- Censys found 1,465 hosts showing the console of ARTEX, an open-source AI penetration testing tool linked to attacks on a South Korean finance company and ConnectWise customers.
- Open directories let CrowdStrike and Censys see attacker activity. TechCrunch reports that many attacks linked to the tool exploited weak passwords and missing multi-factor authentication.
- Review sign-in controls for cloud tenants and check outbound traffic for unfamiliar AI model proxies.
The attacker's tool has the same weakness as yours
Offensive software is still software. People install it and misconfigure it, and TechCrunch reports it is unclear why so many consoles are exposed. A new Censys report shows this for ARTEX, an AI tool that plans and runs attacks with little human input.
The lesson here is that AI speeds up attackers but leaves ordinary hygiene failures in place on both sides. The attackers' mistakes gave researchers a view into their work. Gaps in a defender's basic controls can still give attackers a way in.
What Censys found
ARTEX is an open-source penetration testing framework. That means software that probes systems for weaknesses. Its developer, who goes by Autumn-27, put it on GitHub on July 26, 2026. Defenders can use such tools to find their own flaws. Attackers can use the same features.
Censys's search matched 1,465 hosts with an ARTEX console visible online. The count was taken on November 3. About 44% of them sit in two hosting networks with near-identical set-ups. Censys says this suggests a provisioning template rather than hundreds of individual operators. Without those two networks, about 815 deployments remain.
TechCrunch, citing the same research, reports more than 800 distinct deployments reachable without a password. Censys says not every instance is malicious. Some exposed hosts are probably run by authorized testers. The console does not need to be public, so Censys believes the true number of deployments is likely higher.
The developer also spoke up. On October 8, a day after CrowdStrike's report, they posted that they were not involved in the attacks. They said ARTEX is meant for testing within authorized scopes. That is the developer's own claim. It is not a finding by Censys.
How the tool works
A user writes a Task. It sets the scope, the test accounts and a goal. Censys says the default example reads "gain admin panel access or server privileges".
A Planner agent turns that goal into attack steps, which Censys calls intents. Worker agents pick up those steps and run tools such as nmap, a standard network scanner. They write the results back. The loop repeats until the goal is met.
ARTEX keeps two maps. One shows what the target looks like. The other shows how much of it has been tested. It works with models from Anthropic and OpenAI, or any compatible endpoint. Microsoft describes it as running "from reconnaissance through data exfiltration" with minimal human input.
Two attacks linked to ARTEX
CrowdStrike traced a campaign against a South Korean finance company to an unnamed attacker using ARTEX. The activity ran from late September into early October. The report came out on October 7. CrowdStrike assessed with moderate confidence that the actor is a financially motivated Chinese speaker.
Two banks were hit. At one, the attacker got into a loan inquiry service. At the other, the target was a mobile system for employees. CrowdStrike says the actor exfiltrated data.
The attacker gave CrowdStrike its lead by leaving folders browsable on a server. Anyone could list the files inside. The listing revealed the setup of the attacker's AI coding assistant, the instructions it fed its models, records of earlier sessions and the tool's own configuration files. Censys saw open directories on that server from August 18. That was seven weeks before CrowdStrike's report.
Microsoft ties the ConnectWise Cloud Backup supply-chain breach to Storm-0940, which Censys describes as China state-aligned. Microsoft reports that the group handed three jobs to ARTEX: scanning, password spraying and OAuth application abuse. Password spraying means trying common passwords across many accounts.
The group tried to sign in to more than 2,250 tenants, which are separate customer cloud accounts. At the fastest, that was 2,900 attempts a minute. For some victims, Microsoft's findings show the group needed fewer than three hours to gain privileged access to their cloud.
TechCrunch reports that many attacks linked to ARTEX relied on easy openings. Passwords were guessable or already known, and accounts had no second sign-in step. Microsoft says the speed left defenders "little time to detect and respond." The sources do not say how the South Korean intrusions began.
A crowded toolbox
Censys found that 155 ARTEX hosts, or 10.6%, carry at least one other threat detection. CyberStrikeAI shares 70 of those hosts. Some hosts also run command-and-control software, which lets attackers steer compromised machines. Cobalt Strike is one example.
A further 43 hosts also run software for routing or reselling AI model access. Two products stand out. CLIProxyAPI appears on 19 hosts and New API on 18. CrowdStrike says its actor likely bought DeepSeek access through a reseller. Censys suggests defenders look into unfamiliar LLM proxies in their outbound logs.
While writing the report, Censys saw 32 open directories on ARTEX hosts. Most stayed open for hours to a couple of days. Between November 3 and 5, ten closed and 15 new ones appeared. Censys keeps scan history, so the file listings stay visible after operators close them.
What leaders should ask
The repository has been taken down, and the developer says the project is going closed-source. Censys says archived copies and rebrands such as ScopeWeaver still circulate. TechCrunch reports dozens of copies of the code remain on code-sharing sites.
Ask your identity team three questions. Is multi-factor authentication enforced on every cloud tenant? Would a burst of failed sign-ins at machine speed raise an alert, and who is paged? Which OAuth applications can reach privileged data, and who approved them?
Ask your network team whether outbound traffic to unfamiliar AI model proxies is logged and reviewed. Ask your security vendors whether they track exposed attacker infrastructure, not only your own.
Sign-in controls are within a security team's reach, and TechCrunch links many of these attacks to their absence.
Produced by the WebPulse Newsroom with AI assistance from the original reporting credited below, and checked against that source by our editorial review. How we use AI.
Original reporting: Censys.
