Over 1,400 Artex AI hacking tools found exposed on the internet, Censys reports

What did Censys find?

On November 5, 2026, Censys published a report titled ARTEX: Agentic Asbestos, documenting 1,465 internet-facing hosts running exposed instances of the Artex AI penetration testing framework. The tool, which is open source and uses large language models to automate every stage of a cyberattack from reconnaissance through data exfiltration, was accessible from the internet without any authentication required. The report dramatically expands the known footprint of a tool that previous coverage had linked to a handful of specific attack campaigns.

Censys principal security researcher Silas Cutler noted that not every Artex instance is operated maliciously. Many are run by authorized penetration testers or security researchers conducting legitimate security assessments. But the scale of the exposure is striking: the software does not require an internet-facing interface to function, and leaving it accessible by anyone dramatically increases the risk that the tool and its associated data will be discovered and misused by third parties with malicious intent.

Of the 1,465 hosts, 155 ran at least one additional artifact that Censys categorizes as a threat. Those co-located services included command-and-control panels, phishing kit repositories, and archives of exploit code. The finding suggests that Artex deployments are not isolated experiments but are often part of a broader operational security setup used by both red teams and adversaries alike, with the same infrastructure hosting multiple offensive capabilities.

The exposed instances were distributed globally, with concentrations in North America, Europe, and Asia. Censys did not attribute the majority of deployments to any specific threat actor, but the geographic spread indicates the tool has been adopted by a wide range of operators beyond the groups already tracked by CrowdStrike and Microsoft. Some instances appeared to belong to security consultancies running Artex as part of their client testing practice, while others showed clear signs of malicious intent.

Censys identified the exposed instances through internet-wide scanning, looking specifically for the web interface that Artex serves on its default port. The detection methodology is similar to how the firm tracks other internet-exposed services, but the sheer number of instances found for a tool that only existed publicly since July 2026 is what makes this discovery noteworthy.

How does Artex work?

Artex is an open-source autonomous penetration testing tool that uses AI agents to probe computer systems for weaknesses. It was released publicly in July 2026 and quickly gained adoption among security researchers and, increasingly, malicious actors. Microsoft has described Artex as a system of AI agents that can conduct cyberattacks from reconnaissance through data exfiltration with little needed human interaction. The tool uses large language models to make decisions about target selection, exploit strategy, and data collection without requiring manual input for each step.

The tool has been linked to several documented attack campaigns. In September 2026, security firms tied Artex to intrusions against the South Korean financial sector. CrowdStrike attributed the attacks to a Chinese-speaking hacker who had left an open directory hosting an Artex instance. Censys said its data showed that specific instance had remained publicly accessible for months and contained target records extending well beyond South Korean banks, including payment companies and gaming platforms.

In October 2026, Artex was used in the supply chain attack against IT support provider ConnectWise. Microsoft, which has visibility into the incident, said hackers used Artex to break into customers' cloud environments and exfiltrate data at a speed that gave defenders little time to detect and respond. The attackers exploited basic vulnerabilities such as weak or absent passwords and a lack of multi-factor authentication across the targeted environments, underscoring that the sophistication of the tool does not necessarily correspond to the sophistication of the attackers operating it.

Why is the scale of exposure significant?

The Censys report reveals that the public-facing Artex footprint is significantly larger than previously understood. Earlier coverage focused on individual attack campaigns, each linked to a handful of Artex instances. Censys's internet-wide scan shows the problem is orders of magnitude broader. Security teams that hardened defenses against the specific Korean finance or ConnectWise attacks may still be exposed if adversaries in other regions are operating from the thousands of other publicly visible instances.

The open directories on some exposed hosts also reveal operational intelligence about attackers: the tools they use, the targets they have compromised, and their infrastructure. For defenders, scanning for exposed Artex instances could provide early warning of emerging campaigns before they escalate into full breaches. A compromised instance left in the open can reveal the entire attack chain, from initial access through lateral movement.

The Censys report is titled Agentic Asbestos partly because Artex exposures tend to persist. Even when an operator shuts down one instance, the tool's open-source nature means a new one can be spun up elsewhere within minutes. The same quality that makes it useful for legitimate red teams repeatable, scriptable, and widely available makes it difficult to contain when used maliciously. The asbestos analogy refers to how the tool's deployment leaves behind long-lasting, hard-to-clean-up traces across the internet.

What has been the response?

Artex announced it would transition to a closed-source model following the Censys disclosure, effectively limiting future releases to paying customers. However, dozens of copies of the tool's code remain available on code-sharing platforms, and the existing exposed instances can still be used in active attacks. The closed-source move does not address the immediate risk from the 1,465 already-public deployments or the code already in circulation.

Security researchers recommend that organizations audit their external attack surface for exposed Artex instances, enforce multi-factor authentication across all services, and review the guidance Microsoft published on the Storm-0940 campaign for specific indicators of compromise. Censys has published detection queries that allow defenders to check whether their networks contain exposed Artex instances and has made its full dataset available to threat intelligence teams.

The broader implication is that AI-powered pentesting tools, which lower the skill barrier for conducting sophisticated attacks, are creating a new class of supply chain risk. When the tools themselves are left exposed, they become a vector for attackers rather than just a defense tool. This is especially concerning because the same AI capabilities that make Artex effective at finding vulnerabilities also make it effective at exploiting them in real time.

What does this mean for the AI security landscape?

The Artex exposure is the latest example of a pattern security researchers have been tracking throughout 2026: the same AI tools being developed for defensive and testing purposes are also being deployed by malicious actors, often with minimal configuration changes. The difference with Artex is the scale of the operational security failures among its operators.

Unlike commercial AI security products from companies like Anthropic or OpenAI that run in controlled cloud environments, open-source tools like Artex place the responsibility for secure deployment entirely on the operator. Many operators, whether legitimate testers or malicious actors, appear to be failing at this basic step. The result is a landscape where more than a thousand AI-powered attack platforms are accessible to anyone who can find them with a basic internet scan.

For enterprise security teams, the Censys findings suggest that AI-driven attacks are no longer the domain of sophisticated state-sponsored groups alone. The tools are widely available, and operational security around them is often poor. Defending against them requires the same fundamentals: asset inventory, network segmentation, multi-factor authentication, and continuous monitoring for unauthorized tools on the network. The fundamentals have not changed, but the speed and autonomy of the tools being deployed against them have.