There’s a bitter irony in this one. A tool built to break into other people’s systems is being run by hundreds of operators who left their own systems open to anyone with a browser.
Security firm Censys reported finding more than 800 distinct deployments of Artex reachable from the internet with no login. Artex is a Chinese-made, open source autonomous penetration testing tool. In plain terms, it’s software that probes computer systems for weaknesses on its own. Microsoft has described it as a system of AI agents that can run attacks “from reconnaissance through data exfiltration with little needed human interaction.”
Since its public release in July, Artex has been linked to several real attacks. It’s free, and that is the appeal. Anyone who can’t get access to the most advanced cybersecurity models from Anthropic or OpenAI can download Artex and run it on their own servers. Vendors like to talk about guardrails on their frontier models. Open source tooling like this shows what happens when those guardrails simply aren’t part of the product.
Censys researcher Silas Cutler said not every exposed instance is malicious, and many belong to authorized testers. Fair. But nobody knows why so many are public, because Artex doesn’t need to be internet-facing. That points to sloppy configuration rather than design necessity. And the consequences go beyond embarrassment. Exposed servers also reveal attack tooling, including implants, the hidden malicious software used to compromise a victim’s network and keep persistent access.
The attack record is the part that should worry ordinary users. CrowdStrike tied attacks on the Korean finance industry in September to a Chinese-speaking hacker using Artex, partly because that person left an open directory hosting the system. Censys says the instance had been exposed for months and held data reaching “well beyond South Korean banks,” including payment and gaming companies. Think about that. Data on the victims of an attack was sitting in public, which means those people were compromised twice.
Then there’s ConnectWise. Earlier in October, Chinese-linked hackers used Artex in an attack that let them spy on thousands of organizations whose files live in Microsoft’s cloud. Microsoft said the attackers broke into customers’ cloud environments and stole data so fast that defenders had “little time to detect and respond.” If your employer or a vendor you rely on was in that pool, your data may have gone with it.
Here’s the uncomfortable detail. Many of these attacks didn’t rely on clever zero-days. They exploited guessable or known passwords and missing multi-factor authentication. The AI isn’t doing magic. It’s doing the boring stuff, relentlessly and at machine speed. That makes basic hygiene, like unique passwords and MFA everywhere, more important, not less.
Artex has now said it’s going closed-source, limiting future releases to paying customers. Don’t take that as a fix. Dozens of copies of the code remain on code-sharing sites and can still be used in live attacks. You can’t un-publish software, and a paywall on new versions doesn’t recall the old ones.
The bigger picture is clear enough. Automated offensive tools are getting cheaper and easier to run, while defenders still struggle with the basics. The attackers’ own mistakes may help researchers track them, but that’s a thin comfort when your data is the thing being stolen.