Researchers Find Hundreds of Exposed Consoles for Chinese AI Hacking Tool

Security researchers have found hundreds of unprotected installations of Artex, a Chinese-built artificial-intelligence hacking framework, sitting open on the public internet, according to a report published by the internet-scanning firm Censys. The firm's threat-research team said it identified roughly 1,465 internet-facing hosts running an exposed Artex console, which it narrowed to approximately 815 distinct-looking deployments after accounting for duplicate configurations inside the same hosting blocks.

Artex is an open-source, AI-driven penetration-testing system, first published on GitHub in July, that uses one AI "planner" agent to decide what to attack and a set of "worker" agents to carry out the work, from scanning networks to pulling data out of them. It can be pointed at models from Anthropic, OpenAI or other compatible providers, and anyone can download and run it on their own servers. The tool was built on top of an existing network-scanning platform called ScopeSentry, created by the same developer.

What Censys found

In a blog post titled "Artex: Agentic Asbestos," Censys researcher Silas Cutler wrote that 155 of the exposed hosts, or roughly one in ten, were also running separate attack infrastructure the company already tracks, including Cobalt Strike, Vshell or Adaptix C2 implants. Thirty-two of the exposed hosts had "open directories" — essentially unlocked folders — containing post-exploitation tools, credential-harvesting material and other attacker files that anyone on the internet could browse. The most common exposed port, 8787, turned up on more than 1,900 endpoints, with the largest concentrations of hosts located in the United States, Hong Kong and mainland China. Cutler cautioned that large host counts in a few hosting blocks likely reflect standardized server templates rather than hundreds of individual operators, and that Artex does not need to be internet-facing to function, meaning the true number of deployments worldwide is probably higher than what scanning alone can see. Between November 3 and 5 alone, Censys recorded ten open directories closing while fifteen new ones appeared, evidence that the exposure problem is actively shifting rather than static. The company's developer has since said the project will move to a closed-source, paid model, which would limit future public releases but does nothing to pull back copies already circulating on code-sharing sites.

A tool already linked to real intrusions

The exposure report lands weeks after Artex was tied to two separate attack campaigns. Microsoft's security team said in an October 21 blog post that a China state-aligned group it tracks as Storm-0940 used Artex to breach IT-management firm ConnectWise's cloud backup service, stealing application credentials that gave the hackers a path into customers' Microsoft-hosted environments. Microsoft said the group attempted sign-ins across more than 2,250 tenant organizations and, during one password-spraying burst between October 10 and 14, generated more than 151,000 failed login attempts at a peak rate of nearly 2,900 per minute — a tempo the company said left "very little time for defenders to respond." Microsoft said some attackers reached privileged cloud access in under three hours from the start of targeting, a speed it attributed directly to AI agents that are "not constrained by factors affecting humans."

"The speed of the activity allows very little time for defenders to respond to those alerts," Microsoft's security team wrote of the Storm-0940 campaign.

A separate campaign, which CrowdStrike attributed to a financially motivated, Chinese-speaking actor, used Artex against South Korean financial institutions beginning in late September. Brokerage Daishin Securities disclosed that the wave exposed personal data belonging to 38,490 customers, while asset manager Mirae Asset and crypto exchange Bithumb separately reported intrusions that have not yet been publicly tied to a cause, TechCrunch reported. South Korea's financial regulator has since urged firms to tighten security and ordered checks on dozens of private-sector systems.

Who else has been hit

Identity-management company WorkOS disclosed in a security bulletin dated October 30 that an intruder gained unauthorized access to an internal application used by its sales team, exposing customer account summaries and excerpts of sales calls, support conversations and customer Slack messages. WorkOS founder Michael Grinich said the company traced the intrusion to Artex after spotting two distinctive user-agent strings — "artex-enrich/1.0" and "norma/0.4" — in web server logs. WorkOS said it found no evidence that its core authentication product or customer production data was accessed, disabled external access to the affected tool and hired an outside forensics firm. Infrastructure provider Chainstack disclosed a separate, Artex-linked intrusion around the same time. Both companies sell developer infrastructure used by other technology firms, including, in WorkOS's case, identity services for AI labs — underscoring how a single leaked or misused tool can ripple into the supply chains of companies that have nothing directly to do with China or with Artex's original developer.

What happens next

None of the companies involved — Microsoft, ConnectWise, WorkOS or the South Korean financial firms — have said the exposed consoles Censys found were the specific machines used in their breaches, and Censys itself stressed that not every exposed instance is malicious; some belong to authorized penetration testers who simply left a console open by mistake. But the overlap is the point researchers are raising: because Artex's code remains freely downloadable on multiple code-sharing sites even after its developer restricted future releases, security teams expect copies to keep surfacing in new attacks regardless of what the original project does next. Microsoft's advisory urges affected organizations to keep disabled ConnectWise connections offline until a vendor fix is confirmed, preserve logs before removing any suspicious enterprise application, and extend audit-log reviews back to October 1. Censys said it will continue tracking exposed consoles and open directories, which it argues inadvertently help defenders by revealing attacker tooling even as they also expose the operators running it. For now, the firms that have disclosed intrusions say their investigations are ongoing, and no government agency has yet attributed the Artex-linked campaigns to a specific state actor or individual by name.