Follow us on Google News
Cybersecurity researchers have identified more than 800 publicly accessible installations of ARTEX, a Chinese-developed artificial intelligence hacking tool previously linked to cyberattacks against financial institutions and technology companies. The exposed systems could potentially allow unauthorised users to access offensive security tools and carry out attacks against other organisations.
According to cybersecurity firm Censys, the ARTEX installations were accessible over the internet without password authentication, raising concerns about the security of autonomous AI-powered penetration testing platforms.
ARTEX is an AI-based security testing tool designed to identify and exploit vulnerabilities with limited human involvement. Since its public release in July, the software has been linked to several cyberattacks, including incidents affecting South Korea’s financial sector and customers of IT services provider ConnectWise.
FCRF’s Chief AI Officer Certification Returns on November 14 to Prepare Future AI Leaders
Researchers Discover Hundreds of Unprotected ARTEX Installations
Censys researchers identified more than 800 distinct ARTEX deployments publicly accessible through the internet without requiring users to log in.
The findings were detailed in a report by Silas Cutler, principal security researcher at Censys, which monitors internet-connected systems for security exposures.
ARTEX is an autonomous penetration testing platform capable of carrying out activities ranging from reconnaissance and vulnerability identification to exploitation and data extraction.
Microsoft previously described the tool as a system of AI agents capable of conducting cyberattacks with minimal human intervention.
Although ARTEX was initially released as open-source software, researchers noted that many installations appeared to have been configured without adequate access restrictions.
Cutler cautioned that not all exposed ARTEX deployments were being operated for malicious purposes, as some belonged to legitimate security researchers conducting authorised testing.
However, the software does not require public internet access to function, making the widespread exposure particularly concerning.
Researchers also found that some installations exposed offensive security tools, including software implants capable of maintaining unauthorised access to compromised computer networks.
ARTEX Linked to Cyberattacks Against South Korean Firms and ConnectWise
Security researchers have previously linked ARTEX to cyberattacks targeting South Korea’s financial sector.
CrowdStrike attributed a series of incidents to a Chinese-speaking hacker who allegedly used an ARTEX installation during the attacks.
Investigators identified the tool partly because the attacker had left an openly accessible directory containing attack-related files.
Censys found that the installation had apparently remained exposed for several months and contained information extending beyond South Korean banks to payment and gaming companies.
ARTEX was also linked to an October attack involving IT support provider ConnectWise, which affected organisations using Microsoft cloud services.
According to Microsoft, attackers used the tool to compromise customer cloud environments and extract data rapidly, leaving defenders limited time to identify and respond to the intrusion.
The attacks demonstrated how autonomous AI tools could accelerate offensive operations, particularly when attackers exploited weak passwords, known credentials or systems lacking multi-factor authentication.
Researchers noted that the same configuration weaknesses could also expose the tools and infrastructure used by attackers themselves.
Public Exposure Raises Concerns Over Misuse of AI Security Tools
The Censys findings highlight the risks associated with deploying powerful penetration testing software without appropriate access controls.
Publicly accessible ARTEX installations could allow outsiders to examine offensive tools, access stored attack-related material or potentially misuse exposed systems.
The developers of ARTEX have since announced plans to move the project to a closed-source model, restricting future releases to paying customers.
However, copies of the software remain available on code-sharing platforms, and existing installations can continue to be used.
Researchers warned that limiting future software distribution would not automatically address security weaknesses in deployments already accessible online.
The findings underline how poor configuration practices can create additional risks around autonomous cybersecurity tools, potentially exposing both organisations targeted by cyberattacks and the infrastructure used to conduct them.
About the author — Suvedita Nath is a science student with a growing interest in cybercrime and digital safety. She writes on online activity, cyber threats, and technology-driven risks. Her work focuses on clarity, accuracy, and public awareness.
