Censys Finds 1,465 Exposed Consoles for Artex, the AI Hacking Tool Tied to Bank Breaches

In a report published on November 5, Silas Cutler, a principal security researcher at Censys, wrote that about 650 of the exposed hosts sit in two blocks of identically configured hosting, leaving roughly 815 deployments that look distinct. TechCrunch reported that the consoles were accessible without a password. Censys said the real number of Artex installations is probably higher, because the software does not need to be reachable from the internet to work.

The exposure cuts two ways. Outsiders who find an open console could use someone else's AI attack system against new targets, and the same misconfiguration gives defenders a view of attackers' infrastructure. That is how the tool first came to light in a real campaign: CrowdStrike found the activity against a South Korean finance company through an open directory on the attacker's server.

Artex is an open-source penetration testing framework driven by large language models. Censys said it was posted to GitHub on July 26 under the AGPL-3.0 licence. Microsoft has described it as a system of AI agents that can carry out attacks "from reconnaissance through data exfiltration with little needed human interaction." Because it is free to download and run, it appeals to people who cannot get access to the most advanced cybersecurity models from Anthropic or OpenAI.

Censys said 155 of the Artex hosts, or 10.6%, also run at least one other threat it tracks. These include another AI attack framework, CyberStrikeAI, found on 70 hosts, as well as command-and-control and tunnelling tools such as Cobalt Strike, Vshell, Adaptix C2 and FRP. Forty-three hosts also run self-hosted software for routing or reselling access to large language models.

The researchers found 32 open directories on Artex hosts that exposed post-exploitation kits, stagers and implants, the hidden software attackers use to keep access to a victim's network. Between November 3 and 5, 10 of those directories closed and 15 new ones appeared.

Censys also looked again at the server CrowdStrike named in its October 7 report. Its open directories were visible from August 18, about seven weeks before that report, and exposed exploit files and a folder used by Anthropic's Claude tools. CrowdStrike assessed with moderate confidence that the operator was a financially motivated Chinese speaker, and Censys said the Artex instance on that server used DeepSeek v4.1-flash as its main model. TechCrunch reported that Censys's data showed attack data on the server reaching "well beyond South Korean banks," including payment and gaming companies.

Microsoft attributed the ConnectWise Cloud Backup compromise in October to Storm-0940, a China state-aligned group active since 2021, which Censys said used Artex for scanning, password spraying and abuse of OAuth applications. The group attempted sign-ins to more than 2,250 customer tenants, at a peak of 2,900 attempts a minute, and some victims had privileged cloud access within three hours.

Many of the attacks linked to Artex exploited basic weaknesses such as weak or known passwords and missing multi-factor authentication, according to TechCrunch. Cutler told TechCrunch that not every Artex instance is malicious and that many are run by authorised testers.

After CrowdStrike's report, the developer said the project was intended for authorised testing and would go closed-source. The original repository has since been removed, but Censys said copies and rebranded versions still circulate, and TechCrunch counted dozens of copies of the code on code-sharing sites. Censys advised defenders to hunt for the console's page title and web assets on its default ports, 8787, 8790 and 443, and to check egress logs for unfamiliar AI model proxies.