Hundreds of Artex hacking tools found exposed online
Hundreds of Artex AI hacking tools left unsecured on public internet servers, researchers report
AI agent concept with robot inside a laptop with a voice bubble on red background (Carol Yepes/Getty Images)
Security researchers have identified hundreds of servers hosting the Artex penetration testing framework that were left accessible to the public internet without password protection. The discovery was reported by the cybersecurity firm Censys, which noted that these instances were misconfigured and not intended for public reach.
As of Nov. 4, 2026, Censys identified 1,465 hosts running an exposed Artex console. After adjusting for templated copies and identical hosting configurations, researchers determined there were approximately 815 distinct deployments of the tool. The findings were published by Censys researcher Silas Cutler on Nov. 5, 2026.
Artex is an open-source, LLM-driven framework originally released in July 2026 by an entity known as Autumn-27. While the tool is designed for authorized penetration testing, it has been increasingly utilized to automate cyberattacks, including the scanning of platforms for exposed credentials and API keys. The project transitioned to a closed-source model following reports of public abuse.
The tool has been associated with several security incidents throughout 2026, including a breach affecting more than 90 South Korean organizations, attacks on ConnectWise Cloud Backup, and an accidental breach of the company WorkOS.