Security researchers have discovered that more than 800 distinct deployments of Artex, an autonomous penetration testing tool, were accessible from the internet without requiring authentication, according to analysis by the cybersecurity firm Censys released this week. The number rises to 1,465 visible servers when counting all machines with exposed dashboards, and Check Point Research identified an additional 1,608 active instances and 2,557 that hosted or are hosting control panels for the framework.
Artex is an open-source project developed in China that uses large language models to orchestrate multiple AI agents capable of planning and executing automated scans on target systems. Since its public release in July 2026, the tool has been associated with a series of large-scale cyberattacks, including the South Korean financial sector breaches in September, the compromise of Microsoft customers' cloud environments, an espionage campaign targeting more than 200 organizations in at least 14 countries, and now, an offensive against Indian financial institutions.
What makes the Artex case particularly concerning is the near-total autonomy of these agents. Check Point analyzed 10 exposed instances and gained access to the complete databases, which made it possible to map the prompts used by operators and the exact flow of operations. In virtually all cases, hackers defined an initial goal and then let the agents operate on their own. Human interactions were reduced to questions like "what is the progress?" or "which target is closest to completion?" This is not traditional hacking — it is an autonomous exploitation system operating at machine speed.
Check Point identified two main campaigns. In the first, attackers targeted "sign shops" that distribute digital .p12 certificates for iOS applications. Artex agents exploited remote code execution (RCE) flaws to access entire databases of certificates and plaintext passwords, then validated each key against Apple's revocation service and checked for matching In-House profiles — which would enable signing malicious applications that appear legitimate. This clandestine certificate infrastructure, mapped in a USENIX Security 2026 study, is concentrated primarily in China and has already been used to modify existing applications and inject libraries that exfiltrate sensitive data.
The second observed campaign involved a failed cryptocurrency draining operation, but it nonetheless revealed the command-and-control infrastructure: the largest contingents of Artex servers are hosted in the United States (882, 54%), Hong Kong (295, 18%), and China (103, 6%). Chinese models are overwhelmingly predominant, with the DeepSeek Flash family leading usage. When operators tried using Anthropic's Opus 5.5, safety guardrails blocked exploitation attempts, forcing them to migrate to Chinese models with fewer restrictions.
On the Indian front, CERT-In issued an advisory this week warning about the "Crafty Falcon" group, which uses Artex — along with three other tools (PentAGI, Cairn, and CyberStrikeAI) — to attack at machine speed payment interfaces, financial institution APIs, and lending systems. State Bank of India has already reported a leak of 3,897 customer records on the dark web, and at least two other institutions confirmed incidents. The Reserve Bank of India had already tightened cybersecurity controls in recent weeks, but the threat remains active, according to CERT-In.
The irony of Artex is that it was designed for legitimate use: security teams wishing to test their own systems in an automated fashion. The problem is that the software does not require a public internet connection to function, and many operators — legitimate or malicious — configured their dashboards to be globally accessible. This not only exposes the offensive tools, but also exposes each operator's potential targets.
Artex's developer announced in October that they would make the project proprietary following pressures arising from the South Korea attacks. But maintained copies of public repositories and forks remain available, and the ecosystem of similar agentic tools — PentAGI, Cairn, CyberStrikeAI — only grows. The barrier that Western model guardrails attempt to build ends up pushing attackers toward more permissive Chinese models, which become the minimum floor for offensive capability. While autonomous hacking tools remain accessible to anyone with an internet connection, the race between defenders and attackers will always be a matter of speed, not access.
Sources: TechCrunch, Check Point Research, Firstpost
✓ Independent sources cross-checked and verified before publishing
