login required. The tool, released in July, automatically probes systems for weaknesses and is free to download and run, making it popular among people without access to Anthropic or OpenAI's most advanced vulnerability-finding cybersecurity models.

Microsoft has described Artex as a system of AI agents able to carry out cyberattacks "from reconnaissance through data exfiltration with little needed human interaction." Silas Cutler, principal security researcher at Censys and author of the blog post, said not every instance is operated maliciously, with many used by authorized testers, but he noted the software does not require internet exposure, leaving the reason for hundreds of open systems unclear. Besides misconfiguration risk, the exposed systems leak attack tools such as implants — hidden malicious software used to compromise and maintain persistent access to victim networks.

Security firms have tied Artex to several broad-scale attacks, including strikes against the Korean finance industry in September. CrowdStrike attributed those attacks to a Chinese-speaking hacker using an Artex instance, partly because the attacker left an "open directory" hosting the system. Censys said that instance appeared publicly exposed for months and held attack data extending "well beyond South Korean banks," including payment and gaming companies. Earlier in October, Artex was used in an attack on IT support firm ConnectWise, enabling Chinese-linked hackers to spy on thousands of organizations hosting data in Microsoft's cloud; Microsoft said the intrusion happened so fast defenders had "little time to detect and respond." Many of the linked attacks leaned on basic weaknesses: guessed or weak passwords and absent multi-factor authentication.

Artex has announced it will move closed-source, restricting further releases to paid customers, yet dozens of copies of its code remain on code-sharing sites and usable in active attacks.

What to watch: whether the exposed instances are cleaned up and whether closing the source meaningfully slows reuse given the code already circulating, and how defenders respond to autonomous agent tools that compress intrusion timelines for operators relying on the most basic access controls.