The Pulse

Censys finds exposed ARTEX consoles alongside other AI attack tools

Censys observed 1,465 hosts with exposed ARTEX consoles as of November 4, including roughly 815 distinct-looking deployments. Its latest analysis says other AI attack frameworks and tools appeared on some of the same hosts.

AI.info Team · · fact-checked · against 5 sources ↓ · Published 12 Nov 2026

Censys observed 1,465 hosts with exposed consoles for the AI penetration-testing framework ARTEX as of November 4, including hundreds of deployments that appeared distinct and some hosts running other attack tools. In an analysis published November 12, the security company said the framework had moved from an open-source release to use in attacks in less than three months.

About 650 hosts sat in two blocks of identically configured hosting, leaving roughly 815 distinct-looking deployments, according to the company’s earlier research. The console does not need to be publicly accessible, and Censys said the overall number of deployments is likely higher; some exposed instances are likely operated by authorized testers rather than malicious actors.

Tools sharing hosts

Of the hosts in the count, 155 also ran another threat detected by Censys, while 43 ran self-hosted large language model gateways such as CLIProxyAPI and New API. The other detected tools included command-and-control software as well as AI-assisted testing frameworks.

CyberStrikeAI was the most common AI testing tool found alongside ARTEX, sharing 70 hosts with it, Censys said. The company also identified PentAGI, HexStrike AI and RedAmon on hosts with ARTEX.

From testing framework to attacks

ARTEX was released on GitHub on July 26 by a developer using the name Autumn-27, under the AGPL-3.0 license. The framework uses AI agents to carry out penetration-testing tasks, assembling information about discovered assets as it works.

The original repository has been removed, but a rebrand called ScopeWeaver was circulating after its removal. Censys said forks and rebrands were already circulating before the repository came down.

In an October report, CrowdStrike linked ARTEX to a campaign against South Korean financial organizations that resulted in stolen data. The security company assessed with moderate confidence that the unidentified actor was likely a Chinese speaker and financially motivated.

Censys said its scans showed an open directory on a server identified in that investigation had been serving files since August 18, seven weeks before CrowdStrike’s report became public. The directory exposed information including prompts, session histories and configuration files.

Other incidents and exposed files

Microsoft separately assessed that the China-state-aligned actor it tracks as Storm-0940 was responsible for the ConnectWise supply-chain compromise and used ARTEX to accelerate activity against downstream victims. Following the unauthorized access, the actor used the framework to attempt sign-ins to more than 2,250 tenants, according to Microsoft.

The presence of an affected application or a successful attacker authentication did not necessarily mean customer data had been accessed or stolen, Microsoft cautioned. The company also described activity in which the actor used compromised application credentials to authenticate to customer environments without an interactive user sign-in.

During its earlier research, Censys found 32 open directories on ARTEX hosts; between November 3 and 5, ten closed and fifteen new ones appeared on other hosts. The company said most of the directories it studied were active for hours to a couple of days.

Censys also tracks Cairn, a separate open-source multi-agent platform that has been linked to attempted intrusions. A Cloud Security Alliance research note said Reuters and security firm NorForge disclosed an operation using Cairn to attempt intrusions against more than 1,200 websites and breach sites belonging to more than 100 companies.

The alliance noted that Reuters could not establish how much data, if any, was taken in that operation. Its research note said some exposed Cairn panels appeared to belong to legitimate testing operations.