> ## Content Index > Fetch the complete content index at: https://www.implicator.ai/llms.txt > Use this file to discover other available public pages before exploring further. # ARTEX Operators Leave Their Attack Kits Open to the Web - URL: https://www.implicator.ai/censys-finds-800-publicly-exposed-copies-artex-chinese-made/ - Published: 2026-11-07T11:49:07.000Z - Updated: 2026-11-07T11:49:07.000Z - Description: Its developer took the AI pentest framework offline over threat actor abuse. Copies still run on hundreds of exposed servers. - Author: Marcus Schuler - Tags: AI News, #auto Internet scanning firm Censys [observed](https://censys.com/blog/artex-agentic-asbestos/?ref=implicator.ai) 1,465 hosts running an exposed console for ARTEX, an open-source AI penetration testing framework, as of November 4, 2026\. About 650 sit in two blocks of identically configured hosting, which leaves roughly 815 distinct-looking deployments. The tool has been [linked to several cyberattacks](https://techcrunch.com/2026/11/06/hundreds-of-artex-ai-hacking-tools-found-publicly-exposed-to-the-web/?ref=implicator.ai) since its public release in July. What Changed - Censys observed 1,465 hosts running an exposed ARTEX console as of November 4, 2026, which leaves roughly 815 distinct-looking deployments. - 155 of those hosts, or 10.6%, run at least one other threat that Censys detects, including Vshell, Cobalt Strike and Adaptix C2. - Censys observed 32 open directories on ARTEX hosts, exposing post-exploitation kits, stagers and implants. - The developer said ARTEX would go closed-source, but archived copies, translations and rebrands such as ScopeWeaver still circulate. AI-generated summary, reviewed by an editor. [More on our AI guidelines](https://www.implicator.ai/about/). ## An agent layer on a scanner ARTEX was published on GitHub on July 26, 2026, under the AGPL-3.0 license. Its developer, Autumn-27, also wrote ScopeSentry, a Chinese asset-discovery and vulnerability-scanning platform with more than 2,000 GitHub stars. A planner agent turns a user's goal into attack intents. Worker agents claim those intents, run tools such as nmap and write the results back. The framework works with Anthropic, OpenAI or any OpenAI-compatible model endpoint. Microsoft has described it as able to run "from reconnaissance through data exfiltration" with minimal human input. ## Two campaigns and a takedown On October 7, CrowdStrike reported that an unattributed actor using ARTEX targeted a South Korean finance company from late September to early October. The actor breached a broker-facing loan inquiry service at one bank and an employee mobile system at another, and exfiltrated data. CrowdStrike assessed with moderate confidence that the actor was a financially motivated Chinese speaker. Later in October, Microsoft linked ARTEX to a large-scale compromise of ConnectWise customer tenants. It attributed the compromise to Storm-0940, a China state-aligned actor active since 2021\. The group used ARTEX to automate scanning, password spraying and OAuth application abuse. It attempted sign-ins to more than 2,250 tenants, peaking at 2,900 attempts per minute. FREE AI BRIEFING · WEEKDAYS Track the AI tools attackers put to work. Get the AI stories shaping the day, with concise context from San Francisco. The briefing takes about five minutes and arrives at 4:45 a.m. Pacific, 7:45 a.m. Eastern. Email address Keep me informed Check your inbox for the confirmation link. Free. No hype. Unsubscribe anytime. On October 8, the day after CrowdStrike's report, Autumn-27 posted a statement saying they were not involved in the attacks and that ARTEX was meant for testing within authorized asset scopes. The developer then said the project would go closed-source. The repository has since been taken down, but archived copies, translations and rebrands such as ScopeWeaver still circulate. On November 4, India's CERT-In [warned financial and cryptocurrency organizations](https://www.infosecurity-magazine.com/news/artex-activity-exceeds-reported/?ref=implicator.ai) that a group tracked as Crafty Falcon had targeted them with several AI-powered tools, including ARTEX. ## What sits beside the consoles Of the 1,465 hosts, 155, or 10.6%, run at least one other threat that Censys detects, including Vshell, Cobalt Strike and Adaptix C2\. The most common companion is another AI pentesting tool. CyberStrikeAI shares 70 hosts with ARTEX. "Operators appear to be using multiple agent frameworks side by side," wrote [Silas Cutler](https://censys.com/blog/artex-agentic-asbestos/?ref=implicator.ai), a principal security researcher at Censys. Forty-three ARTEX hosts also run self-hosted LLM gateway or reseller software. In the South Korean campaign, ARTEX ran with DeepSeek v4.1-flash as its main model, which the actor likely bought through an API reseller. Censys observed 32 open directories on ARTEX hosts, exposing post-exploitation kits, stagers and implants. For defenders, Censys says, the more useful finding is that this mistake is not unusual. One exposes an operator's entire home directory, including .ssh, .bash\_history and the ARTEX install. Most were active for only hours to a couple of days. Between November 3 and November 5, 10 closed and 15 new ones appeared. Know someone who'd find this useful? [✉️ Email it to a friend in one click](mailto:?subject=A%20newsletter%20I%20think%20you%27d%20like&body=This%20is%20one%20of%20maybe%20three%20newsletters%20I%20actually%20read.%20The%20rest%20just%20pile%20up%2C%20unread%2C%20judging%20me.%0A%0AAnd%20yes%2C%20this%20email%20mostly%20wrote%20itself%2C%20which%20is%20a%20little%20on%20the%20nose%20for%20an%20AI%20newsletter.%20Doesn%27t%20make%20it%20wrong.%20implicator.ai%20is%20good.%0A%0ASubscribe%20free%3A%20https%3A%2F%2Fwww.implicator.ai%2Fsubscribe%2F%3Futm%5Fsource%3Dnewsletter%26utm%5Fmedium%3Dforward%26utm%5Fcampaign%3Demail%5Fforward), or they can [subscribe free here](https://www.implicator.ai/subscribe/?utm%5Fsource=newsletter&utm%5Fmedium=forward&utm%5Fcampaign=forward%5Fto%5Fcolleague). The server named in CrowdStrike's report had open directories visible to Censys from August 18, seven weeks before that report was published. ## What the count leaves out Censys says some of the exposed hosts are likely operated by authorized testers, and that not every ARTEX instance is run with malicious intent. Uniform configurations in the two hosting blocks suggest a provisioning template rather than hundreds of individual operators. Because the console does not require public-facing access, the overall deployment is likely higher. [Check Point researchers](https://www.infosecurity-magazine.com/news/artex-activity-exceeds-reported/?ref=implicator.ai) found AI agents in ARTEX control panels running large-scale attacks with little human input for a few hundred dollars, though the agents still fail and hallucinate successes. ## What defenders can check The console runs on port 8787 by default, with 8790 and 443 common. Censys suggests checking the same host for open directories, Vshell or FRP listeners and LLM proxy software. Because Censys keeps scan history, the file listings remain available after an operator takes a directory down. Frequently Asked Questions What is ARTEX? An open-source AI penetration testing framework published on GitHub on July 26, 2026\. A planner agent turns a user's goal into attack intents, and worker agents run tools such as nmap. It works with Anthropic, OpenAI or any OpenAI-compatible model endpoint. Which attacks has ARTEX been linked to? CrowdStrike reported that an unattributed actor using ARTEX targeted a South Korean finance company from late September to early October. Microsoft linked ARTEX to a large-scale compromise of ConnectWise customer tenants and attributed it to Storm-0940. Are all exposed ARTEX hosts run by attackers? No. Censys says not every ARTEX instance is run with malicious intent and some exposed hosts are likely operated by authorized testers. Uniform configurations in two hosting blocks suggest a provisioning template rather than hundreds of individual operators. What can defenders look for? The console runs on port 8787 by default, with 8790 and 443 common. Censys suggests checking the same host for open directories, Vshell or FRP listeners and LLM proxy software. Is the ARTEX code still available? The developer said the project would go closed-source, and the repository has since been taken down. Archived copies, translations and rebrands such as ScopeWeaver still circulate. AI-generated summary, reviewed by an editor. [More on our AI guidelines](https://www.implicator.ai/about/). [OpenAI's Hacking Model Learns to Stay in Its LaneOpenAI released GPT-6 Cyber, a model trained to stay within the scope researchers authorize, on Thursday, Nov. 5, to a select group of customers in Daybreak Red, its access tier for vetted offensive sThe Implicator![](https://www.implicator.ai/content/images/2026/11/20261105-122659-openai_cyber_lane.webp)](https://www.implicator.ai/openai-gpt-6-cyber-stays-in-scope/) [OpenAI pauses tool-use training; AWS traces why AI agents actedIMPLICATOR .ai Morning Briefing · From San Francisco Monday, September 28, 2026 11 stops From San Francisco 1 The Editorial Marcus here. People still have to chThe Implicator![](https://www.implicator.ai/content/images/2026/09/20260927-202017-nl_training_halt.webp)](https://www.implicator.ai/openai-pause-aws-agent-tracing-hospital-ai-coding/) [OpenAI and Anthropic Probe Tens of Thousands of Incidents as OpenAI Halts TrainingOpenAI, Anthropic and security researchers are investigating tens of thousands of incidents in which advanced models acted beyond intended limits, while OpenAI has paused training of its most capable The Implicator![](https://www.implicator.ai/content/images/2026/09/20260927-193344-openai_training_pause.webp)](https://www.implicator.ai/openai-anthropic-tens-of-thousands-incidents-pause/)