Censys Finds 800+ Open Servers of Chinese AI Hacking Tool Artex With No Password

The tool used to attack others turned out to be as poorly protected as a corporate test admin panel forgotten behind a NAT. That is exactly what a fresh Censys report on Artex has shown.

What Artex Is and Why It Is in the News

Artex is an open source autonomous penetration testing system. It is a set of AI agents that carry out the whole path from reconnaissance to data exfiltration on their own, with almost no human involvement. That is how Microsoft describes it. The project was released in July, it is free, and it can be deployed on your own server. For those who cannot access the most powerful cyber models from Anthropic or OpenAI, it is a convenient alternative.

Since July, Artex has been tied to several major attacks. In September, CrowdStrike attributed attacks on South Korea's financial sector to a Chinese-speaking hacker who left an "open directory" with his instance. In October, Artex was used to attack ConnectWise, and then China-linked groups spied on thousands of organizations in the Microsoft cloud. According to Microsoft, data leaked so fast that defenders had almost no time to react.

What Censys Found

Censys scanned the internet and found more than 800 unique Artex deployments reachable from the web without a password. The study's author, Silas Cutler, stresses that far from all owners are malicious actors; many instances belong to authorized pentesters. But why they were exposed is unclear: Artex does not require it.

Such open systems also reveal the offensive arsenal, including implants, meaning covert software used to gain a foothold in a victim's network. The very instance used against Korean banks sat open for months. According to Censys, it held materials from attacks not only on banks but also on payment and gaming companies.

What This Means in Practice

The first takeaway is unpleasantly mundane: most Artex-based attacks relied on simple things. Guessing weak or known passwords and the lack of multi-factor authentication. The AI agent did not find a magic vulnerability; it simply checked the basics very quickly and at scale.

The second takeaway concerns security teams and developers themselves. If you run agentic tools, pentest frameworks, or internal AI panels, check whether they are exposed to the outside. Agents need keys, access, and action history, and all of this becomes valuable loot if misconfigured.

What to do right now:

• enable MFA everywhere it is still missing, especially for cloud consoles and IT support;
• remove weak and reused passwords and check them against breach databases;
• scan your own perimeter the way Censys does;
• restrict access to agent admin panels via VPN or an IP allowlist.

Limitations

A caveat is needed: Censys does not claim that all 800 instances are malicious. It is impossible to say for sure who is behind them. Moreover, closing Artex's source code recalls nothing: dozens of copies of the code still sit on code hosting platforms and can be used in attacks. Closed source will only limit new releases to paying customers.

The bottom line: the speed of attacks has grown thanks to AI, but the loopholes remain the same. Defense against agentic hacking begins not with exotic measures but with hygiene: passwords, MFA, and a closed perimeter. And, ironically, those who use powerful tools themselves must observe it first of all.