Security researchers have found hundreds of Artex systems exposed to the open internet with no password required to log in, according to a blog post by cybersecurity firm Censys. Artex is a Chinese-made, open-source AI penetration testing tool: software that scans computer systems for weaknesses on its own. Microsoft has described it as a system of AI agents able to run attacks from reconnaissance to data theft with little human involvement.
Censys said it counted more than 800 distinct Artex deployments reachable from the web without login. Silas Cutler, principal security researcher at the firm, said not every instance is run maliciously and that many belong to authorized testers. Still, Artex does not need internet access to work, so researchers say it is unclear why so many copies are open to anyone. The finding matters because misconfigured tools can be found and reused by attackers who never installed the software themselves.
What Censys found and why it matters
The exposed servers also leak attack tools, including implants, the hidden malware used to keep persistent access inside a victim's network, Censys said. Artex has been tied to several large-scale cyberattacks since its public release in July, including one against the Korean finance industry in September. CrowdStrike attributed that campaign to a Chinese-speaking hacker who used an Artex instance, partly because the attacker had left an open directory hosting the system online.
Censys said its data showed that same Artex instance had been exposed for months and appeared to hold attack data reaching well beyond South Korean banks, including payment and gaming companies.
- Artex is an open-source AI penetration testing tool, released publicly in July.
- Censys found 800+ deployments reachable online without a password.
