The same AI-driven hacking framework behind some of October's biggest intrusions is being run so carelessly that researchers can now look straight into its operators' toolboxes. Security firm Censys says it found more than 800 distinct, internet-exposed deployments of ARTEX, according to TechCrunch.
ARTEX is an open-source, LLM-driven penetration testing framework released in July. In its own write-up, Censys counted 1,465 hosts running an exposed ARTEX console as of November 4. About 650 sit in two blocks of identically configured hosting, leaving roughly 815 distinct-looking deployments. The console does not need to be public-facing, and Censys says global deployment is likely higher.
The design is what makes it potent: a planner agent turns a goal into attack "intents," worker agents run real tools such as nmap, and an engine loop repeats until the goal is met. It works with Anthropic, OpenAI or any OpenAI-compatible model endpoint.
Not every instance is malicious, since authorized testers use it too. But the exposure is revealing. Censys says 155 hosts, about 10.6%, also run other threats such as Cobalt Strike and Vshell, and it saw 32 open directories exposing post-exploitation kits, stagers and implants. One such directory on the server named in CrowdStrike's report on attacks against South Korean finance was visible from August 18, seven weeks before that report was published.
Microsoft has tied ARTEX to the ConnectWise supply-chain compromise, which we covered earlier this week. The author has since declared the project closed-source and pulled the repository, but archived copies and rebrands are still circulating.
The takeaway is less about AI wizardry than hygiene. Per TechCrunch, many ARTEX-linked attacks succeeded through guessed passwords and missing multi-factor authentication. Tools that lower the skill bar for attackers also lower the bar for sloppy operational security, which hands defenders a rare opportunity. Watch for whether the closed-source fork or the rebrands keep the same default exposure, and whether providers of the underlying model APIs start cutting off the accounts those exposed consoles reveal.
— via TechCrunch