Censys Finds About 815 Distinct Artex AI Hacking Consoles Exposed Online Without a Password

Censys counted 1,465 hosts with an exposed Artex console as of November 4. About 650 of them sit in two blocks of identically configured machines at two hosting providers, which the company treats as likely provisioning templates, leaving roughly 815 deployments that look distinct. The real number of installations is probably higher, Censys said, because the console does not need to be reachable from the public internet to work.

The findings put a number on how widely an autonomous attack tool has spread in the four months since it appeared. Artex was published on GitHub on July 26 under an open-source licence by a developer who also wrote ScopeSentry, a Chinese asset-discovery and vulnerability-scanning platform. It works as an agent layer on top of that reconnaissance data: a planner agent breaks a goal into attack steps and worker agents run tools such as the nmap network scanner, looping until the goal is reached. It can run on models from Anthropic, OpenAI and OpenAI-compatible providers. Microsoft has described it as able to carry out attacks "from reconnaissance through data exfiltration" with little human involvement.

Not every exposed console belongs to a criminal. Silas Cutler, the Censys principal security researcher who wrote the report, told TechCrunch that many are used by authorised penetration testers. But 155 of the hosts, or 10.6%, also run at least one other tool Censys flags as a threat, including the Cobalt Strike and Vshell command-and-control frameworks. By Censys's count, 726 of the hosts are in the United States, 387 in Hong Kong and 177 in mainland China.

The tool has already been linked to real intrusions. CrowdStrike reported on October 7 that a financially motivated actor, assessed with moderate confidence to be a Chinese speaker, used it against South Korean finance companies from late September into early October, breaching a broker-facing loan inquiry service at one bank and an employee mobile system at another. On October 21 Microsoft attributed a supply-chain compromise of ConnectWise's cloud backup service to Storm-0940, a group it describes as China state-aligned, which used Artex to attempt sign-ins to more than 2,250 customer tenants at up to 2,900 attempts a minute.

Censys said it first saw open directories on the server named in CrowdStrike's report on August 18, about seven weeks before that report came out. Files left there, including prompts and session histories, pointed to targets beyond Korean banks, among them payment and gaming services. On 32 other Artex hosts, Censys found open directories holding lateral-movement kits, a public privilege-escalation exploit, implant builds and other attack tooling.

The developer said on October 8 that Artex was meant only for authorised testing and that the project would go closed-source with no further public releases. The repository has since been removed, but archived copies, translations and rebranded versions such as ScopeWeaver are still circulating, Censys said. TechCrunch noted that many of the attacks tied to the tool exploited basic weaknesses such as weak or known passwords and missing multi-factor authentication.

Censys advised defenders to look for Artex's default console port, 8787, and to check outbound traffic for unfamiliar AI model proxies and resellers, which attackers have used to buy model access.