ARTEX Operators Leave Their Attack Kits Open to the Web

Internet scanning firm Censys observed 1,465 hosts running an exposed console for ARTEX, an open-source AI penetration testing framework, as of November 4, 2026. About 650 sit in two blocks of identically configured hosting, which leaves roughly 815 distinct-looking deployments. The tool has been linked to several cyberattacks since its public release in July.

An agent layer on a scanner

ARTEX was published on GitHub on July 26, 2026, under the AGPL-3.0 license. Its developer, Autumn-27, also wrote ScopeSentry, a Chinese asset-discovery and vulnerability-scanning platform with more than 2,000 GitHub stars.

A planner agent turns a user's goal into attack intents. Worker agents claim those intents, run tools such as nmap and write the results back. The framework works with Anthropic, OpenAI or any OpenAI-compatible model endpoint. Microsoft has described it as able to run "from reconnaissance through data exfiltration" with minimal human input.

Two campaigns and a takedown

On October 7, CrowdStrike reported that an unattributed actor using ARTEX targeted a South Korean finance company from late September to early October. The actor breached a broker-facing loan inquiry service at one bank and an employee mobile system at another, and exfiltrated data. CrowdStrike assessed with moderate confidence that the actor was a financially motivated Chinese speaker.

Later in October, Microsoft linked ARTEX to a large-scale compromise of ConnectWise customer tenants. It attributed the compromise to Storm-0940, a China state-aligned actor active since 2021. The group used ARTEX to automate scanning, password spraying and OAuth application abuse. It attempted sign-ins to more than 2,250 tenants, peaking at 2,900 attempts per minute.

On October 8, the day after CrowdStrike's report, Autumn-27 posted a statement saying they were not involved in the attacks and that ARTEX was meant for testing within authorized asset scopes. The developer then said the project would go closed-source. The repository has since been taken down, but archived copies, translations and rebrands such as ScopeWeaver still circulate.

On November 4, India's CERT-In warned financial and cryptocurrency organizations that a group tracked as Crafty Falcon had targeted them with several AI-powered tools, including ARTEX.

What sits beside the consoles

Of the 1,465 hosts, 155, or 10.6%, run at least one other threat that Censys detects, including Vshell, Cobalt Strike and Adaptix C2. The most common companion is another AI pentesting tool. CyberStrikeAI shares 70 hosts with ARTEX. "Operators appear to be using multiple agent frameworks side by side," wrote Silas Cutler, a principal security researcher at Censys.

Forty-three ARTEX hosts also run self-hosted LLM gateway or reseller software. In the South Korean campaign, ARTEX ran with DeepSeek v4.1-flash as its main model, which the actor likely bought through an API reseller.

Censys observed 32 open directories on ARTEX hosts, exposing post-exploitation kits, stagers and implants. For defenders, Censys says, the more useful finding is that this mistake is not unusual. One exposes an operator's entire home directory, including .ssh, .bash_history and the ARTEX install. Most were active for only hours to a couple of days. Between November 3 and November 5, 10 closed and 15 new ones appeared.

The server named in CrowdStrike's report had open directories visible to Censys from August 18, seven weeks before that report was published.

What the count leaves out

Censys says some of the exposed hosts are likely operated by authorized testers, and that not every ARTEX instance is run with malicious intent. Uniform configurations in the two hosting blocks suggest a provisioning template rather than hundreds of individual operators. Because the console does not require public-facing access, the overall deployment is likely higher.

Check Point researchers found AI agents in ARTEX control panels running large-scale attacks with little human input for a few hundred dollars, though the agents still fail and hallucinate successes.

What defenders can check

The console runs on port 8787 by default, with 8790 and 443 common. Censys suggests checking the same host for open directories, Vshell or FRP listeners and LLM proxy software. Because Censys keeps scan history, the file listings remain available after an operator takes a directory down.

OpenAI's Hacking Model Learns to Stay in Its Lane

OpenAI released GPT-6 Cyber, a model trained to stay within the scope researchers authorize, on Thursday, Nov. 5, to a select group of customers in Daybreak Red, its access tier for vetted offensive s

The Implicator

OpenAI pauses tool-use training; AWS traces why AI agents acted

IMPLICATOR .ai Morning Briefing · From San Francisco   Monday, September 28, 2026 11 stops From San Francisco 1 The Editorial   Marcus here. People still have to ch

The Implicator

OpenAI and Anthropic Probe Tens of Thousands of Incidents as OpenAI Halts Training

OpenAI, Anthropic and security researchers are investigating tens of thousands of incidents in which advanced models acted beyond intended limits, while OpenAI has paused training of its most capable

The Implicator

Marcus Schuler

San Francisco

Editor-in-Chief and founder of Implicator.ai. Former ARD correspondent and senior broadcast journalist with 10+ years covering tech. Writes daily briefings on policy and market developments. Based in San Francisco. E-mail: editor@implicator.ai