Hundreds of Artex AI Hacking Tools Are Reachable From the Web Without a Password

Censys has identified more than 800 distinct deployments of Artex that can be reached from the web without a password. Artex is a Chinese-made, open-source autonomous penetration testing tool, meaning software that automatically probes computer systems for weaknesses. It was publicly released in July.

The exposure matters because the tool is built to act without an operator at the keyboard. Microsoft describes Artex as a system of AI agents, programs that plan and execute sequences of tasks on their own. According to Microsoft, these agents can carry out cyberattacks from reconnaissance (mapping a target) through data exfiltration (copying data out) with little needed human interaction. Publicly accessible Artex systems also expose attack tools such as implants, the components used to compromise a victim's network and maintain persistent access to it. Silas Cutler, principal security researcher at Censys, wrote the company's blog post on the exposed deployments.

The attacks attributed to the tool began in South Korea. CrowdStrike attributed September attacks against the South Korean finance industry to a Chinese-speaking hacker who used an Artex instance, a running copy of the software. CrowdStrike reported that the campaign was active from late September to early October 2026. Censys said the instance used in the bank attacks had been publicly exposed for months, and that its attack data reached beyond South Korean banks to payment and gaming companies. AhnLab's ASEC had separately examined exposed web services tied to ARTEX infrastructure in mid-October.

Japanese researchers said Artex, implicated in the attacks on South Korean banks, was used to target as many as 80 companies. As of late October, officials were still investigating the root cause of the latest breaches affecting South Korea's financial sector.

The campaign reached cloud customers as well. Microsoft attributed the ConnectWise supply-chain compromise, which used ARTEX agentic AI, to the threat actor Storm-0940. A supply-chain compromise means attacking a supplier in order to reach its customers. The early October attack on ConnectWise allowed Chinese-linked hackers to spy on thousands of organizations whose data is hosted in Microsoft's cloud. Microsoft said the hackers used Artex to break into customer cloud environments and steal data at such speed that defenders had little time to detect and respond.

Criminal use has also been reported outside state-linked activity. BleepingComputer reported on October 26 that a former pentester used ARTEX AI to steal 8.2 million data records. The Cloud Security Alliance Labs research note, titled “Multi-Agent Offensive Frameworks in the Wild: CyberStrikeAI and ARTEX,” covers the tool's multi-agent design alongside a related framework. Bloomberg separately reported that hackers are using AI models left exposed online to boost cybercrime, including data theft and the installation of cryptocurrency-mining software.

The developer's response has been mixed in direction. Artex's Chinese developer stopped public updates after the tool was linked to cyberattacks. The developer has also announced that Artex will go closed-source, with further releases limited to paid customers. That announcement describes a plan for future distribution, not a change that removes existing copies. Dozens of copies of Artex's code remain available on code-sharing sites.

The broader context here is the gap between a tool's design and its deployment. Autonomous offensive tooling is meant to be pointed at systems an organization owns, under controlled conditions. Once an instance sits on a public address without authentication, the same automation that makes it useful to a tester makes it useful to anyone who finds it, and the attacker needs little more than a scanner to locate it. The Censys figure is a count of deployments that were reachable at the time of its survey.

In my view, the immediate task for defenders is inventory. Security teams need to know whether any Artex or similar agentic framework is running in their estate, including on cloud workloads and forgotten test infrastructure, and whether its management interfaces answer from the internet. Closing the source code does little for instances already in the field, and the dozens of copies online mean the code will persist regardless of the developer's licensing decision.

There is a more hopeful reading, and it deserves equal weight. The same agentic approach that Microsoft describes in attack terms can be run by defenders against their own perimeters, at a pace that makes continuous testing practical for teams that could never afford it by hand. Whether that capability ends up on the defensive side depends on unglamorous work that has always mattered: authenticated management planes, accurate asset inventories, and the discipline to notice when a tool meant for internal testing has quietly become visible to everyone.