More than 800 distinct-looking deployments of Artex AI hacking tools were found publicly accessible online, raising concerns about unauthorized use. Cybersecurity company Censys discovered the exposed systems during an investigation published Nov. 5, 2026.
Artex is an open-source AI penetration-testing framework that automates security testing and vulnerability discovery. Although designed for authorized assessments, the software has appeared in several cyberattacks involving financial institutions and cloud services.
Artex AI Hacking Tools Found on Exposed Servers
According to Censys researchers, internet scans identified 1,465 hosts running exposed Artex consoles as of Nov. 4. About 650 used nearly identical hosting configurations, leaving approximately 815 distinct-looking deployments.
The interfaces were accessible without password protection. Researchers also discovered 32 publicly accessible directories containing offensive security software, including exploitation tools, malicious implants and programs used to maintain access to compromised systems.
Silas Cutler, the Censys researcher behind the investigation, emphasized that not every Artex installation is malicious. Some systems likely belong to legitimate security professionals, although publicly exposing their consoles creates unnecessary risks.
Microsoft Links Artex to China-Aligned Cyberattacks
Artex has already been associated with significant cyber incidents. In October, Microsoft identified its use by Storm-0940, a China-aligned hacking group involved in the ConnectWise supply chain compromise.
According to Microsoft’s security research, the attackers used Artex to automate reconnaissance, password attacks and cloud application abuse. The campaign attempted authentication across more than 2,250 Microsoft 365 customer environments, reaching approximately 2,900 attempts per minute.
Some attacks resulted in privileged cloud access within three hours. However, Microsoft cautioned that attempted or successful authentication does not necessarily indicate that customer data was stolen.
TechAmerica previously reported on the ConnectWise cyberattack, including the stolen application credentials that enabled attackers to target Microsoft cloud customers.
Exposed Systems Reveal Additional Security Risks
CrowdStrike also identified Artex during attacks against South Korean financial institutions. Censys later examined the exposed server associated with that campaign and found evidence suggesting the operator targeted additional payment and gaming services.
Researchers discovered other Artex hosts running multiple offensive security frameworks. Of the 1,465 exposed hosts, 155 also triggered detections for other potentially dangerous tools.
Artex’s developer has since withdrawn the original public repository and announced plans to stop open-source releases. However, archived copies and modified versions remain available online.
The findings illustrate how poor security configurations can expose powerful cyberattack tools and potentially sensitive operational information. Restricting administrative interfaces and securing exposed credentials remain essential safeguards for organizations operating such software.
