800-Plus Passwordless Artex AI Hacking Tools Exposed Online
Censys found more than 800 passwordless Artex AI hacking deployments online, exposing attack tools linked to Korean finance and the ConnectWise cloud attack.
Summary
As of November 6, 2026, Censys had identified more than 800 distinct Artex deployments accessible online without passwords, although the Chinese-made tool does not require internet exposure. Principal security researcher Silas Cutler said many instances support authorized testing, but public access could let outsiders launch attacks or obtain implants used to compromise networks and maintain access. Released publicly in July, Artex is a free, open-source autonomous penetration-testing system popular with users unable to access Anthropic or OpenAI’s advanced cybersecurity AI models. Microsoft said its agents can progress from reconnaissance to data theft with minimal human input.
CrowdStrike linked Artex to September attacks on the Korean finance industry by a Chinese-speaking hacker whose open directory had exposed the system for months. Censys said its data appeared to reach beyond South Korean banks to payment and gaming companies. Earlier in October, Chinese-linked hackers used Artex against IT support provider ConnectWise, rapidly entering customers’ Microsoft cloud environments and stealing data from thousands of organizations. Many Artex-linked attacks exploited weak or known passwords, missing multi-factor authentication and misconfigurations, exposing attackers alongside targets. Artex plans to become closed-source and restrict future releases to paying customers, but dozens of code copies remain on sharing sites and can support active attacks.
Positives
- Censys identified more than 800 exposed Artex deployments, giving defenders a defined set of passwordless systems to investigate.
- Many Artex instances support authorized penetration testing rather than malicious activity, Silas Cutler said.
- Artex plans to become closed-source, restricting future releases to paying customers.
- CrowdStrike and Microsoft traced Artex use across separate campaigns, clarifying its role and attackers’ methods.
Risks & concerns
- More than 800 Artex deployments were publicly accessible without passwords despite requiring no internet exposure.
- Exposed systems can reveal implants that attackers use to compromise networks and maintain persistent access.
- September attacks reached Korean financial institutions, with exposed data apparently extending to payment and gaming companies.
- The October ConnectWise attack enabled rapid theft from Microsoft cloud environments belonging to thousands of organizations.
- Weak passwords, known credentials, missing multi-factor authentication and misconfigurations enabled many Artex-linked attacks.
- Dozens of Artex code copies remain available on sharing sites for use in active attacks.