Censys finds more than 800 Artex AI hacking deployments open to anyone on the web

Censys, an internet-scanning firm, says 1,465 hosts were running an exposed console for Artex, an open-source AI penetration testing tool, on November 4. TechCrunch reported the findings, which Censys published in its own post on November 5.

Artex is an LLM-driven framework that probes systems for weaknesses with little human input. According to Censys, it was published on GitHub on July 26, 2026. CrowdStrike and Microsoft both reported its use by threat actors in October.

1,465 consoles, 815 that look distinct

About 650 of the hosts sit in two identically configured hosting blocks: 493 at PEG Tech and 157 at Yancy Limited. Without them, Censys counts about 815 distinct-looking deployments. TechCrunch’s figure of more than 800 refers to this narrower count.

By country, Censys lists 726 consoles in the United States, 387 in Hong Kong and 177 in China. Japan has 51, Singapore 38 and South Korea 21. Port 8787, the Artex default, is the most common, followed by 8790, 443 and 80. Censys says the true total is probably higher, because the console does not need to face the public internet.

Open directories hold implants and an operator’s home folder

Thirty-two of the hosts had open directories when Censys wrote its post. Their contents included a Windows lateral-movement kit, a public sudo exploit with brute-force scripts, several Linux implant builds, reverse-shell scripts and a compiled Windows stager. Censys also lists about 18 HTA droppers and a private key for a man-in-the-middle root certificate. One directory was an operator’s home folder, with SSH data and shell history.

Another 155 hosts, or 10.6%, also ran at least one other detected threat tool, such as Cobalt Strike, Adaptix C2, Vshell or FRP. Forty-three ran LLM gateway or reseller software, mostly CLIProxyAPI (19) and New API (18). The set is volatile: between November 3 and 5, ten open directories closed and fifteen new ones appeared.

Censys is careful about what this shows. It does not say every deployment is malicious. TechCrunch quotes the firm’s principal security researcher, Silas Cutler, as saying many are used by authorized testers, and that it is unclear why so many are reachable from the web.

How an open directory helped link Artex to a bank attack

The exposure matters because mistakes by operators have already helped defenders. CrowdStrike assessed with moderate confidence that a financially motivated Chinese-speaking actor used Artex against banking services in South Korea in late September and early October, according to Censys. Censys says its scans recorded open directories on the host named in CrowdStrike’s report from August 18, about seven weeks before that report appeared on October 7. Scan history kept the file listings after the operator removed them.

Microsoft has also attributed a ConnectWise supply-chain compromise to a group it tracks as Storm-0940. Per Censys, the group tried sign-ins to more than 2,250 tenants, peaking at 2,900 attempts per minute. Infosecurity Magazine covered that report; the Microsoft post itself could not be opened for this article. These are the findings of the security firms involved, not court findings.

Artex’s developer posted a statement on October 8, according to Censys, saying the project was meant for testing within authorized scopes and would go closed-source. TechCrunch notes that dozens of copies of the code remain on code-sharing sites. Closing the source therefore does not remove versions already in circulation.

What defenders can do now

Censys gives hunting guidance rather than a formal fix. It suggests searching for the console by its page title and Next.js assets, checking ports 8787, 8790 and 443, and looking for nearby Vshell or FRP listeners. It also recommends watching egress logs for unfamiliar LLM proxies and blocking the indicators listed in its post. TechCrunch adds that many Artex-linked attacks relied on simple weaknesses such as weak passwords and missing multi-factor authentication, so basic account hygiene still blunts the tool.

The numbers come from one scanning firm’s methods, using page titles and static assets, and have not been independently checked. Censys says it cannot see who operates each console, and the reasons for the exposure remain unexplained.