Security researchers have identified more than 800 deployments of Artex, a Chinese-made AI hacking tool, publicly accessible on the internet without password protection. Artex functions as an open-source autonomous penetration testing tool designed to automatically probe computer systems for vulnerabilities. Released in July, it has since been linked to multiple cyberattacks.
Microsoft previously described Artex as a system of AI agents capable of conducting cyberattacks from reconnaissance to data exfiltration with minimal human interaction. Its open-source nature makes it a popular alternative for threat actors unable to access advanced cybersecurity AI models from companies like Anthropic or OpenAI.
Cybersecurity firm Censys, which scans the internet for exposed systems, detailed its findings in a blog post. Silas Cutler, principal security researcher at Censys, noted that while some Artex instances are used by authorized testers, the reason for hundreds of systems being publicly exposed remains unclear, as the software does not require internet accessibility.
Security companies have connected Artex to multiple broad-scale cyberattacks. In September, the tool was used against the Korean finance industry. CrowdStrike attributed these attacks to a Chinese-speaking hacker who utilized an Artex instance. The hacker had left an open directory hosting the system, which Censys data showed had been publicly exposed for months. The instance contained attack data extending beyond South Korean banks to include payment and gaming companies.
Artex was also deployed in an October attack on IT support provider ConnectWise. Chinese-linked hackers used Artex to spy on thousands of organizations that hosted their data within Microsoft's cloud infrastructure. Microsoft, which had visibility into the attack, reported that the hackers leveraged Artex to breach customer cloud environments and exfiltrate data at speeds that offered defenders minimal time to respond.
The widespread exposure of Artex deployments shifts cybersecurity economics. By making powerful attack capabilities free and open-source, Artex lowers the barrier to entry for malicious actors and compels enterprises to substantially increase defensive spending. Companies can no longer rely on the cost of developing advanced attack tools to slow threat actors.
This dynamic erodes traditional competitive moats in cybersecurity, where advanced defensive AI has commanded premium valuations. Enterprises now face the necessity of continuous, substantial investment in multi-layered security architectures to defend against an expanding threat landscape populated by actors who bear no development costs.
