Security firm Censys found more than 800 Artex deployments accessible without a password. The tool has been linked to attacks on South Korean finance firms and ConnectWise.
By Hermes-Vector AI Desk
Security researchers have found hundreds of copies of a Chinese-made AI hacking tool publicly exposed to the internet, potentially allowing outsiders to launch cyberattacks against unsuspecting targets.
Cybersecurity firm Censys, which scans the internet for exposed or vulnerable systems, said it identified more than 800 distinct deployments of Artex that were accessible from the web without needing a password to log in. Silas Cutler, principal security researcher at Censys, said not every instance of Artex is operated maliciously and many are used for authorized testers. But it is unclear why hundreds of these Artex systems are exposed to the web, as the software does not require them to be accessible from the internet.
Artex is an open source autonomous penetration testing tool, meaning software that automatically probes computer systems for weaknesses. Microsoft has previously described Artex as a system of AI agents that can conduct cyberattacks “from reconnaissance through data exfiltration with little needed human interaction.”
Security companies have linked the use of Artex to several broad-scale cyberattacks, including against the Korean finance industry in September. Cybersecurity giant CrowdStrike attributed the attacks to a Chinese-speaking hacker who used an Artex instance in the attacks, in part because the hacker had left an “open directory” hosting the system. Censys said that its data showed the Artex instance in question had been publicly exposed for months, and appeared to contain more attack data that extended “well beyond South Korean banks,” including payment and gaming companies.
Artex was also used in an attack on IT support giant ConnectWise earlier in October, which allowed Chinese-linked hackers to spy on thousands of organizations whose data and files are hosted in Microsoft’s cloud. Microsoft, which has visibility into the attack, said in a blog post that the hackers used Artex to break into customers’ cloud environments and steal their data at such speed that defenders had “little time to detect and respond.”
Many of the attacks linked to Artex involved exploiting simple vulnerabilities, such as guessing weak or known passwords, and a lack of multi-factor authentication.
Artex has since announced it would go closed-source, effectively limiting further releases for paid customers. There are still dozens of copies of Artex’s code available on code-sharing sites that can still be used in active attacks.
The publicly accessible systems expose attack tools, such as implants (hidden malicious software) used to compromise and maintain persistent access to a victim’s network. The findings underscore how even powerful hacking tools can be misconfigured to be publicly accessible by anyone, increasing the chance that someone will find and misuse them.
Sources
This article was drafted with AI assistance and checked against the sources above. Company claims are reported as claims. Cover image is AI-generated.
The day's checked news, by email
One short email a day with the top stories. Free, and you can unsubscribe in one click.
Or follow for the latest news:
No comments yet. Start the discussion.
TechTrending
A British Airways Boeing 787-8 has remained at Pittsburgh International Airport since August 28, 2026, after a ground service vehicle collided with the aircraft, causing damage that has complicated repairs.
TechTrending
The Royal Navy has formally commissioned the 1st Autonomous Squadron, its first squadron made up entirely of uncrewed boats, at HMNB Portsmouth.
