Editorial Team
8 min read
Internet scans and leaked databases expose the spread of ARTEX, a security-testing framework used in cyberattacks. Researchers documented largely autonomous compromises, but the records also show failed cashouts and uncertain counts of independent deployments.
Hundreds of internet-accessible management consoles for ARTEX, an AI-driven framework designed to test computer systems for security weaknesses, have exposed the infrastructure behind both authorized testing and criminal attacks. Censys, which scans the internet for exposed systems, found 1,465 hosts displaying the software’s console in early November. Its analysis reduces that to roughly 815 distinct-looking deployments after excluding two repetitive hosting clusters.
The risk extends beyond operators leaving their own systems exposed. ARTEX directs software tools to investigate and exploit targets, and leaked operational records show attacks continuing with little human input. Yet those records also distinguish finding a vulnerability, obtaining useful access and making money—outcomes that claims about autonomous hacking can blur.
Company-reported Censys counts: 1,465 exposed hosts and roughly 815 distinct-looking deployments after excluding two repetitive hosting clusters. Neither figure establishes independent operators. Source: Censys.
ARTEX’s console does not need to face the public internet. A report on Censys’s findings says the firm identified more than 800 distinct deployments accessible without a login password. That creates an opportunity for outsiders to misuse them, although the research does not establish how many consoles were actually commandeered. Some installations belong to authorized testers; exposure alone is not evidence of criminal intent.
Censys detected consoles through their page titles and Next.js web assets. Its executive summary dates the 1,465-host observation to November 4, while its detailed measurement section says November 3. Neither the raw count nor the adjusted figure measures independent operators, victims or completed attacks, and private installations are outside the survey.
The adjustment matters: 493 hosts at PEG Tech and 157 at Yancy Limited shared standardized configurations. Those 650 addresses account for about 44% of the total. Censys assessed a previous, similar proliferation of Cobalt Strike infrastructure at Yancy as likely representing a few installations behind many IP aliases. Excluding these ARTEX clusters avoids counting each address as a separate operation, but does not prove every remaining deployment is independent.
Check Point Research’s November 5 investigation identified 2,557 systems hosting or having hosted ARTEX panels, including 1,608 live, publicly available instances. Its opening bullets separately cite more than 1,800 exposed instances. These differing totals and scopes cannot be combined into a reliable deployment count or growth rate.
Censys’s diagram shows ARTEX’s planner-and-worker loop, reconnaissance inputs and external language-model connections. Source: Censys.
Released on July 26, 2026, under the AGPL-3.0 open-source license, ARTEX was developed by the programmer known as Autumn-27, also the author of ScopeSentry, an asset-discovery and vulnerability-scanning platform. Censys describes ARTEX as an AI agent layer over that reconnaissance foundation: discovered assets feed into its records and subsequent testing.
An operator supplies targets, objectives and permitted scope. A planner divides the objective into tasks; worker agents execute security tools and return results that guide the next steps. A web dashboard records progress and lets the operator steer the work. ARTEX supplies the orchestration, while operators connect external language models to make decisions.
After security company CrowdStrike linked ARTEX to attacks against South Korean financial institutions, Autumn-27 denied involvement and said the tool was intended for authorized testing. Censys dates that statement and the announcement of a move to closed source with no further releases to October 8. The repository subsequently disappeared, but copies, translations and rebrands including ScopeWeaver remained available.
The released capability therefore survives the withdrawal. It also has substitutes: Check Point names CyberStrike, Cairn and PentAGI as frameworks offering similar capabilities. Censys found 155 of its 1,465 ARTEX hosts, or 10.6%, also carrying another of its threat detections, spanning AI testing frameworks, reconnaissance tools, tunneling software and conventional command-and-control systems. Co-location describes an infrastructure mix, rather than proving who operates each host.
Model access is another dependency. Censys found LLM gateway or reseller software on 43 ARTEX hosts. In Check Point’s sample of ten exposed databases, Chinese models predominated, especially the DeepSeek Flash family. American models were configured on three instances; the researchers observed guardrails being triggered only with Anthropic’s Opus 5.5, after which the operator switched to more permissive Chinese models. That is evidence from this small sample, rather than a comparison of all providers’ safeguards.
Censys found 32 open directories on ARTEX hosts exposing material including implants, post-exploitation tools and, in one case, an operator’s home directory. Its scan history showed open directories on the server associated with the South Korean finance campaign from August 18, seven weeks before CrowdStrike’s public report.
According to Censys’s account of that report, CrowdStrike said an actor breached a broker-facing loan inquiry service at one bank and an employee mobile system at another, exfiltrating data. The operational leak helped reveal the activity; it was not merely a count of visible consoles.
Censys also recounts Microsoft’s attribution of the supply-chain compromise involving IT support company ConnectWise’s Cloud Backup service to Storm-0940, a China state-aligned group active since 2021. Microsoft said the group used ARTEX to automate scanning, password spraying and abuse of OAuth applications. It attempted sign-ins to more than 2,250 tenants, peaking at 2,900 attempts per minute; some victims experienced privileged cloud access in under three hours. These figures describe that campaign, rather than ARTEX’s general performance.
Check Point’s ten exposed databases provided a different view: attacker goals, model use and recorded actions. Operators often did little after setting objectives beyond asking for progress. Many configured residential proxies to get around filtering and IP blocks. Three campaigns show why autonomy and economic success need separate measures.
Two consoles targeted ten gray-market iOS signing shops from October 14 to October 29, seeking certificates and passwords for resale. Such certificates enable signing apps for installation outside the official App Store. Agents obtained more than 300 certificates and passwords, but only three passed their validation checks, including expiration, revocation and a matching provisioning profile.
The records showed about 36 billion input and output tokens, mostly cached inputs. Check Point estimated $700–$1,500 using official DeepSeek API prices, although the consoles used both DeepSeek and Kimi models. This is a pricing estimate, not a verified bill or complete operating budget; the report does not establish resale proceeds.
A four-day operation processed 167.5 million tokens, with estimated model costs of $145–$300. Check Point reported 292 campaign objectives and 230 findings, but the monitored attacker wallet had no transactions.
Some claimed cashouts were hallucinations based on API responses indicating success. One real compromise used leaked cloud credentials to modify an app-distribution storage bucket, creating a supply-chain attack path. The owners later restored the original manifest file; no proceeds were observed.
Agents targeting thirteen gray-market account sites over about five days recovered more than 190,000 credential sets for the mobile game Honor of Kings. Check Point reproduced an agent record describing 29 accounts verified as active through sampling and an estimated valid share of 3.3%, extrapolated to about 6,000 accounts. The latter is an estimate, not an individually verified count; the report does not give the full sample denominator.
Exposed credential files and hardcoded administrator credentials helped enable the theft. Check Point estimated model costs of $180–$360 for this operation, which used DeepSeek through a third-party relay.
Company-reported Check Point observations from one crypto campaign: 292 objectives, 230 findings and a monitored wallet with a $0 balance and no transactions. These are campaign-specific results. Source: Check Point Research.
CERT-EU, the cybersecurity service for EU institutions, bodies, offices and agencies, says it has observed AI-driven activity against its constituency that highly likely involved ARTEX. Its November 5 advisory warns that ARTEX relies on configurable rules and the model itself to respect scope and avoid destructive actions, without hard technical enforcement. Available versions are independent forks whose integrations and capabilities can differ.
Separate controlled tests by security company AhnLab demonstrated execution of a program on a vulnerable web server and remote command execution on four internal hosts after entry through an exposed ActiveMQ server. Researchers supplied the targets, objectives and permitted scope without specifying the vulnerabilities or attack procedures. These two vulnerable test environments demonstrate capability, rather than a general success-rate benchmark.
AhnLab cautions that ARTEX uses multiple external tools and non-HTTP communications, so a single browser-style User-Agent identifier cannot reliably identify its activity or prove a successful intrusion. Defenders need to connect web, network, authentication and endpoint evidence to establish the progression from reconnaissance to execution and internal movement.
The immediate decisions are to isolate management consoles, remediate exposed vulnerabilities, require stronger authentication and limit privileges and internal access. The unresolved measure of ARTEX’s impact is how often these operations produce verified compromise, downstream harm or proceeds—and whether exposed consoles themselves have been abused. Answering that requires incident evidence beyond another tally of public addresses.
Meta's strategy chief and former CFO is joining Fireworks AI ahead of a reported fundraising push targeting at least a $30 billion valuation. The inference company announced a $17.5 billion valuation in July, making the hire part of a much larger expansion than its older funding figures suggest.
Sand.ai says its $200 million Series A+ round lifts its valuation above $1 billion. Co-lead investor Wangsu plans inference and deployment cooperation, while its filing shows substantial losses behind the startup’s video AI ambitions.
An advocacy group estimates Interior Secretary Doug Burgum’s AI holdings at $18.1 million–$64.4 million as his department advances data centers on public land. His ethics agreement allows retained investments with recusals, while pending permits will determine both the application of those safeguards and the public’s return. Interior denies his decisions are driven by personal investments.
Microsoft is evaluating fewer neocloud partners while expanding its own infrastructure. Delivery-dependent contracts underpin supplier financing, while IREN reports rising revenue alongside a $6 billion funding target for its broader expansion.
Physical Superintelligence says its AI system found a proof of a conjecture limiting quantum query advantages on random inputs. Public proof files enable scrutiny, but do not establish the private system’s cost or repeatability.
OpenAI is expanding its relationship with Hacktron, whose researchers previously reported an attack chain into employee accounts, to test third-party connections with greater access to cybersecurity models.
Google has acquired Crusoe’s southeast Wyoming data center site, where it plans a long-term $17 billion investment. Crusoe describes completed pre-development work; independent reporting points to customer setbacks. Power delivery and carbon capture remain key tests.
The team behind document-parsing service SoMark has released OXR-1.0 code and weights. A benchmark retest supports a strong result, but speed and accuracy were measured separately, and users above funding or revenue thresholds need a commercial license.
OpenAI is reportedly developing a Business Hub with daily mention and click charts, product updates and business agents. The unannounced feature could give verified businesses direct visibility into ChatGPT responses, without revealing prompts or competitor rankings.
Palantir and Nvidia have specified an integrated stack for running AI in customer-controlled environments. The architecture builds on existing software and infrastructure offerings, with published configurations spanning 32 to 640 GPUs, while pricing and workload economics remain unproven in the launch materials.
Democrats’ incoming congressional majorities put hearings and investigations within reach, but AI rules and crypto legislation still face bipartisan bargaining and a Republican president.
Microsoft reportedly declined to renew Oracle server rentals as older chips became less useful to it. The decision comes despite continuing capacity shortages, while Oracle says demand for earlier-generation GPUs remains strong.
An investigation puts Nvidia’s future commitments and guarantees at $530.5 billion. Its disclosures show rapidly expanding supplier commitments and phased support for customers whose infrastructure could generate further chip sales, with cash payments depending on timing, demand and contract terms.
TSMC is reportedly planning a possible move into 3D DRAM at Nvidia’s request. The foundry already helps integrate AI processors with memory, but a manufacturing expansion has no disclosed factory or production date.
Physicl has raised a $10 million seed round and introduced Studio, a beta app for generating targeted physical AI data. Its reported customer gains concern 3D reconstruction, leaving broader robot reliability and commercial economics to be demonstrated.
New cloud partners in Southeast Asia must enroll in Nvidia’s Fleet Intelligence system, according to a report, linking preferred chip access to monitoring while leaving data sharing and existing partners’ obligations unresolved.
Airbnb sold intellectual property to a private AI lab controlled by CEO Brian Chesky in a $7.1 million arrangement that also reimburses expenses. It obtained a license to certain lab technology and future investment rights, but disclosed no asset valuation or detailed license terms.
Chip shares recovered part of Thursday’s losses in early Friday trading. Fears about data-centre construction face a test against AI-chip supplier Nvidia’s strong reported sales, growth forecast and conditional infrastructure-financing plans.
SoftBank shares fell 10.8% as default-insurance costs reached a four-year high. Delayed listings and unfinished data centers complicate its AI investment outlook, while a $40 billion bridge facility has a March 2027 maturity and a repayment plan based on existing assets and other financing.
U.S. prosecutors allege a global fraud combined AI impersonation, sham confidential deals and cryptocurrency laundering. A blocked bank transfer shows why convincing an employee and moving the money are separate hurdles.