AI Hacking Tools: What 1,465 Exposed Artex Servers Reveal

AI hacking tools have moved from conference demos to real break-ins. On 5 November 2026 the internet-scanning company Censys published research showing 1,465 servers on the open web running the console of Artex, a free AI tool that can carry out most of a cyberattack by itself. This post explains what Artex is, what the exposed servers showed, how these tools work, and what you can do about them.

What happened with the exposed Artex servers?

Silas Cutler, a principal security researcher at Censys, scanned the internet for Artex's web console and wrote up the results. As of 3–4 November 2026:

• 1,465 hosts had a reachable Artex console.
• About 650 of them sat in two hosting blocks with identical setups, which Censys reads as copies of a template. That leaves roughly 815 deployments that look distinct. TechCrunch reported these as more than 800 deployments open to the web without a password.
• 155 hosts (10.6%) also ran at least one other tool Censys flags as a threat, such as the attack framework Cobalt Strike.
• Open folders on 32 further Artex hosts exposed attack material: exploit files, hidden malware ("implants") for keeping access to a victim's network, phishing droppers and, in one case, an operator's own home directory.

Most hosts were in the United States (726), Hong Kong (387) and China (177). Cutler told TechCrunch that not every instance is malicious and that many belong to authorised testers. Censys also notes that the console does not need to be public, so the real number of Artex installs is likely higher.

What is Artex?

Artex is an autonomous penetration testing framework. Penetration testing (or "pen testing") means attacking a system with permission to find weaknesses before criminals do. "Autonomous" means AI agents do the work instead of a person typing every command.

According to Censys, Artex was published on GitHub on 26 July 2026 under the AGPL-3.0 open-source licence, and TechCrunch reports it was developed in China. Microsoft describes it as a multi-agent system written in Go with a web interface, able to run a test from reconnaissance all the way to data theft with little human involvement. It can plug into models from Anthropic, OpenAI or any OpenAI-compatible service.

After CrowdStrike reported criminal use in early October, the developer said Artex would go closed-source. That did not put the genie back: archived copies and renamed forks are still circulating, Censys and TechCrunch report.

How do AI hacking tools like Artex work?

If you have seen our 30-second AI agents explainer reel, the pattern will look familiar: plan, act, check, repeat. Artex applies it to attacking networks.

1. A planner agent takes a goal, such as "get into this company's email", and breaks it into steps.
2. Worker agents run ordinary security tools for each step. Censys gives the network scanner nmap as an example.
3. A loop feeds results back. Microsoft says the agents build up a graph of the machines and weaknesses they find, then choose the next move.

None of the individual tricks are new. Password spraying (trying a few common passwords against many accounts) and scanning are long-standing techniques. What changes is speed and scale. Microsoft says one Artex-driven campaign peaked at 2,900 failed logons per minute, a pace no human team types at.

	Human-led attack	AI-agent attack (Artex-style)
Who chooses the next step	A skilled operator	A planner AI model
Speed	Limited by how fast people work	Microsoft saw under 3 hours to privileged access in several cases
Targets at once	Limited by team size	Hundreds of organisations (Storm-0940)
Skill needed	High	Lower: the tool supplies much of the know-how

Has Artex been used in real attacks?

Yes, in at least two campaigns documented by major security firms.

South Korean finance (late September to early October 2026). CrowdStrike said on 7 October that an unnamed, likely Chinese-speaking and financially motivated actor used Artex against South Korean financial institutions. At one bank the actor reportedly got into a loan progress service used by brokers. The main AI model behind that Artex setup was DeepSeek v4.1-flash, according to CrowdStrike, which said the number of affected organisations was unconfirmed. Censys adds that its scans saw the attacker's open folders from 18 August, seven weeks before CrowdStrike's report.

ConnectWise customers (October 2026). Microsoft attributes this one to Storm-0940, a China state-aligned group active since 2021. The timeline it gives:

• 10–14 October: password spraying against 327 accounts at eight organisations, producing more than 151,000 failed logons, with no successful sign-in seen.
• 15–16 October: ConnectWise's cloud backup application is compromised.
• After that: Artex agents use the stolen app identities to attempt sign-ins to more than 2,250 Microsoft cloud tenants. Because those apps were already trusted by customers, no user had to log in.

Microsoft says most of the targeting failed, but the group still gained privileged, persistent cloud access at many organisations in a short time. TechCrunch reported that ConnectWise paused access to its backup service while it investigated.

Why does this matter?

The skill barrier is dropping. TechCrunch notes that Artex is popular with people who cannot get the most advanced security models from Anthropic or OpenAI. The same week, TechCrunch reported that OpenAI's newest cybersecurity model is limited to the top tier of its Daybreak programme for vetted researchers, and that some defenders argue such limits leave them behind attackers using open tools.

Supply chains are the target. One trusted vendor app opened a path to thousands of customer tenants. If you connect third-party apps to your Microsoft 365 or Google Workspace, their permissions are your attack surface. Our what is an API reel explains how apps talk to each other in the first place.

Attackers make mistakes too. The exposed consoles and open folders are a gift to defenders: they reveal tools, prompts and infrastructure that researchers can track.

What should you do?

• Turn on multi-factor authentication everywhere. TechCrunch reports that many of the South Korean targets lacked it. Password spraying fails against accounts with MFA.
• Kill weak, default and reused passwords, especially on admin and service accounts.
• Audit third-party app permissions. Microsoft recommends least privilege for multi-tenant apps and consent grants, and watching for new app credentials, role changes and odd app-only activity.
• Keep logs, and keep them long enough. Microsoft asked ConnectWise customers to review activity back to 1 October where records exist. Short retention would have made that impossible.
• If you run AI pen-testing tools yourself, never put the console on the public internet, and only test systems you have written permission to test.
• For students and job seekers: understanding both AI agents and cloud identity (how apps and users prove who they are) is a valuable combination to learn.

Want help building AI agents that are useful and locked down? Start a project with byagents.

Researched and drafted with AI agents by byagents, fact-checked against the sources above. Edited by Yashvanth S.