Threat assessment: high, and the exposure cuts both ways.
Security firm Censys has found more than 800 deployments of Artex, a Chinese-made open source AI hacking tool, sitting on the web with no password required, TechCrunch AI reports. Anyone who finds one can get in. That could hand outsiders a ready-made system for launching cyberattacks against unsuspecting targets.
Artex is an autonomous penetration testing tool, meaning software that probes computer systems for weaknesses on its own. It’s been public since July. Microsoft has described it as a system of AI agents that can run attacks “from reconnaissance through data exfiltration with little needed human interaction.”
Situation report
- Exposure. Censys, which scans the internet for exposed or vulnerable systems, counted more than 800 distinct Artex deployments reachable without a login.
- Contents. The open systems also reveal attack tools, including implants. That’s hidden malicious software used to compromise a victim’s network and keep access to it.
- Intent. It’s mixed. Silas Cutler, principal security researcher at Censys, said not every instance is malicious and many are used by authorized testers.
- The open question. Artex doesn’t need to be reachable from the internet to work. Nobody knows yet why hundreds of copies are.
Known operations
South Korea. CrowdStrike tied September attacks on the Korean finance industry to a Chinese-speaking hacker using an Artex instance. Part of that attribution came from the hacker leaving an “open directory” hosting the system.
Censys says its data shows that instance sat exposed for months. It also appeared to hold attack data reaching “well beyond South Korean banks,” including payment and gaming companies.
ConnectWise. Artex was also used in an October attack on the IT support giant, which let Chinese-linked hackers spy on thousands of organizations with data and files in Microsoft’s cloud. Microsoft says the hackers broke into customers’ cloud environments and stole data so fast that defenders had “little time to detect and respond.”
Why this matters
Anthropic and OpenAI keep their most advanced cybersecurity models out of reach for many people. Artex fills that gap. It’s free to download and run on your own servers, so it’s become popular with people who can’t get access to the frontier models. My read: gating the best models only slows this down so much once a capable open source option is in circulation.
What stands out is how basic the attacks were. Many of those linked to Artex relied on guessing weak or known passwords and on missing multi-factor authentication. Think of a burglar with a robot that tries every door handle on the street. The trick is old. The speed is what’s new.
There’s some irony here too. The attackers made the same mistake as their victims, and in the Korean case that sloppiness helped CrowdStrike point to who was behind it. But an exposed attack server also puts the victims at further risk, because their data and the tools used against them may be open to anyone.
The closed source move
Artex has announced it will go closed source, effectively limiting further releases to paid customers. Don’t count on that to contain it. Dozens of copies of the code remain on code-sharing sites, and they can still be used in active attacks.
Immediate actions
- Turn on multi-factor authentication everywhere, starting with cloud admin and remote support accounts.
- Audit for weak, default and known passwords. That’s the door these attacks keep walking through.
- If your team runs Artex or similar agent tooling for authorized testing, confirm it isn’t reachable from the internet and put a login in front of it.
- Look hard at your response times. Attacks at this speed won’t wait for someone to read an alert in the morning.
- Review your IT vendors’ access. The ConnectWise attack shows how one provider can open the door to thousands of organizations.
What comes next
I’d expect more scans like this one, and more attacks traced back to open instances of Artex. The older open source copies aren’t going anywhere, even as new releases move behind a paywall. Full details are available at TechCrunch AI.