Over 800 AI Hacking Tools Exposed on the Public Internet: Artex Makes Automated Penetration Testing as Affordable as Cabbage

Cybersecurity firm Censys published scan results on November 6: over 800 Artex instancesaccessible without passwords. Artex is not ordinary software—it is an autonomous penetration-testing tool open-sourced in July, using AI Agents to automatically discover vulnerabilities, exploit them, and exfiltrate data.

In other words, one of the sharpest tools on both offense and defense—currently over 800 instances—is publicly accessible online for anyone to use. The absurdity lies in the fact that Artex itself does not need to be exposed to the public internet to function; users voluntarily deploy it there.

What is Artex: An unattended attack Agent

Artex is an open-source autonomous penetration-testing tool, logically closer to an “AI attack team” than a single scanner. Microsoft previously described it as a set of AI Agents capable of completing the entire process—from reconnaissance to data exfiltration—with minimal human intervention.

It gained traction for a practical reason: Anthropic and OpenAI’s most advanced cybersecurity models come with strict usage restrictions, making them inaccessible to most people. Artex, by contrast, is open-source, free, and self-hostable—making it the go-to alternative for teams (and attackers) lacking official authorization.

Silas Cutler, Chief Security Researcher at Censys, put it cautiously: Not every Artex instance is being used maliciously; many are run by authorized testers. The problem isThere is no justification for exposing testing systems to the public internet—these publicly accessible instances still contain attack tools such as implants, meaning whoever discovers them first can immediately use them.

Battles already fought: South Korea’s financial sector and ConnectWise

This is not a purely theoretical risk. In September, CrowdStrike attributed a large-scale attack against South Korea’s financial industry to a Chinese-language user. A key clue was the attacker’s “open directory”—an Artex instance exposed on the public internet for months, containing attack data far beyond South Korean banks, including payment and gaming companies.

The October attack against IT service provider ConnectWise was also linked to Artex: Attackers leveraged it to breach customers’ Microsoft cloud environments and steal data from thousands of organizations hosted there. Microsoft stated the attack moved so quickly that defenders had “almost no time to detect or respond.”

The most painful detail: All successful breaches exploited low-severity vulnerabilities

When these two incidents and their vulnerability details are examined side by side, the contrast is stark. Most associated attacks exploited the most basic issues:Weak or compromised default passwords, missing multi-factor authentication—not zero-days, not novel AI-invented attack techniques.

Here, AI’s role is not “inventing attacks humans cannot conceive,” but reducing the execution cost of “identifying these basic flaws → attempting exploitation → lateral movement” to nearly zero. Tasks that previously required days of manual effort now complete overnight via Agent clusters. The cost curves for offense and defense have been fundamentally rewritten.

This also explains why our reporting on Agent privilege escalation is growing increasingly frequent: from OpenAI Model Hacks into Crypto Wallets arrive Qwen3.8-Flash-Next leak exposed, all represent different facets of the same issue—where exactly does an Agent’s boundary lie once it obtains credentials?

Defensive tools are evolving in parallel—for example, Anthropic’s free OSS Scanner and OpenAI security model detects 948 Linux vulnerabilitiesAll involve using powerful models to audit open-source projects. But even the best tools won’t help if you leave the tool’s own door wide open.

What this means for ordinary teams: three immediate actions

• Audit your public-facing assetsAny self-hosted system labeled “admin console”: first verify whether it allows unauthenticated access. Systems like Artex often default to listening on 0.0.0.0—starting one on a test machine can instantly expose it to the entire public internet.
• Enforce identity boundaries for AI AgentsCredentials used by Agents must be short-lived, least-privilege, and auditable. Never use long-lived admin tokens just to make things “more convenient.”
• Implement multi-factor authentication (MFA) immediatelyIn both recent large-scale incidents, the absence of MFA was a critical force multiplier. This step is cheaper and more effective than purchasing any AI security product.

Artex goes closed-source—but “copies” remain

The Artex team later announced a shift to closed-source, offering new versions exclusively to paying customers—a proactive containment measure. Yet already-leaked code persists: dozens of Artex copies remain publicly available on code hosting platforms, ready to be weaponized. Once open-source models are released, they cannot be retracted.

A related signal: Google’s Gemini 4 Argon Explicit focus on cybersecurity—with autonomous vulnerability discovery and patching—and OpenAI treating cybersecurity models as a standalone product line. Security is emerging as the first “killer enterprise use case” for cutting-edge models—and both attackers and defenders are leveraging the same underlying models.

Frequently Asked Questions (FAQ)

What is Artex—and is it legal?

Artex is an open-source autonomous penetration testing tool, legally compliant as a security testing utility when used within its license terms. Its risk stems from misuse: conducting tests against unauthorized targets constitutes malicious activity. The project has since announced its transition to closed-source, with new versions available only to paying customers.

Why were over 800 instances exposed to the public internet?

Most cases stem from deployment oversights. Such systems default to binding to all network interfaces; when testers launch them on cloud servers without restricting ports via security groups, they become publicly accessible by default. Artex functions perfectly without public exposure—this is purely a configuration issue.

Could my server be scanned by such tools?

Yes—and that’s routine. Automated internet-wide scanning occurs daily. What determines the outcome is whether you’ve implemented basic protections: closing unnecessary public ports, enforcing multi-factor authentication, applying patches promptly, and avoiding weak passwords. Implementing these four measures causes the vast majority of automated attacks to abort at the first step.

How should enterprises defend against AI-powered attack Agents?

The core is controlling credentials and permissions—not trying to block traffic. Assign AI Agent accounts minimal privileges, short lifespans, and full auditability; require human approval for high-risk operations (e.g., data export, permission changes, fund transfers). See reference Meta’s Personal Agent Protocol with Shopify and Stripe The layered permissions approach within it.

Summarize

800 exposed Artex instances do not reveal a bug in any single product—they expose the industry’s unwarranted assumption of “AI tool default security.” Attack costs are collapsing to commodity levels thanks to Agents, while most organizations’ defenses remain stuck at weak passwords and no MFA. This gap will not close automatically this year.

Want ongoing coverage of AI security and tooling developments? Check out our AI Model Library and Tool Comparison Engineor continue reading:Determining whether “a specific game has been replicated” requires item-by-item comparison between output and original work—a step current models lack · the OpenAI agent leaking user photos · Full In-Depth Evaluations.