Security firm Censys found 1,465 hosts running publicly reachable consoles for ARTEX, an AI-assisted penetration testing tool that attackers have adopted.
The raw number overstates the problem. Censys said roughly 650 of those hosts belonged to two groups of identically configured hosting infrastructure, which leaves about 815 unique installations. Of the 1,465, 155 (roughly 10%) also ran at least one common attack tool: Cobalt Strike, Vshell, or Adaptix C2. Censys also said not every exposed instance is malicious. The researchers added that the ARTEX console normally does not need to face the public internet, and that real global deployment is "likely higher".
The more revealing finding is what operators left lying around. Censys found 32 open directories holding exploit binaries, post-exploitation tools, and other sensitive files. One install exposed an operator's entire home directory, including SSH configuration and shell command history. At least 70 hosts paired ARTEX with another AI offensive tool, CyberStrikeAI, and others ran PentAGI, HexStrike AI, or RedAmon.
ARTEX appeared in late July 2026 as an LLM layer on ScopeSentry, a Chinese asset-discovery and scanning platform from the same developer. On October 7, CrowdStrike reported malicious use. The next day the developer said the tool was meant for authorized testing, closed the source, and stopped releasing updates. Censys said archived copies, translations, and rebrands still circulate.
CrowdStrike tied one campaign to a financially motivated Chinese actor that hit South Korean financial institutions, using DeepSeek v4.1-flash as its main model alongside Claude Code and Grok. That team was found partly because it left prompts, session histories, and configuration files in open directories, about seven weeks before CrowdStrike published. Microsoft separately linked ARTEX to Storm-0940, which reportedly peaked at 2,900 sign-in attempts per minute.
The pattern is that AI agents speed up attackers, but they do not fix sloppy operations. Pulling a repository stopped new releases, not the copies already in the wild. For defenders, the carelessness of the operators may be the more useful signal.