New research from Censys has identified 1,465 internet-exposed instances of ARTEX, an AI-powered autonomous penetration testing framework previously linked to cyberattacks against South Korean financial institutions and a China-linked campaign targeting ConnectWise customers.
In a separate November 5 warning, CERT-EU reported observing multiple threat actors using ARTEX to automate cyberattacks and assessed that similar activity targeting EU institutions highly likely involved the framework. The agency warned that ARTEX could enable faster, more frequent and scalable attacks, noting that its operating boundaries rely on configurable rules and AI model behavior rather than hard technical enforcement.
Censys found that 155 exposed instances (10.6%) were hosted alongside other offensive security tools or threats, including Cobalt Strike and Vshell. Researchers also discovered 32 publicly accessible directories containing exploitation tools, malware implants and post-exploitation utilities. Approximately 650 hosts shared nearly identical configurations.
CERT-EU urged organizations to restrict internet-facing management interfaces, monitor privileged accounts, strengthen authentication and address even minor misconfigurations that automated tools could combine into more serious attacks.
The original ARTEX repository was withdrawn in October, but independent forks remain publicly available.
Daniel Park, Senior Marketing Executive, BreachLock
“Microsoft documenting privileged cloud access in under three hours shows that the human-paced assumptions behind most defensive programs have already broken. Censys found roughly 650 exposed hosts with nearly identical configurations, which means this tooling is being deployed from a template by operators who need very little skill of their own. Any tenant with an open path to privileged access is now on a timeline measured in hours, and a remediation cycle measured in weeks will lose that race.”
ㅤ
Corey Ham, COO, Black Hills Information Security
“There’s no honor among cyber criminals. They don’t just go after corporations, they go after each other. ARTEX is an ideal target for a supply chain attack: If it succeeds, you compromise another hacker and pillage whatever they have gathered from their victims. If anyone happens to using ARTEX for legitimate purposes, compromising them is even better, as they likely have corporate resources backing them up. I suspect the attackers main goal was to obtain AI API keys they can use to fuel more attacks. As good as tools like ARTEX are, they are not cheap to run, because of their token use. This creates an unexpected financial burden on threat actors: they have to monetize their campaigns early on, to make up for the cost of running these tools.
“We’ve seen threat actors using tools like https://github.com/Wei-Shaw/sub2api to cheaply combine AI subscription services like Claude and Codex, since these subscriptions are much cheaper than API billing, and spreading this activity across multiple accounts makes it harder to detect for providers like Anthropic and OpenAI. I also assume that many of the accounts being used with sub2api are compromised and stolen accounts. Earlier this year, we saw Anthropic proactively notifying people who had Claude accounts compromised by infostealers.”
ㅤ
Darin Fredde, Senior Director and Offensive Security Evangelist, Ridge Security
“ARTEX didn’t invent the attack chain. It just took the coffee breaks out of it. What concerns me isn’t simply how many ARTEX instances Censys discovered. Not every deployment is malicious. It’s what we’re seeing in documented attacks, where automation combines reconnaissance, exploitation, and abuse of trusted relationships at speeds that leave defenders precious little time to respond. Attackers have always combined weaknesses to achieve their objectives. Agentic AI can accelerate that process without necessarily introducing new techniques. Our response shouldn’t be to panic over another AI framework. We need proven countermeasures, strong identity and access controls, and continuous offensive testing that challenges trust boundaries, business logic, and complete attack paths. The real question isn’t how quickly an AI agent can find a weakness. It’s whether our security controls can stop what happens next.”
ㅤ
Ryan McCurdy, Vice President of Marketing, Liquibase
“What’s concerning about ARTEX isn’t just how widely available these tools are. It’s how quickly they can operate. Attackers can now automate reconnaissance, test permissions, and move through systems at a speed that gives security teams very little time to respond.
“For databases, that creates another challenge. An attacker with valid credentials doesn’t necessarily need to exploit a vulnerability to make a damaging change. They may already have the permissions needed to execute it.
“Companies have spent years strengthening access controls and vulnerability detection but organizations also need to limit unnecessary privileges, monitor unexpected database activity, and enforce policies around changes before they reach production.
“AI is accelerating the attack lifecycle. The controls protecting critical systems need to account for that speed.”
This is bad as it is a safe bet that the bad guys are using tools like this to go after any organization that is not prepared for this sort of thing. So you need to choose which organization that you are.
Researchers identify 1,465 exposed AI-powered hacking frameworks
Posted in Commentary with tags Censys on November 6, 2026 by itnerdNew research from Censys has identified 1,465 internet-exposed instances of ARTEX, an AI-powered autonomous penetration testing framework previously linked to cyberattacks against South Korean financial institutions and a China-linked campaign targeting ConnectWise customers.
In a separate November 5 warning, CERT-EU reported observing multiple threat actors using ARTEX to automate cyberattacks and assessed that similar activity targeting EU institutions highly likely involved the framework. The agency warned that ARTEX could enable faster, more frequent and scalable attacks, noting that its operating boundaries rely on configurable rules and AI model behavior rather than hard technical enforcement.
Censys found that 155 exposed instances (10.6%) were hosted alongside other offensive security tools or threats, including Cobalt Strike and Vshell. Researchers also discovered 32 publicly accessible directories containing exploitation tools, malware implants and post-exploitation utilities. Approximately 650 hosts shared nearly identical configurations.
CERT-EU urged organizations to restrict internet-facing management interfaces, monitor privileged accounts, strengthen authentication and address even minor misconfigurations that automated tools could combine into more serious attacks.
The original ARTEX repository was withdrawn in October, but independent forks remain publicly available.
Daniel Park, Senior Marketing Executive, BreachLock
“Microsoft documenting privileged cloud access in under three hours shows that the human-paced assumptions behind most defensive programs have already broken. Censys found roughly 650 exposed hosts with nearly identical configurations, which means this tooling is being deployed from a template by operators who need very little skill of their own. Any tenant with an open path to privileged access is now on a timeline measured in hours, and a remediation cycle measured in weeks will lose that race.”
ㅤ
Corey Ham, COO, Black Hills Information Security
“There’s no honor among cyber criminals. They don’t just go after corporations, they go after each other. ARTEX is an ideal target for a supply chain attack: If it succeeds, you compromise another hacker and pillage whatever they have gathered from their victims. If anyone happens to using ARTEX for legitimate purposes, compromising them is even better, as they likely have corporate resources backing them up. I suspect the attackers main goal was to obtain AI API keys they can use to fuel more attacks. As good as tools like ARTEX are, they are not cheap to run, because of their token use. This creates an unexpected financial burden on threat actors: they have to monetize their campaigns early on, to make up for the cost of running these tools.
“We’ve seen threat actors using tools like https://github.com/Wei-Shaw/sub2api to cheaply combine AI subscription services like Claude and Codex, since these subscriptions are much cheaper than API billing, and spreading this activity across multiple accounts makes it harder to detect for providers like Anthropic and OpenAI. I also assume that many of the accounts being used with sub2api are compromised and stolen accounts. Earlier this year, we saw Anthropic proactively notifying people who had Claude accounts compromised by infostealers.”
ㅤ
Darin Fredde, Senior Director and Offensive Security Evangelist, Ridge Security
“ARTEX didn’t invent the attack chain. It just took the coffee breaks out of it. What concerns me isn’t simply how many ARTEX instances Censys discovered. Not every deployment is malicious. It’s what we’re seeing in documented attacks, where automation combines reconnaissance, exploitation, and abuse of trusted relationships at speeds that leave defenders precious little time to respond. Attackers have always combined weaknesses to achieve their objectives. Agentic AI can accelerate that process without necessarily introducing new techniques. Our response shouldn’t be to panic over another AI framework. We need proven countermeasures, strong identity and access controls, and continuous offensive testing that challenges trust boundaries, business logic, and complete attack paths. The real question isn’t how quickly an AI agent can find a weakness. It’s whether our security controls can stop what happens next.”
ㅤ
Ryan McCurdy, Vice President of Marketing, Liquibase
“What’s concerning about ARTEX isn’t just how widely available these tools are. It’s how quickly they can operate. Attackers can now automate reconnaissance, test permissions, and move through systems at a speed that gives security teams very little time to respond.
“For databases, that creates another challenge. An attacker with valid credentials doesn’t necessarily need to exploit a vulnerability to make a damaging change. They may already have the permissions needed to execute it.
“Companies have spent years strengthening access controls and vulnerability detection but organizations also need to limit unnecessary privileges, monitor unexpected database activity, and enforce policies around changes before they reach production.
“AI is accelerating the attack lifecycle. The controls protecting critical systems need to account for that speed.”
This is bad as it is a safe bet that the bad guys are using tools like this to go after any organization that is not prepared for this sort of thing. So you need to choose which organization that you are.
Leave a comment »