Censys scanned the open internet and found 1,465 live consoles of Artex, the Chinese-made AI penetration testing tool already tied to bank breaches in South Korea, sitting wide open with no login required.
TechCrunch reported on November 6 that security researchers at Censys identified 1,465 hosts running an exposed Artex console as of November 4, the kind of exposure that hands anyone with a browser a working AI hacking toolkit without needing to steal a single credential. After stripping out roughly 650 hosts that belonged to two blocks of identically configured hosting, likely bulk deployments rather than separate operators, the researchers were left with about 815 distinct-looking installations still reachable from the open web.
Artex is an open-source agentic pentesting framework: software that wraps a large language model in a harness, handing it a command shell, a shared notes file for tracking what it finds, and a planner that splits a break-in into tasks for several AI agents working in parallel. It’s been public since July, and in that short window it has already shown up in real attacks. Chinese hackers used it against more than 200 organizations across 14 countries, according to CrowdStrike, and an unattributed attacker ran it against seven South Korean financial institutions between late September and early October, exfiltrating the personal data of roughly 68,000 people.
What makes the new Censys findings different is where the exposure sits. This isn’t a leak of credentials or a config file. It’s the live tool itself, reachable by anyone who knows where to look.
Of the exposed hosts, 155 were also running at least one other threat tool alongside Artex, and 32 had open directories, meaning their file systems were browsable with no authentication at all. Inside those open directories, researchers found Windows lateral-movement tools, a public sudo exploit, Linux implants, reverse-shell scripts and compiled stagers, the connective tissue of an actual intrusion, not a demo environment. Anyone who found one of those directories could, in principle, lift a working exploit chain and point it somewhere else.
Defenders should be uneasy about this. An AI pentesting framework is supposed to probe your own systems for weaknesses before an attacker does. Left exposed, it does the opposite: it hands a stranger the weaknesses, the tools, and in some cases the exploit code, all in one place, no development effort required.
Frankly, the operators who left these consoles open didn’t need to be hacked to leak this material. They just never locked the door. That’s a far more common failure than a sophisticated breach, and it’s exactly why Censys was able to find over a thousand of them with a routine internet scan rather than any kind of intrusion.
The developer is already pulling back
Artex’s creator, a Chinese cybersecurity engineer who goes by the alias Autumn, made the project private earlier this fall after South Korean investigators linked it to the bank breaches, and has since said the tool will go closed-source, limiting future access to paying customers rather than anyone on GitHub. That move addresses who can download new copies of Artex. It does nothing for the 1,465 consoles Censys found still running and still exposed as of November 4, since those are existing deployments, not new downloads.
Limiting new downloads and securing what’s already running are two different jobs. A framework can restrict its source code while thousands of already-running instances remain open to the internet with no login screen in front of them. Closing the front door on new users doesn’t touch the installations that were already live.
Agentic pentesting tools like Artex are good at exactly what they’re built for: cheaply enumerating services across many targets and iterating automatically when something fails. That’s useful for a security team testing its own network. It’s just as useful, run by someone else, against a network that isn’t theirs. The Censys count shows how many of those tools are currently sitting on the open internet with nothing stopping either kind of user from logging in.
Also read: Microsoft Winds Down Oracle Deal To Rent AI Cloud Capacity • Walmart opens checkout to AI shopping agents while Amazon keeps them out • Three Men Charged in $129 Million AI Voice Cloning Fraud Scheme
The Metropolix, from Startup Fortune
→
This article is posted in AI News, check it out for more related stories.
Almost there. Sign in and your reply posts straight away.
Click Here For The Original Source.
——————————————————–
