Censys Finds Exposed Artex AI Consoles Online
Censys identified 1,465 hosts running an open-source AI pentesting framework's console with no login protection.
Updated on Nov. 6, 2026 in Cybersecurity
Live Poll
Do you feel safer online now that AI hacking tools are spreading?
Censys reported on Nov. 5, 2026 that 1,465 hosts ran an exposed Artex AI console with no login wall as of Nov. 4. Artex is an open-source, LLM-driven autonomous penetration testing framework that was released on GitHub in July 2026.
Why it matters
The console does not need to be reachable from the public internet, so the open instances reflect a misconfiguration rather than a design feature. Security researchers have linked Artex to attacks on South Korean finance targets, raising concern about misuse of the tool.
Censys matched the instances by the console's web title and Next.js assets, and about 44% of the 1,465 hosts come from two providers with cloned port layouts. Of the exposed hosts, 155 (10.6%) also run at least one other Censys-detected threat tool, and 32 open directories expose implants, stagers, and post-exploitation kits.
The players
Censys
Censys is an internet-scanning and attack-surface research company that maps exposed hosts and services across the public internet.
CrowdStrike
CrowdStrike is a major cybersecurity firm known for its endpoint protection platform and threat intelligence research.
Microsoft
Microsoft is a global technology company whose security teams track threat actors, including the activity it tied to Storm-0940.
The details
Censys identified the consoles by matching the web-console title and Next.js assets associated with Artex. Researchers observed 32 open directories on Artex hosts containing implants, stagers, and post-exploitation kits. CrowdStrike linked Artex to a campaign in late September and early October against South Korean finance targets, and Microsoft tied it to Storm-0940 activity around a ConnectWise customer-tenant compromise.
Timeline
July 2026: Autumn-27 releases Artex on GitHub.
Late September-early October 2026: Artex-linked campaign targets South Korean finance organizations.
October 2026: CrowdStrike publicly links Artex to the South Korean finance campaign.
Nov. 4, 2026: Censys counts 1,465 passwordless Artex consoles.
Nov. 5, 2026: Censys publicly reports the exposed Artex findings.
The Tech Race
Artex follows the pattern set by Metasploit and Cobalt Strike, where legitimate offensive-security frameworks were later adopted by threat actors. The rapid shift of Artex toward closed-source after public abuse reports marks a departure from the open model that such tools have typically maintained.
Anyone running an AI pentesting console should confirm it is not reachable from the public internet and requires authentication. Organizations in affected sectors should check their networks for unfamiliar AI consoles and related post-exploitation files.
The takeaway
Exposed administrative consoles remain one of the simplest ways attackers gain a foothold, and checking that such tools require authentication is a basic safeguard. Reviewing internet-facing services for unintended exposure can prevent misused tools from becoming a route into an organization.
Further reading
Explore more Cybersecurity coverage to see how exposed tools and misconfigurations are tracked across the industry.
Source note: This article includes information reported by Teknoloji Haberleri - ShiftDelete.Net.
Live Poll
Do you feel safer online now that AI hacking tools are spreading?
