Researchers Discover Hundreds of Publicly Exposed Artex AI Hacking Tools

Security researchers at Censys found more than 800 publicly accessible deployments of Artex, a Chinese-made open-source AI hacking tool, exposed to the internet without passwords. Artex is an autonomous penetration-testing platform that uses AI agents to probe systems for weaknesses and, according to Microsoft, can carry out cyberattacks from reconnaissance through data exfiltration with minimal human interaction. The tool’s free availability has made it attractive to users unable to access frontier cybersecurity models from Anthropic or OpenAI. The exposure increases the risk of misuse and accidental compromise. Although some deployments are operated by legitimate testers, the software does not require public internet access, leaving hundreds of systems available to anyone who scans the web. The exposed instances also reveal embedded attack capabilities, including implants used to maintain access to compromised networks. The discovery adds urgency to previous links between Artex and real-world cyber operations. In September, CrowdStrike attributed attacks on South Korean financial institutions to a Chinese-speaking actor who used an Artex instance, after finding an open directory hosting the tool. Censys said that instance had been public for months and appeared to contain attack data extending beyond South Korean banks to payment and gaming firms. In October, Microsoft said Chinese-linked hackers used Artex to compromise cloud environments tied to IT support provider ConnectWise, enabling theft of data and files from thousands of organizations hosted in Microsoft’s cloud. Microsoft said the attacks moved so quickly that defenders had little time to detect and respond. Many of the linked intrusions relied on basic security failures, including weak or reused passwords and missing multi-factor authentication. The findings highlight how misconfigurations can create a two-sided risk: attackers may expose their own tooling and evidence, while defenders leave exploitable paths into target environments. Following the scrutiny, Artex said it would move closed-source, limiting future releases to paid customers. Dozens of copies of its code remain available on code-sharing sites, preserving the possibility of continued use in active attacks. The episode underscores the operational hazard created when advanced offensive AI tools are widely available and deployed without access controls, monitoring, or clear governance.