New research from Censys has identified 1,465 internet-exposed instances of ARTEX, an AI-powered autonomous penetration testing framework previously linked to cyberattacks against South Korean financial institutions and a China-linked campaign targeting ConnectWise customers.
In a separate November 5 warning, CERT-EU reported observing multiple threat actors using ARTEX to automate cyberattacks and assessed that similar activity targeting EU institutions highly likely involved the framework. The agency warned that ARTEX could enable faster, more frequent and scalable attacks, noting that its operating boundaries rely on configurable rules and AI model behavior rather than hard technical enforcement.
Censys found that 155 exposed instances (10.6%) were hosted alongside other offensive security tools or threats, including Cobalt Strike and Vshell. Researchers also discovered 32 publicly accessible directories containing exploitation tools, malware implants and post-exploitation utilities. Approximately 650 hosts shared nearly identical configurations.
CERT-EU urged organizations to restrict internet-facing management interfaces, monitor privileged accounts, strengthen authentication and address even minor misconfigurations that automated tools could combine into more serious attacks.
The original ARTEX repository was withdrawn in October, but independent forks remain publicly available.
Daniel Park, Senior Marketing Executive, BreachLock
“Microsoft documenting privileged cloud access in under three hours shows that the human-paced assumptions behind most defensive programs have already broken. Censys found roughly 650 exposed hosts with nearly identical configurations, which means this tooling is being deployed from a template by operators who need very little skill of their own. Any tenant with an open path to privileged access is now on a timeline measured in hours, and a remediation cycle measured in weeks will lose that race.”
ㅤ
Corey Ham, COO, Black Hills Information Security
“There’s no honor among cyber criminals. They don’t just go after corporations, they go after each other. ARTEX is an ideal target for a supply chain attack: If it succeeds, you compromise another hacker and pillage whatever they have gathered from their victims. If anyone happens to using ARTEX for legitimate purposes, compromising them is even better, as they likely have corporate resources backing them up. I suspect the attackers main goal was to obtain AI API keys they can use to fuel more attacks. As good as tools like ARTEX are, they are not cheap to run, because of their token use. This creates an unexpected financial burden on threat actors: they have to monetize their campaigns early on, to make up for the cost of running these tools.
“We’ve seen threat actors using tools like https://github.com/Wei-Shaw/sub2api to cheaply combine AI subscription services like Claude and Codex, since these subscriptions are much cheaper than API billing, and spreading this activity across multiple accounts makes it harder to detect for providers like Anthropic and OpenAI. I also assume that many of the accounts being used with sub2api are compromised and stolen accounts. Earlier this year, we saw Anthropic proactively notifying people who had Claude accounts compromised by infostealers.”
ㅤ
Darin Fredde, Senior Director and Offensive Security Evangelist, Ridge Security
“ARTEX didn’t invent the attack chain. It just took the coffee breaks out of it. What concerns me isn’t simply how many ARTEX instances Censys discovered. Not every deployment is malicious. It’s what we’re seeing in documented attacks, where automation combines reconnaissance, exploitation, and abuse of trusted relationships at speeds that leave defenders precious little time to respond. Attackers have always combined weaknesses to achieve their objectives. Agentic AI can accelerate that process without necessarily introducing new techniques. Our response shouldn’t be to panic over another AI framework. We need proven countermeasures, strong identity and access controls, and continuous offensive testing that challenges trust boundaries, business logic, and complete attack paths. The real question isn’t how quickly an AI agent can find a weakness. It’s whether our security controls can stop what happens next.”
ㅤ
Ryan McCurdy, Vice President of Marketing, Liquibase
“What’s concerning about ARTEX isn’t just how widely available these tools are. It’s how quickly they can operate. Attackers can now automate reconnaissance, test permissions, and move through systems at a speed that gives security teams very little time to respond.
“For databases, that creates another challenge. An attacker with valid credentials doesn’t necessarily need to exploit a vulnerability to make a damaging change. They may already have the permissions needed to execute it.
“Companies have spent years strengthening access controls and vulnerability detection but organizations also need to limit unnecessary privileges, monitor unexpected database activity, and enforce policies around changes before they reach production.
“AI is accelerating the attack lifecycle. The controls protecting critical systems need to account for that speed.”
This is bad as it is a safe bet that the bad guys are using tools like this to go after any organization that is not prepared for this sort of thing. So you need to choose which organization that you are.
OpenAI unveils GPT-6 Cyber with new safety safeguards
Posted in Commentary with tags OpenAI on November 6, 2026 by itnerdOpenAI has introduced GPT-6 Cyber, a cybersecurity-focused AI model designed to discover vulnerabilities, develop working exploits and help security teams patch weaknesses. OpenAI reports that the model identified 81 previously unknown high-severity vulnerabilities in Firefox and developed working exploits for 948 Linux kernel vulnerabilities.
The model achieved a 48.5% success rate on OpenAI’s ExploitGym benchmark, compared with 32.1% for GPT-5.6 Cyber. OpenAI also introduced stronger safeguards intended to prevent unauthorized exploitation. In internal evaluations, GPT-6 Cyber remained within its assigned boundaries in 99.93% of tests without additional deployment safety instructions and 100% with them.
OpenAI has classified the model as Critical in cybersecurity under its Preparedness Framework. Initially available to a limited group of approved researchers through its Daybreak Red program, GPT-6 Cyber includes additional monitoring, identity verification and safeguards for high-risk activities involving critical infrastructure. The launch raises questions about how organizations can safely deploy increasingly capable autonomous security tools while ensuring defenders have access to them.
Daniel Park, Senior Marketing Executive, BreachLock
“A 99.93% boundary compliance rate sounds reassuring until you ask what the 0.07% looks like when the model is holding a working privilege-escalation exploit. In a test harness, that’s a rounding error. But on a production network, it’s an unauthorized action by something that can chain exploits faster than anyone can review them. The first real measure of those safeguards will come from what the model does when a live environment pushes back.”
ㅤ
Darin Fredde, Senior Director and Offensive Security Evangelist, Ridge Security
“An AI agent capable of developing working exploits shouldn’t also get to write its own permission slip. GPT-6 Cyber represents meaningful progress in offensive security, and I understand OpenAI’s decision to limit initial distribution. These capabilities deserve responsible oversight. But restricting access cannot become a substitute for proving the technology operates safely. We also need to consider who gets access. If the most capable security tools remain available only to a select few, we risk leaving smaller organizations and independent defenders behind. The answer is neither unrestricted access nor indefinite gatekeeping. Its responsible expansion supported by enforceable rules of engagement, independent validation, and technical controls that limit what these agents can do. The real breakthrough won’t be deciding who gets the keys. It will be proving the brakes work, regardless of who’s driving.”
Frankly, OpenAI can’t be trusted. At least not with me. So I would be wary of running this model as it may go rogue just like every other OpenAI model.
Leave a comment »