Censys published a report on November 5 counting 1,465 internet-facing hosts running ARTEX, an open-source framework for AI-assisted penetration testing. Most of them are probably authorized testers doing their job. The churn around the rest is the part worth reading twice.
Censys found 1,465 exposed AI agent servers running ARTEX
The scan looked for a specific piece of software and found a lot of it. Censys says about 650 of those hosts shared repeated configurations across two hosting providers, which points to cloned systems or one operator using many addresses. Strip those clusters out and roughly 815 distinct deployments remain.
That distinction matters more than the headline number. A single tester who spun up twenty instances isn't twenty operators, and a copied image isn't a campaign.
Censys is also careful about what exposure means. Running ARTEX in public doesn't establish malicious activity, because authorized penetration testers use the same tool with the same defaults. An open door is a finding, not a verdict.
What the Artex AI hacking tools do after login
The software is young. ARTEX was released on July 26, 2026, and it combines a Go backend, a Next.js console and a PostgreSQL database. It connects to the ScopeSentry asset-discovery platform to import domains, addresses, ports and endpoints, so an operator starts with a map instead of a blank page.
Then the agent loop takes over. An operator sets a target, a scope and an objective. A planner agent breaks the objective into tasks, and worker agents run tools such as nmap and record what comes back. The framework keeps an asset graph and an exploration graph for the whole operation, so every later task can build on the last result instead of starting from nothing.
It also supports Anthropic, OpenAI and compatible model endpoints, which means an operator can switch providers without rebuilding the workflow. That portability is a feature for researchers and a headache for anyone trying to block the tool by watching one API.
Censys counted 815 deployments, 155 flagged hosts and 32 open directories
The report's most concrete numbers sit below the host count. Out of 1,465 hosts, 155 showed additional threat detections, about 10.6%. Thirty-two ran open directories that exposed tools, implants and operator files, which is the closest thing in the report to a smoking gun. Does 10.6% sound small? It's 155 machines carrying attack tooling and whatever else their operators left behind.
One of those directories exposed an operator's home folder, including SSH material and shell history. That's the security equivalent of leaving your keys, your address book and your diary in a unlocked shed. Whoever found it didn't need to break anything.
The neighborhood is crowded too. Censys found CyberStrikeAI co-hosted on 70 hosts, with PentAGI, HexStrike AI and RedRamon also showing up. Other hosts carried Vshell, Cobalt Strike, Adaptix C2, FRP and Gophish. None of those names belongs on a machine that anyone on the internet can reach.
The offensive AI framework has been tied to real attacks
Vendor research connects ARTEX to activity that wasn't a test. Microsoft has described the system as a set of AI agents that can run a cyberattack from reconnaissance through data exfiltration with little human interaction.
CrowdStrike linked an ARTEX instance to attacks on South Korean financial institutions in September. Censys found that server's open directory had been visible since August 18, seven weeks before CrowdStrike published. Seven weeks is a long time to leave a control panel facing the street, and nobody needed a zero-day to walk in. For a security team at a bank in Seoul, that window is the useful detail, not the tool's name.
Microsoft attributed ARTEX-assisted activity against ConnectWise customer tenants in October to the group it calls Storm-0940, which used it to reach customers' Microsoft cloud environments. Many of the linked attacks relied on simple weaknesses: weak or known passwords, and missing multi-factor authentication.
Keep the attribution straight. The vendors named the activity. Nobody has tied the framework itself to a government, and Censys calls it dual-use rather than malware.
Why an open console with LLM keys is an AI security problem
An ARTEX console without authentication creates a problem bigger than one server. The box holds model API keys, a target list and the output of every scan it has run. Someone who finds it gets your model budget, your scope and your notes.
That combination is new enough that a lot of teams haven't built a rule for it. A leaked database is a breach. A leaked attack console is a breach plus a map of what you were planning to test next, which is the worst possible thing to hand an adversary who is already curious.
The population is also moving. Between November 3 and November 5, ten exposed directories disappeared and fifteen appeared elsewhere. Taking one down doesn't reduce the total for long.
How Censys says to spot ARTEX, and the closed-source turn
Censys gives defenders detection signals rather than proof of compromise. Look for consoles on TCP 8787, 8790 and 443, page titles beginning with ARTEX, and _next/static assets in unexpected places. Nearby open directories, tunnelling services and unfamiliar LLM gateways are worth a look too.
The framework's own future is shifting. ARTEX has announced it will go closed-source, which would limit further releases to paying customers. That hasn't happened yet, and dozens of copies of the code remain on code-sharing sites, so the exposure won't end when the licence does.
Same defaults, same exposure.
For anyone running an agent framework of any kind, the lesson is boring and effective. Put authentication in front of the console before the first scan, keep model keys in a separate secret store, and give the box a network path that can't reach production.
The count will change by next week. The pattern, a capable tool with permissive defaults and an operator in a hurry, is the part that repeats.
