Security researchers have found more than 800 publicly accessible deployments of Artex, a Chinese-made AI penetration testing tool, exposed to the internet without password protection — a misconfiguration that could allow anyone to launch cyberattacks using the software.
The discovery was reported in November 2026 by cybersecurity firm Censys, which scans the internet for exposed or vulnerable systems. Silas Cutler, principal security researcher at Censys, noted that not every exposed instance is being used maliciously — many serve authorized testers — but said there is no technical reason the systems need to be accessible from the internet at all.
Artex is an open source autonomous penetration testing tool, meaning it automatically probes computer systems for weaknesses. Microsoft has described it as a system of AI agents capable of conducting cyberattacks “from reconnaissance through data exfiltration with little needed human interaction.” Released publicly in July, it has since been linked to multiple large-scale cyberattacks.
In September, CrowdStrike attributed attacks on the Korean finance industry to a Chinese-speaking hacker who used an Artex instance, partly identified because the attacker left an open directory hosting the system. Censys data indicated that instance had been publicly exposed for months and appeared to contain attack data extending beyond South Korean banks to include payment and gaming companies. In October, Artex was also used in an attack on IT support company ConnectWise, enabling Chinese-linked hackers to access thousands of organizations’ data stored in Microsoft’s cloud. Microsoft said the attackers moved at such speed that defenders had “little time to detect and respond.”
Many attacks linked to Artex exploited basic weaknesses, including weak passwords and the absence of multi-factor authentication. The exposed servers also risk revealing attack tools such as implants — hidden software used to maintain persistent access to compromised networks.
Artex has since announced it will transition to a closed-source model, limiting future releases to paying customers. However, dozens of copies of its code remain available on code-sharing platforms and could still be used in active attacks.
Source: TechCrunch