Security researchers from Censys identified over 800 instances of the Chinese-developed Artex AI hacking tool that were publicly accessible online without password protection. The software, which functions as an autonomous penetration testing system, was released as open-source in July.
Microsoft reports that Artex enables AI agents to execute cyberattacks, ranging from initial reconnaissance to data exfiltration with minimal human intervention. The tool has been linked to multiple large-scale incidents, including attacks on the Korean finance sector in September and the IT firm ConnectWise in October.
CrowdStrike investigators noted that attackers utilized exposed Artex instances to compromise networks, often targeting systems with weak passwords or lacking multi-factor authentication. Data from these exposed instances suggests the tool was used to target payment and gaming companies beyond the initial scope.
Following these security concerns, the developers of Artex have announced a transition to a closed-source model, restricting future releases to paid customers. Despite this change, numerous copies of the software remain available on various code-sharing platforms for potential use in malicious operations.
