Censys said on November 5 that, as of November 3, 1,465 internet hosts ran consoles for ARTEX. ARTEX is an AI tool that plans and runs hacking steps with little human input. A developer called Autumn-27 posted it on GitHub on July 26. In October, CrowdStrike linked it to attacks on South Korean finance firms. Microsoft said the China state-aligned group Storm-0940 used it in the ConnectWise Cloud Backup compromise, trying sign-ins at more than 2,250 tenants.
Censys says not every host is hostile, and some likely belong to authorized testers. Two hosting netblocks hold about 44% of hosts and look like one template copied many times. Without them, about 815 deployments remain. Censys found 155 hosts with at least one other threat detection, and 32 open directories on ARTEX hosts. The sources do not say how many hosts are used in attacks. Autumn-27 said the project is closed-source now. The repository is down, but copies and rebrands still circulate.
For teams that run internet-facing systems, the two October reports show the tool in real attacks, and Censys counts well over a thousand consoles. Censys also notes that 43 ARTEX hosts run LLM proxy or reseller software, and advises defenders to check outbound logs for unfamiliar ones.