Censys finds roughly 800 publicly reachable Artex AI pentest consoles

Censys researcher Silas Cutler reports about 1,465 exposed Artex consoles; after excluding two uniform hosting blocks, roughly 815 look like distinct deployments. Artex is an LLM-driven autonomous penetration-testing framework open-sourced in July 2026; its console does not need to face the public internet. About 10.6% of hosts also run other attack frameworks or C2, and 32 open directories expose implants and lateral-movement kits. CrowdStrike and Microsoft previously tied Artex to South Korean finance attacks and the ConnectWise supply-chain compromise. The author said in October the project would go closed-source.

Written by dalao.ai: the title, summary and why it matters are our own words. The original reports are the record; their publishers keep authorship.