SafetyRisk, alignment & guardrails
Censys finds about 815 Artex AI hacking deployments with control consoles exposed to the web
Censys found 1,465 internet-exposed consoles for Artex, an open-source multi-agent AI hacking framework, which it collapses to roughly 815 deployments. The open panels leak implants and victim data. Artex has been linked to attacks on South Korean finance firms and the ConnectWise supply-chain intrusion.
From the TechCrunch AI article of November 6, 2026 and cited sources: Censys counted 1,465 exposed Artex consoles. [1] [2]
SOURCES[1] TechCrunch: Hundreds of Artex AI hacking tools found… techcrunch.com[2] Censys: ARTEX: Agentic Asbestos censys.com
AT Pulse research deskPublished · Updated · 5 min read · AI-assisted analysisAI-assisted, not human-edited. Methodology Corrections Who owns this site
- Original source
- TechCrunch AI article, independent perspective
- Brief by
- AT Pulse research desk AI-assisted; publisher and contact on the desk page
- When
- November 6, 2026 article published
- Covered
- Nov 9 edition
- Evidence
- 7 sources across 7 sites
- 1TechCrunch: Hundreds of Artex AI hacking tools found…techcrunch.com
- 2Censys: ARTEX: Agentic Asbestoscensys.com
- 3Security Affairs: AI-Driven tool ARTEX used in attacks…securityaffairs.com
- 4The Hacker News: China-linked hackers use Artex AIthehackernews.com
- 5Tom's Hardware: China-aligned hackers deploy AI agents in…tomshardware.com
- 6Brandefense: ARTEX AI Pentest Framework Profilebrandefense.io
Reach: not measured yet
Censys counted 1,465 exposed Artex consoles. After merging identical hosting setups, that comes to about 815 distinct deployments. TechCrunch reports the consoles could be reached without a password. Censys also found 32 open directories leaking implants and attack data, which hurts both the operators and their victims. Censys found the consoles by matching the page title and Next.js assets in scan data, a method others can repeat. [1] [2]
Artex is a model-agnostic, multi-agent LLM framework that splits an attack into stages handled by separate sub-agents. CrowdStrike tied it, with moderate confidence, to a Chinese-speaking, financially motivated actor that attacked South Korean finance firms. Microsoft says the China-aligned group Storm-0940 used it with stolen ConnectWise credentials against Microsoft 365 tenants. [3] [4] [5] [6]
exposed Artex consoles show up in internet-scan data and leak attack material. Implication: threat-intel teams get a way to hunt attacker infrastructure.
Read the full assessment
Meanwhile, automated password spraying leaves defenders less time to respond, so enforcing MFA and rotating third-party credentials becomes more urgent.
Sources are checked. Here is the dossier, kept to about 900 words.
Executive brief
Attackers have been using Artex, an open-source AI hacking framework, and many of them left their own control panels open to anyone. Censys counted 1,465 internet-exposed Artex consoles, which it reduces to about 815 distinct deployments. TechCrunch reports that these consoles could be reached without a password. Artex has been tied to an attack on South Korean finance firms and to Microsoft's account of the ConnectWise supply-chain intrusion. The exposed servers also leak implants and attack data, which harms both the operators and their victims. Artex has since moved to closed source, but archived copies still circulate.
What changed and event timeline
Artex released as open source
Censys gives this as the public release date of the LLM-driven autonomous pentesting framework. Its developer is.
More detail
Korean-linked instance starts leaking
Censys data shows open directories on the server at 38.244.50[.]120 from this date. That is about seven weeks before the operation was publicly disclosed.
09: CrowdStrike ties Artex to Korean bank attacks
CrowdStrike identified the operator because they left session logs and Claude Code histories in open directories. It assesses, with moderate confidence, that the operator is a Chinese-speaking, financially motivated actor.
22: Microsoft names Storm-0940 in the ConnectWise campaign
Microsoft says the China state-aligned group used Artex together with stolen ConnectWise Cloud Backup credentials against Microsoft 365 tenants.
06: Censys exposure census published
Censys counted 1,465 exposed consoles, 32 open directories, and 155 hosts that also run other malicious tooling. TechCrunch reported the findings on November 6.
More detail
Capabilities and access
- What it is: a multi-agent LLM system written in Go, with a Next.js web console. It is model-agnostic.
- What it does: Microsoft says it runs operations "from reconnaissance through data exfiltration" with little human input (TechCrunch).
- Access: the original repository was removed in October 2026. No exact version numbers are documented.
Read the full section
- What it is: a multi-agent LLM system written in Go, with a Next.js web console. It is model-agnostic. Google Threat Intelligence describes it as splitting the attack lifecycle across six specialized sub-agents.
- What it does: Microsoft says it runs operations "from reconnaissance through data exfiltration" with little human input (TechCrunch).
- Access: the original repository was removed in October 2026. Forks such as ScopeWeaver and a commercial "ARTEX PRO" are reported. No exact version numbers are documented.
Technical analysis for researchers and developers
- How Censys detected it: a match on the HTML title (
^ARTEX[ :—]) plus Next.js_next/staticassets. - How Censys de-duplicated: it collapses identical hosting configurations, which turns 1,465 hosts into about 815 deployments.
- Model stack in the Korean operation: DeepSeek v4.1-flash was the primary model, accessed through a reseller, with GLM-5.3 and Grok 4.6 used in some sessions.
Read the full section
- How Censys detected it: a match on the HTML title (
^ARTEX[ :—]) plus Next.js_next/staticassets. This is a fingerprint anyone can reproduce in internet-scan data (Censys). - How Censys de-duplicated: it collapses identical hosting configurations, which turns 1,465 hosts into about 815 deployments. Two netblocks hold about 44% of instances, which suggests templated provisioning (Censys).
- Model stack in the Korean operation: DeepSeek v4.1-flash was the primary model, accessed through a reseller, with GLM-5.3 and Grok 4.6 used in some sessions. The operator also used Claude Code (Security Affairs).
- Design note: the console does not need to face the public internet, so these exposures are operator misconfiguration, not a product requirement.
Claims and evidence
- Exposure counts: reported by Censys from its own scan data (Censys). TechCrunch's "more than 800" is the de-duplicated figure, not the raw host count.
- Korean attribution: CrowdStrike's own assessment, rated moderate confidence (Security Affairs). Security Affairs says exact victim counts are unconfirmed.
- ConnectWise speed figures: more than 2,250 tenants, about 2,900 sign-in attempts per minute, and privileged access in under three hours.
Read the full section
- Exposure counts: reported by Censys from its own scan data (Censys). TechCrunch's "more than 800" is the de-duplicated figure, not the raw host count.
- Korean attribution: CrowdStrike's own assessment, rated moderate confidence (Security Affairs). The figures of seven affected firms and 67,000+ exposed records come from South Korean media, as relayed by Tech-Insider. Security Affairs says exact victim counts are unconfirmed.
- ConnectWise speed figures: more than 2,250 tenants, about 2,900 sign-in attempts per minute, and privileged access in under three hours. These come from Microsoft's telemetry alone, and no independent reproduction appears in the reviewed sources (The Hacker News).
Context and prior work
- Censys says operators run Artex alongside established C2 frameworks: Cobalt Strike, Vshell and Adaptix C2 (Censys).
- TechCrunch frames Artex as filling a gap for actors who cannot get frontier cyber-capable models from Anthropic or OpenAI (TechCrunch).
- Censys's finding that the Korean server held attack data reaching payment and gaming companies follows CrowdStrike's original open-directory discovery.
Read the full section
- Censys says operators run Artex alongside established C2 frameworks: Cobalt Strike, Vshell and Adaptix C2 (Censys). The AI layer appears to be added to existing attacker toolkits rather than replacing them.
- TechCrunch frames Artex as filling a gap for actors who cannot get frontier cyber-capable models from Anthropic or OpenAI (TechCrunch).
- Censys's finding that the Korean server held attack data reaching payment and gaming companies follows CrowdStrike's original open-directory discovery.
Limitations, safety and contested findings
- Disputed start date for the Korean campaign: CrowdStrike's reported window is late September to early October (Security Affairs).
- Exposed does not mean malicious: Censys says some exposed hosts are probably authorized testers.
- Closed source has limited effect: going closed source restricts new releases, but archived copies and forks remain usable (TechCrunch).
Read the full section
- Disputed start date for the Korean campaign: CrowdStrike's reported window is late September to early October (Security Affairs). The Hacker News describes weaponization from August (The Hacker News), which fits Censys's August 18 exposure data.
- Exposed does not mean malicious: Censys says some exposed hosts are probably authorized testers.
- Closed source has limited effect: going closed source restricts new releases, but archived copies and forks remain usable (TechCrunch).
- The attacks were not technically advanced: many relied on weak or known passwords and missing MFA.
Business and practitioner implications
- Defenders: machine-speed password spraying shrinks the time available to respond.
- Threat-intel teams: the Censys fingerprint and the open directories are practical sources for hunting attacker infrastructure.
- Red teams using agentic tools: keep consoles behind a VPN and authentication. An exposed console leaks client data and implants.
Read the full section
- Defenders: machine-speed password spraying shrinks the time available to respond. Enforce MFA, monitor OAuth app consents, and rotate third-party SaaS credentials, as the ConnectWise case shows (Tom's Hardware).
- Threat-intel teams: the Censys fingerprint and the open directories are practical sources for hunting attacker infrastructure.
- Red teams using agentic tools: keep consoles behind a VPN and authentication. An exposed console leaks client data and implants.
- Model providers and resellers: API reseller channels, such as the one used to reach DeepSeek, are part of the abuse supply chain.