Censys finds 1,465 exposed Artex AI attack consoles through a page-title fingerprint

Censys reported on November 5 that it had counted 1,465 internet-exposed consoles for Artex, an open-source, LLM-driven autonomous penetration testing framework that Microsoft and CrowdStrike have linked to intrusion activity in October. The consoles were not found through any novel technique but through an ordinary fingerprint: the web page title.

Artex appeared on GitHub in July 2026. Microsoft describes it as a system of LLM-driven agents that carries out penetration testing autonomously, from reconnaissance through data exfiltration, and on October 21 tied it to a ConnectWise supply-chain compromise by a group it tracks as Storm-0940. According to Censys, CrowdStrike and Microsoft attributed malicious use of the framework to two separate campaigns that month, and WorkOS previously said Artex was likely behind an intrusion into its sales tool.

How Censys found the consoles

Censys matched hosts whose HTML page title begins with "ARTEX" followed by a space, colon or em dash, and whose page body loads Next.js static assets. The default console port is 8787/tcp, with 8790 and 443 also common; Censys counted 1,931 endpoints on port 8787 alone. It also spotted customized builds, including an "ARTEX MX" variant on four adjacent hosts. Any operator who renames the console so the title no longer starts with "ARTEX" falls outside the query, so the true count is likely higher.

The 1,465 hosts also do not equal 1,465 operators. Censys says about 650 sit in two blocks of identically configured hosting, leaving roughly 815 distinct-looking deployments, a figure TechCrunch reported as more than 800 distinct deployments reachable from the web without a password. By country, Censys lists 726 hosts in the United States, 387 in Hong Kong and 177 in China. The company cautions that some exposed consoles are probably operated by authorized testers, and that the console does not require public-facing access, meaning overall deployment is likely larger than the exposed count.

What runs beside the consoles

Roughly one in ten exposed consoles shared a host with other tooling. Censys found that 155 of the 1,465 hosts, or 10.6 percent, also ran at least one other threat it detects, led by CyberStrikeAI on 70 hosts, along with Vshell, Cobalt Strike and Adaptix C2. Another 32 open directories on Artex hosts held post-exploitation kits, stagers and implants. In the case CrowdStrike investigated, the actor left open directories exposing a .claude folder, prompts, session histories and ARTEX configuration files. Censys separately describes one host with an exposed home directory containing .ssh and .bash_history, and another leaking a MITM root CA private key.

Model traffic as the tell

For teams that ship LLM features, the most relevant detail concerns model traffic. Censys found 43 Artex hosts also running self-hosted LLM gateway or reseller software, mainly CLIProxyAPI on 19 hosts and New API on 18. In the CrowdStrike case, the actor used DeepSeek as the main model, likely purchased through an API reseller, and ran Claude Code sessions backed by GLM and Grok; Artex supports Anthropic, OpenAI and OpenAI-compatible endpoints. Censys advises defenders that unfamiliar LLM proxies and resellers appearing in egress logs are worth investigating, a signal that only works if an organization knows which model endpoints its own services are supposed to call.

Closed source will not remove it

Censys says the Artex author has stated the project will go closed-source with no further releases, and the repository has since been taken down. Archived copies and rebrands are still circulating, and TechCrunch reports dozens of copies remain on code-sharing sites. TechCrunch also notes that many of the linked attacks got in through weak or known passwords and missing multi-factor authentication rather than any sophisticated exploit.

Why it matters

The finding shows that attack infrastructure built on LLM agents is now enumerable at internet scale, and that it is discoverable through the same mundane fingerprints, a page title and a framework's asset paths, that expose any poorly configured self-hosted dashboard. Renaming a console defeats the title query, but model calls still have to leave the network, which makes egress logs a more durable detection point. For organizations running LLM features in production, the practical question Censys raises is whether they could spot an unapproved model reseller domain in their own traffic today.