ARTEX AI Hacking Framework Found on 1,465 Public Servers, Some Hosting Cyberattack Tools

Security researchers have found ARTEX, an AI-powered penetration-testing framework, exposed on 1,465 internet-facing hosts.

Some servers also hosted command-and-control tools, phishing software, and exploit files, showing how automated security-testing platforms are appearing alongside established attack infrastructure.

The findings offer defenders a view of these environments, including files operators left publicly accessible. The count does not mean 1,465 separate hacking groups are operating the framework.

Around 650 hosts shared repeated configurations across two hosting providers, suggesting cloned systems or servers using multiple addresses.

Removing those clusters leaves roughly 815 distinct-looking deployments. Public exposure also does not establish malicious activity, because authorized security testers can use ARTEX.

Researchers from Censys identified the exposed consoles and associated attack tools in a November 5 report. They described ARTEX as a dual-use framework, not a malware family.

Their investigation found additional threat detections on 155 hosts, or 10.6% of the total, and 32 open directories exposing tools, implants, and operator files.

ARTEX AI Hacking Framework Found on 1,465 Public Servers

Released on July 26, 2026, ARTEX combines a Go backend, Next.js console, and PostgreSQL database. It connects with ScopeSentry, an asset-discovery platform, to import domains, addresses, ports, and endpoints.

Operators define a target, testing scope, and objective; AI agents then plan tasks, execute tools, and record results. Earlier coverage of ARTEX enterprise attack automation explains how this approach reduces manual work across attack stages.

A planner breaks objectives into smaller actions, while worker agents run tools such as nmap and return findings. ARTEX maintains an asset graph showing discovered systems and an exploration graph tracking what has been tested.

It supports Anthropic, OpenAI, and compatible model endpoints, allowing operators to change providers without rebuilding the workflow.

Censys found CyberStrikeAI alongside ARTEX on 70 hosts, with PentAGI, HexStrike AI, and RedAmon also appearing. Other servers carried Vshell, Cobalt Strike, Adaptix C2, FRP, and Gophish.

These combinations matter because reconnaissance, phishing, remote access, and AI-assisted testing can sit together, although shared hosting alone does not prove a coordinated attack.

The exposed directories provided stronger operational clues. Their contents included Windows lateral-movement tools, a public sudo exploit, Linux implants, reverse-shell scripts, and compiled stagers.

One directory exposed

One directory exposed an operator’s home folder, including SSH material and shell history. Separate reporting on ARTEX Active Directory attacks describes how agents have supported credential attacks and movement between Windows systems.

Censys also traced an ARTEX server cited by CrowdStrike to open directories visible from August 18, seven weeks before CrowdStrike’s report.

That investigation linked ARTEX to attacks against South Korean financial institutions. Separately, Microsoft attributed ARTEX-assisted activity against ConnectWise customer tenants to Storm-0940.

Coverage of ARTEX Microsoft 365 targeting details that campaign’s scanning, password spraying, and OAuth abuse. Defenders should correlate infrastructure matches with authentication logs, endpoint activity, and network connections rather than treat every ARTEX console as hostile.

Censys recommends checking nearby open directories, tunneling services, unfamiliar LLM gateways, and historical scan records. Short-lived directories are particularly useful: ten disappeared and fifteen appeared elsewhere between November 3 and November 5.

Indicators of compromise (IoCs):-

Note: IP addresses and domains are intentionally Qdefanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Give your SOC the alert context to stops incidents quickly. Integrate Threat Intel from 16K SOCs.