Censys finds more than 800 Artex deployments exposed on the web

Censys identified more than 800 distinct Artex deployments accessible from the web without requiring a password on Nov. 6, 2026, according to TechCrunch.

Silas Cutler, Censys principal security researcher, said it is unclear why hundreds of Artex systems sit on the open web when the software does not require internet accessibility, and he noted that not every instance is malicious because authorized testers use many of them. Publicly exposed Artex systems expose attack tools including implants used to compromise and maintain persistent access to victim networks.

Artex is an open source tool for autonomous penetration testing that was publicly released in July 2026 and is free to download and run, making it popular among those who cannot access Anthropic or OpenAI’s advanced cybersecurity AI models. Microsoft described Artex as AI agents that can conduct cyber attacks “from reconnaissance through data exfiltration with little needed human interaction.” Microsoft said hackers used Artex to break into customer cloud environments and steal data so quickly defenders had little time to respond. Security researchers have linked the tool to cyber attacks since its release.

ARTEX is a harness, not an AI model, that wraps tools around large language models and provides a command shell, shared discovery record and planner. Its documentation suggests it can connect to Anthropic and OpenAI models or any service using OpenAI’s API. “We have no evidence that fully autonomous (aka human out of the loop) is here yet,” said Rohit Nambiar.

Microsoft Threat Intelligence reported on Oct. 21, 2026 that China state-aligned group Storm-0940 used ARTEX in a sprawling campaign, placing the group’s activity back to at least 2021. Storm-0940 moved from initial foothold to elevated cloud privileges in less than three hours in some incidents.

One operation ran from Oct. 10 to Oct. 14, 2026 and targeted 327 accounts using ARTEX. The campaign exploited a ConnectWise supply chain compromise on Oct. 15-16, 2026, and ConnectWise publicly acknowledged the breach on Oct. 16.

Attackers abused OAuth application identities to fire authentication attempts at 2,900 sign-in attempts per minute, affecting more than 2,250 tenants. Artex was used in an October 2026 ConnectWise attack that let Chinese-linked hackers spy on thousands of organizations using Microsoft’s cloud. Storm-0940 previously used Artex to abuse ConnectWise Cloud Backup and target downstream Microsoft 365 tenants.

CrowdStrike attributed use of ARTEX against more than 200 distinct organizations worldwide to China-based Vapor Panda, starting Oct. 17, 2026. The company said “Agentic tooling like ARTEX enables this scale of expansion at speed.” Vapor Panda, previously VexatiousTemper and overlapping with Trend Micro’s Earth Estries cluster, was first identified in February 2021 and targets foreign ministries in Latin America, Europe, Asia and the Middle East as well as U.S. semiconductor, defense and think tank organizations.

In one intrusion, Vapor Panda’s planning agents consumed roughly 1.4 billion input tokens. The group ran ARTEX primarily on DeepSeek alongside an unidentified commercial model, with planner and worker agents coordinated by a human operator issuing instructions in Mandarin.

Post-exploitation activity was confirmed at nine organizations where the attacker deployed BLOODALCHEMY and conducted credential spraying, network scanning and reconnaissance. Vapor Panda also conducted password-spraying and credential scanning against at least 12 additional organizations including U.S. think tanks and European government entities.

Security companies linked Artex to broad-scale cyber attacks against the Korean finance industry in September 2026. CrowdStrike attributed the attacks to a Chinese-speaking hacker who used an Artex instance and left an open directory hosting the system, and CrowdStrike assessed with moderate confidence that the attacker was likely Chinese-speaking and financially motivated but did not identify a named group. Before ConnectWise, researchers linked ARTEX to data breaches affecting roughly 68,000 individuals at South Korean financial institutions.

Censys said the Korean finance Artex instance sat publicly exposed for months and contained attack data extending beyond South Korean banks to payment and gaming companies. South Korea’s Financial Services Commission said on Oct. 14, 2026 that the breach affected 16 financial institutions and that approximately 100,000 personal information records leaked.

GMO Cybersecurity by IERAE confirmed ARTEX use on servers attacking Japanese businesses, identifying six servers targeting about 80 companies in retail, digital gifts, education, printing, insurance, finance, e-commerce and logistics. Eight Japanese companies disclosed cyber attacks between Sept. 18 and Oct. 18, 2026, but none of the companies publicly established a connection between their disclosed breaches and ARTEX.

Lawson reported personal information for more than 2 million accounts leaked. Yamato Transport confirmed theft of about 5.26 million customer records from its payment-after-delivery service. GMO Research & AI reported hackers stole 894,082 personal information records from its infoQ survey platform.

Investigators have not established that the same attacker operated in Japan and South Korea. CrowdStrike assessed that the South Korean ARTEX attacks were likely carried out by a China-based individual, not a confirmed state-linked group. Developer Autumn-27 published a statement on Oct. 8, 2026 condemning misuse, denying involvement and saying ARTEX would stop public updates and become closed-source. GTIG and Mandiant said the developer withdrew the original ARTEX code in October 2026 because of misuse, but copies continue to circulate.

The product lead of ThreatBook’s RedAgents security testing platform created ARTEX’s original tool as a personal project, according to ThreatBook. The company acknowledged the original open-source ARTEX lacked built-in security controls and attackers misused it in major financial sector incidents.

Microsoft Threat Intelligence said hackers use Artex and similar agentic AI systems to look for exposed credentials and API keys in public code repositories. Hackers have applied agentic frameworks to scan for GitHub secrets since August 2026, according to Microsoft researchers, who said organizations finding secrets in public repositories should treat those secrets as compromised.

Researchers observed a single IP address beginning Oct. 28, 2026 using compromised application credentials to access downstream tenant accounts. Hackers stole credentials and exfiltrated data from Azure Key Vaults and Storage Accounts and abused Azure AI services. The GitHub scanning activity overlaps with Todyl research showing hackers with stolen Entra ID secrets signed in to Microsoft 365 and Azure environments.

GTIG has seen groups use ARTEX in incident response work, including financially motivated extortion crews, starting in late August 2026. GTIG observed ARTEX execution sequences lasting seconds, including one generating 27 events in 23 seconds, and said ARTEX is not particularly stealthy, leaving its name in file and account names and generating hundreds of log entries.

Zscaler ThreatLabz said ARTEX orchestrates LLM backends to autonomously perform reconnaissance, vulnerability identification and exploitation. Mandiant said underlying techniques have not changed, with attackers still relying on stolen credentials and unpatched systems.

Many Artex-linked attacks exploited simple vulnerabilities such as weak or known passwords and a lack of multifactor authentication. Simple vulnerabilities including misconfigurations can expose both attackers and their targets.