Censys finds over 800 unprotected Artex AI hacking tool deployments exposed online

Security scanning firm Censys has discovered more than 800 distinct deployments of Artex, a Chinese-made autonomous AI hacking tool, that anyone on the internet can reach without a password, TechCrunch reports. The exposed instances turn an offensive AI system into an open attack surface that outsiders can find, inspect and potentially abuse.

An autonomous hacking tool anyone can run

Artex is an open-source penetration testing framework that automatically probes computer systems for weaknesses. According to TechCrunch, it has been linked to several cyberattacks since its public release in July. Part of its appeal is access: it offers capabilities that many users cannot obtain from the most advanced cybersecurity AI models sold by Anthropic or OpenAI, which are not freely downloadable.

Microsoft has characterized Artex as a system of AI agents able to carry out an attack "from reconnaissance through data exfiltration with little needed human interaction."

Why the exposure matters

In a blog post, Censys principal security researcher Silas Cutler noted that not every exposed instance is malicious, and many belong to authorized security testers. But the software has no technical requirement to be reachable from the internet, so it remains unclear why so many operators left their deployments open.

The exposure cuts both ways, TechCrunch points out. It hands outsiders a ready-made hacking capability they did not have to build, and it also leaks the operators' own attack tooling, including implants, the hidden malicious software used to compromise a victim's network and maintain persistent access to it.

A tool already tied to major attacks

Artex is not a theoretical risk. CrowdStrike attributed September's broad-scale attacks on the Korean finance industry to a Chinese-speaking hacker who ran an Artex instance, and identified that operator partly because the hacker had left the system in an openly browsable directory. Censys said its data showed the same instance had been publicly exposed for months and appeared to contain attack data reaching "well beyond South Korean banks," including payment and gaming companies.

Earlier in October, Artex was used in the breach of IT support giant ConnectWise, which allowed China-linked hackers to spy on thousands of organizations whose data is hosted in Microsoft's cloud. Microsoft, which had visibility into the intrusion, said the hackers used Artex to break into cloud environments and steal data so quickly that defenders had "little time to detect and respond."

According to TechCrunch, many of the attacks linked to Artex did not depend on sophisticated techniques. They exploited simple weaknesses such as weak or already-known passwords and a lack of multi-factor authentication.

Artex moves to a closed model

The project behind Artex has since announced it will go closed-source, restricting further releases to paying customers. That does not clean up what is already circulating: dozens of copies of the code remain available on code-sharing sites and can still be used in active attacks.

Why it matters

This story is about two failure modes compounding each other. First, offensive AI capability has become commodity software: an autonomous agent that can chain reconnaissance through data theft is now something anyone can download and run. Second, the same hygiene failures Artex exploits in its victims, weak credentials and careless configuration, are exposing Artex deployments themselves. Anyone who locates one of these 800-plus instances gains a powerful attack tool, while the original operator absorbs the attribution. For defenders, the takeaway is straightforward: inventory what is internet-facing, enforce authentication everywhere, and assume that tools built to attack you are themselves being attacked and reused.