Censys finds hundreds of exposed Artex AI hacking consoles on the public web
TechCrunch cites Censys: more than 800 distinct-looking Artex deployments reachable without a password; the open-source autonomous pentest tool was linked to prior Korea finance and ConnectWise campaigns.
Why it matters
Censys researchers reported large numbers of internet-facing Artex management consoles, many without authentication, even though the framework does not require public exposure to operate. Artex is an open-source LLM-driven autonomous penetration-testing system previously tied by CrowdStrike and Microsoft to attacks on South Korean finance targets and ConnectWise customer tenants. TechCrunch's Friday report brings the exposure counts to a wider audience and notes that operators sometimes leave open directories with implants and exploit kits. Defenders should treat exposed offensive agent consoles like unauthenticated admin panels and hunt for co-located C2 and LLM-proxy tooling.
Key facts
- TechCrunch: 800+ distinct-looking Artex deployments without passwords
- Censys also reported ~1,465 exposed consoles including duplicate hosting blocks
- Linked previously to Korea finance and ConnectWise campaigns
- Some hosts expose open directories with implants