More than 800 Artex AI hacking tool deployments exposed online

Security researchers have identified more than 800 distinct deployments of Artex, an open-source autonomous penetration-testing tool, that were reachable online without a password. The Chinese-made software automatically searches computer systems for weaknesses and has been linked to several cyberattacks since its public release in July. It is freely available to run on private servers and has been used by organizations that cannot access advanced cybersecurity AI models from Anthropic or OpenAI.

Censys said the exposed systems were not necessarily operated maliciously, but Artex does not need to be internet-accessible for normal use. Public access could let outsiders use the tool or obtain attack-related components, including implants designed to compromise networks and preserve access. Microsoft has described Artex as capable of carrying out operations from reconnaissance to data exfiltration with limited human involvement.

Security companies have associated Artex with attacks on South Korean financial organizations and with an October incident involving ConnectWise, in which Chinese-linked hackers accessed customer cloud environments. Investigators said many incidents exploited weak or known passwords and missing multi-factor authentication. Artex has announced a move to closed-source development, although dozens of code copies remain available online.