Hundreds of copies of an autonomous, AI-driven penetration-testing framework are sitting on the open internet with no password required to reach them. Security firm Censys says it identified more than 800 distinct deployments of Artex that could be accessed from the web without authentication, a finding that turns a legitimate security tool into a ready-made launchpad for anyone who scans for it.
- Scale of exposure: Censys counted over 800 distinct Artex deployments reachable without a login, even though the software does not need to be internet-facing to operate.
- Real-world abuse: The framework has been linked to attacks on South Korean financial institutions in September and on ConnectWise customer cloud environments in October.
- Basic failures: The documented intrusions leaned on weak or known passwords and missing multi-factor authentication rather than sophisticated exploits.
- Late fix: Artex has said it will move to closed source, but copies of its code remain available on code-sharing sites.
What Artex Is and Why Open Doors Matter
Artex is an open-source, Chinese-made framework that orchestrates AI agents to carry out penetration testing autonomously. Microsoft has described it as a system of AI agents capable of conducting cyberattacks “from reconnaissance through data exfiltration with little needed human interaction.” Because it is free to download and run on private servers, it has become attractive to users who cannot obtain the most advanced cybersecurity models from Anthropic or OpenAI.
The problem is not the tool’s existence. Autonomous pentesting has legitimate uses, and authorized testers run Artex to probe their own systems for weaknesses. The problem is configuration. Artex does not require its management interface to be reachable from the public internet, yet hundreds of operators have left it exposed anyway, raising the odds that a passing scanner will find it and put it to hostile use.
Silas Cutler, principal security researcher at Censys, noted that not every instance of Artex is operated maliciously and that many are used by authorized testers.
Censys also warned that exposed systems can leak more than a login screen. Some hosts carried open directories revealing attack tooling such as stagers and implants, the hidden software used to hold persistent access inside a victim’s network.
The Attacks Already Tied to Artex
The exposure is not theoretical. In September, CrowdStrike attributed attacks on the South Korean finance industry to a Chinese-speaking actor who used an Artex instance, partly because the attacker left an open directory hosting the system. Censys said that instance had been publicly exposed for months and appeared to contain attack data extending “well beyond South Korean banks,” including payment and gaming companies.
In October, Microsoft reported that Chinese-linked hackers used Artex to break into customers’ cloud environments tied to IT support provider ConnectWise, stealing data at a pace that left defenders with “little time to detect and respond.” The intrusions moved from reconnaissance to data theft with minimal human input.
What stands out is how ordinary the entry points were. Rather than chaining novel exploits, the attackers guessed weak or known passwords and took advantage of accounts without multi-factor authentication. AI did not invent a new way in; it compressed the time needed to walk through doors that were already unlocked.
Defenses That Still Work
The practical response looks much like baseline security hygiene. Enabling two-factor authentication, retiring weak or reused credentials and auditing which services are actually reachable from the internet remain the most effective barriers. Organizations running Artex internally should confirm that its console is not publicly addressable and that no open directories expose supporting tooling.
Artex has announced it will go closed source, limiting future releases to paying customers. That gesture arrives after the fact: dozens of copies of the code are already circulating on code-sharing sites and can still be used in active campaigns.
The broader lesson is about cost and speed. Agentic tooling lowers the skill and effort required to attack, which is the genuinely new and troubling part of this story. Yet the incidents documented so far succeeded through the same misconfigured doors that have always been exploited. Basic defenses still hold, but as automation shrinks the window between scanning and intrusion, the margin for leaving them unattended keeps narrowing month by month.