Hundreds of Artex AI hacking tools found publicly exposed to the web | TechCrunch

Hundreds of systems exposed

Censys, a cybersecurity firm that scans the internet for vulnerable systems, identified more than 800 separate Artex deployments that people could access online without logging in. Artex is an open-source tool for automated penetration testing, which involves probing computer systems for security weaknesses.

Censys researcher Silas Cutler said some deployments are used by authorized testers. However, the reason so many systems were exposed is unclear, since Artex does not need to be reachable from the internet.

Microsoft has described Artex as a network of AI agents able to carry out attacks from reconnaissance to data theft with limited human involvement. The tool has been available publicly since July.

Links to reported attacks

Security firms have connected Artex to several large-scale attacks, including incidents targeting South Korea’s finance sector in September. CrowdStrike attributed those attacks to a Chinese-speaking hacker who used an Artex system that had an exposed directory.

Censys said the system had been publicly accessible for months. Its data appeared to include attack material involving payment and gaming companies, as well as South Korean banks.

Exposure creates added risks

Publicly accessible systems can reveal attack tools, including implants: hidden malicious software used to compromise a network and maintain access. The exposure may put both the systems’ operators and their intended targets at risk.

Some attacks linked to Artex relied on basic weaknesses, including weak or commonly known passwords and missing multi-factor authentication. The cases illustrate how simple security gaps and misconfiguration can enable intrusions.

Artex has said it will become closed-source, limiting future releases to paying customers. Dozens of copies of its code remain on code-sharing sites and can still be used in attacks.