- On November 4, 2026, Censys saw 1,465 servers with an open ARTEX console, an AI tool for automated break-ins. That is about 815 separate setups.
- 32 servers exposed open folders full of attack tools. ARTEX has been linked to attacks on South Korean banks and ConnectWise customers.
In short: Censys, a company that scans the internet for exposed systems, found hundreds of live copies of ARTEX, an AI tool for automated break-ins, with a control panel open to anyone and no password. The report describes what Censys saw on November 4, 2026, and TechCrunch picked it up on November 6.
What ARTEX is
- It is a free penetration testing tool published on GitHub on July 26, 2026. AI agents plan an attack, run tools and write down results until they reach the goal.
- It works with models from Anthropic, OpenAI or any compatible provider.
- After reports of attacks, its author said they were not involved and that the project would no longer be developed in public. The repository is gone, but copies and rebrands still circulate.
What Censys found
- 1,465 servers running an exposed ARTEX console. About 650 of them sit in two blocks of identical machines, which leaves roughly 815 distinct setups.
- 155 of those servers (10.6%) also run other attack tools, such as Cobalt Strike.
- 32 servers had an open directory with network takeover kits, implants and, in one case, an operator’s entire home folder.
- The server named in CrowdStrike’s report on attacks against South Korean banks had open directories from August 18, 2026, seven weeks before that report came out.
Where the attacks came from
Censys, citing Microsoft, says the group Storm-0940 used ARTEX in the ConnectWise breach: it tried to sign in to more than 2,250 organizations, peaking at 2,900 attempts per minute. According to TechCrunch, many of these attacks began with guessing weak passwords and a lack of multi-factor authentication.
How to read it
Censys stresses that not every copy is used by criminals; some belong to authorized testers. The lesson is still simple: AI makes attacks faster, but the door is usually opened by an old oversight. Turn on a second login factor wherever you can, and do not expose control panels to the internet when they do not need it. I write about securing projects in the AI code security hub.