Internet-scanning firm Censys says it observed 1,465 hosts running an exposed console of ARTEX, an open-source AI agent framework for autonomous penetration testing, as of 4 November 2026. About 650 of them sit in two blocks of identically configured hosting, which Censys says leaves roughly 815 distinct-looking deployments. TechCrunch reported the findings on 6 November.
Censys says the ARTEX console does not need to be reachable from the internet: “The ARTEX console does not require public-facing access, and overall global deployment is likely higher”. It adds that “Not every ARTEX instance is operated with malicious intent, and some of the hosts publicly exposed are likely operated by authorized testers”.
Business Pill · AI Agents Explained
A short explainer on AI agents. It teaches the general idea only and does not discuss ARTEX.
The key insight: As we read the Censys count, about 815 of the 1,465 exposed ARTEX consoles look like distinct deployments, about 56% by our arithmetic; Censys says the console does not need to face the internet at all, and that some of the exposed hosts are likely operated by authorized testers.
What Censys Found
According to the blog post by Censys principal security researcher Silas Cutler, 155 ARTEX hosts, or 10.6%, also run at least one other threat that Censys detects, including other AI attack frameworks, reconnaissance platforms, tunnelling tools and command-and-control software.
Censys says 32 open directories run on other ARTEX hosts today, exposing post-exploitation kits, stagers and implants. It also says it saw open directories on the ARTEX server named in CrowdStrike’s report starting 18 August 2026, seven weeks before that report was published.
Censys counts as of 4 November 2026 from its blog of 5 November: 1,465 hosts running an exposed ARTEX console; about 815 distinct-looking deployments after excluding roughly 650 hosts in two blocks of identically configured hosting; 155 hosts that also run at least one other threat Censys detects; and 32 open directories on other ARTEX hosts.
What ARTEX Is
Censys says ARTEX was published on GitHub on 26 July 2026 under the AGPL-3.0 licence by a developer using the name Autumn-27, who also wrote the asset-discovery platform ScopeSentry. It describes ARTEX as an AI agent layer in which a planner agent turns a goal into tasks and worker agents run tools and report back, and says it works with Anthropic, OpenAI or any OpenAI-compatible model endpoint.
TechCrunch reports that Microsoft has described ARTEX as a system of AI agents that can conduct cyberattacks “from reconnaissance through data exfiltration with little needed human interaction”. Censys says that on 8 October the author posted a statement denying involvement in the attacks and said the project would go closed-source with no further releases; the repository has since been taken down, but archived copies and rebrands still circulate.
The Two Campaigns
Censys says two threat intelligence companies linked ARTEX to attacks in October: CrowdStrike tied it to a campaign against South Korean financial institutions, and Microsoft tied it to the Storm-0940 compromise of ConnectWise customer tenants. We covered both: CrowdStrike’s report on the Korean finance firms and Microsoft’s 11 checks after the ConnectWise breach.
TechCrunch reports that Microsoft said the attackers used ARTEX to break into customers’ cloud environments at such speed that defenders had “little time to detect and respond”. TechCrunch also reports that many of the attacks linked to ARTEX involved simple weaknesses such as weak or known passwords and a lack of multi-factor authentication.
Our Numbers
By our arithmetic, the roughly 815 distinct-looking deployments are about 56% of the 1,465 exposed hosts, and 4 November, the date of Censys’s count, was 101 days after ARTEX’s public release on 26 July.
Connecting the Coverage
This week’s other AI-and-security pieces: DeepMind’s AI agents found two weaknesses in legacy 1024-bit RSA, Detail said an uncensored AI found 13,000 vulnerabilities, and the DOJ charged three men over an alleged $129M AI impersonation scheme. Earlier, India said hackers used four public AI tools to hit fintechs.
The Structural Read
As we read the Censys post, the exposure cuts both ways: the same open consoles and directories that could let outsiders reach the tool also let researchers such as CrowdStrike and Censys see what operators were doing.
As we read it, ARTEX sits in the same agent pattern as commercial tools: Censys describes a planner agent that sets tasks and worker agents that run tools, connected to Anthropic, OpenAI or OpenAI-compatible model endpoints.
As we read the coverage, the attacks TechCrunch describes did not need new techniques; TechCrunch reports that many relied on weak or known passwords and a lack of multi-factor authentication.
Censys, in its blog post of 5 November 2026
“The ARTEX console does not require public-facing access, and overall global deployment is likely higher”
Three Implications
FOR SECURITY TEAMS TechCrunch reports that many attacks linked to ARTEX relied on weak or known passwords and a lack of multi-factor authentication.
FOR MODEL PROVIDERS Censys says ARTEX works with Anthropic, OpenAI or any OpenAI-compatible model endpoint.
FOR THE TOOL Censys says the author announced the project would go closed-source and the repository has been taken down, while archived copies and rebrands still circulate.
The Business Engineer Lens
This story maps onto the Business Engineer framework The Agentic Harness War.
The analysis says: “The surface, not the model, governs autonomy.”
As we read it, an open-source agent framework that runs on any compatible model endpoint is one example of autonomy set by the harness around the model. The analysis does not discuss ARTEX.
What Is Not Established
Censys does not say who operates the exposed hosts or how many are used for authorised testing, and says overall deployment is likely higher than it can see. We did not read Microsoft’s or CrowdStrike’s reports in full for this piece; their findings are as summarised by Censys and TechCrunch. We did not contact Censys or the ARTEX developer. The 56% share and the 101 days are our arithmetic.
This Week In The AI Supercycle
Anthropic’s Reality Check, The Capital Squeeze, & The New World Order
This week’s issue: for two years the AI build-out was priced as a growth story. This week it started being priced as a credit story.
Read the full issue →
Business Engineer Framework
The Agentic Harness War
The Business Engineer analysis of who controls the surfaces where AI agents act.
Read the Map of AI →
The Bottom Line
Censys says it counted 1,465 web-exposed ARTEX consoles on 4 November, about 815 of them distinct-looking, and that 155 also ran other attack tooling. The open-source AI attack framework has been linked by CrowdStrike and Microsoft to two October campaigns, and its author has said it will go closed-source.
A note on sourcing. The counts, dates and descriptions of ARTEX are from the Censys blog post “ARTEX: Agentic Asbestos” by Silas Cutler, dated 5 November 2026, with data as of 4 November; Microsoft’s descriptions are as reported by TechCrunch on 6 November. The share and day count are our arithmetic. We did not contact Censys or the ARTEX developer.
Click Here For The Original Source.
——————————————————–
