ARTEX is an open-source, AI-driven penetration testing framework that a GitHub user called “Autumn-27” published on July 26, 2026. In a little over three months it went from hobby project to a tool tied to real intrusions, and now to an internet-wide count of who is running it. Censys, the internet-scanning firm, reported on November 5 that 1,465 hosts matched its fingerprint for the ARTEX web console. After setting aside about 650 hosts on two hosting providers with identical templated setups, it estimated about 815 distinct deployments.
Those consoles are reachable from the web, and TechCrunch reported that more than 800 of them could be accessed without a password. Censys titled its research “Agentic Asbestos,” and the label fits: something useful that becomes hazardous once it is everywhere and poorly contained.
I think the lesson here is less about AI inventing new attacks than about AI making old ones cheap and fast. The tool is new. The weaknesses it exploited, and the sloppiness of many people running it, are not.
What ARTEX does
ARTEX is written in Go with a web console, according to Censys. An operator sets a task with a scope and a goal; a planner agent breaks the goal into steps, and worker agents run standard tools such as the nmap scanner and record what they find. In other words, it automates the grind of reconnaissance and follow-up that used to take a team of people.
Censys’s count shows the deployments are concentrated in the U.S. (726 hosts), Hong Kong (387) and China (177). About 155 of the hosts, or 10.6 percent, also ran other attack infrastructure Censys tracks, including Cobalt Strike and Vshell, and 32 had open directories holding post-exploitation kits and implants, the report says.
The attacks it has been tied to
CrowdStrike linked ARTEX to an actor that targeted South Korean financial companies from late September into early October, breaching a loan-inquiry service at one bank and an employee mobile system at another, Censys summarized. At least nine Korean financial institutions were reportedly hit or targeted, Korea JoongAng Daily reported, citing Reuters.
Microsoft has tied the tool to a larger case. It says Storm-0940, a group it describes as aligned with the Chinese state, used ARTEX in a supply-chain compromise involving ConnectWise’s cloud backup service, and Censys notes that more than 2,250 customer tenants were targeted. Microsoft described the tool as covering an attack “from reconnaissance through data exfiltration,” TechCrunch reported.
The developer took ARTEX closed-source in October, citing “misuse of the tool,” JoongAng Daily reported, and has said they were not involved in the attacks. That did not put the genie back. Archived copies and rebrands are still circulating, Censys says, and Infosecurity Magazine points to forks including a commercial “ARTEX PRO.”
The Hacker News flagged a further twist: some copies in circulation are themselves booby-trapped.
‼️ A backdoored AI hacking tool is exposing servers to root access without authentication.
A malicious Docker image for ARTEX hides a root shell in its login handler.
Researchers found 62 internet-facing consoles running the backdoored build.
Read: https://t.co/JiUtfukLWG
— The Hacker News (@TheHackersNews) November 5, 2026
The old doors it walked through
Here is the part that matters most for defenders. Many of the attacks linked to ARTEX relied on guessing weak or already-known passwords and on accounts without multi-factor authentication, TechCrunch reported. An AI agent can try those doors far faster and more persistently than a person, but it still needs the doors to be unlocked.
My take: the right response to tools like ARTEX is not panic about superhuman hackers. It is closing the gap between how fast attackers can now move and how slowly many organizations still enforce basics like MFA, credential rotation and keeping admin consoles off the open internet.
The case that the count overstates the threat
There is a fair argument that 815 exposed deployments sounds scarier than it is. ARTEX was built as a penetration testing tool, and penetration testing is a legitimate business. Censys itself says plainly that “not every ARTEX instance is operated with malicious intent.” Some of those consoles likely belong to security teams and researchers trying the tool out, and some are probably idle.
The exposure also cuts against attackers. A console that anyone can find is one that defenders can find too. Censys published hunting pivots, including the tool’s default port and the AI proxy software running alongside it, and suggested that unfamiliar AI model proxies in a company’s outbound traffic are worth a look. Visibility of this kind is exactly how researchers tied scattered incidents back to one framework.
Both points are real. But they do not change the core finding: an autonomous attack tool tied to bank breaches and a supply-chain compromise spread to hundreds of internet-facing servers within months, and closing the source did not stop it.
What I’ll be watching
I’d watch two things. First, whether the forks and commercial versions keep growing now that the original is closed, which would show that AI attack frameworks have become a product category rather than a single project. Second, whether more incident reports describe the same pattern: fast, automated intrusions that still begin with a reused password or a missing second factor. If they do, the fix is unglamorous, and it is mostly in defenders’ hands.
Related reading: PHP2Shell Hit the Software Behind 70% of Websites. Cloudflare Counted Tens of Thousands of Attacks in 45 Minutes. · Hackers Took $6.3 Billion From Binance. About $3 Billion Was Frozen Because Stablecoins Have an Off Switch. · For Two Hours, New Mexico’s Only Level 1 Trauma Center Diverted Ambulances.
