Security researchers at Censys have identified more than 800 instances of Artex, an open-source autonomous penetration testing tool, publicly accessible from the web without requiring a password. Artex is a Chinese-made AI hacking tool that automatically probes computer systems for weaknesses, and it has been linked to several cyberattacks since its public release in July. Because it is open source, anyone can download and run it on their own servers, which has made it popular among people who cannot access the most advanced cybersecurity AI models from Anthropic or OpenAI. Microsoft has described Artex as a system of AI agents that can conduct cyberattacks “from reconnaissance through data exfiltration with little needed human interaction.”

Censys principal security researcher Silas Cutler, who wrote the blog post, noted that not every exposed instance is operated maliciously; many are used by authorized testers. Still, the software does not require internet access to run, so it is unclear why hundreds of systems are exposed. The findings highlight how even powerful hacking tools can be misconfigured to be publicly accessible, increasing the chance that someone will find and misuse them. The publicly accessible systems also expose attack tools, including implants used to compromise and maintain persistent access to a victim’s network.

Security companies have tied Artex to several broad-scale attacks. In September, it was used in attacks against the Korean finance industry. CrowdStrike attributed those attacks to a Chinese-speaking hacker who used an Artex instance and left an “open directory” hosting the system. Censys said its data showed that instance had been publicly exposed for months and appeared to contain attack data extending beyond South Korean banks to payment and gaming companies.

Artex was also used in an October attack on IT support giant ConnectWise, which allowed Chinese-linked hackers to spy on thousands of organizations whose data and files are hosted in Microsoft’s cloud. Microsoft, which had visibility into the attack, said the hackers used Artex to break into cloud environments and steal data so quickly that defenders had “little time to detect and respond.” Many of the linked attacks exploited simple vulnerabilities such as weak or known passwords and a lack of multi-factor authentication.

Artex has since announced it would go closed-source, limiting further releases to paid customers. However, dozens of copies of its code remain available on code-sharing sites and can still be used in active attacks.