Censys finds 800 password-free Artex AI hacking tools exposed online

Censys reported identifying more than 800 distinct deployments of the Artex penetration testing tool that are accessible from the web without requiring a password to log in.reported The cybersecurity firm that scans the internet for exposed or vulnerable systems published a blog post detailing this finding.Security researchers found hundreds of unprotected hacking tools online that anyone can access.Censys identified over 800 password-free Artex deployments, highlighting misconfiguration risks in autonomous penetration testing infrastructure.

The claim

Originating in China, Artex is a free, self-operating security testing application that automatically scans computer networks for vulnerabilities. Since its public release in July, the software has been linked to several cyberattacks. Microsoft has characterized Artex as an AI agent system that can execute cyberattacks, spanning from initial reconnaissance to data theft, with minimal human involvement. As open-source software, Artex is available for free download and self-hosting, appealing to users who lack access to the advanced cybersecurity AI models offered by Anthropic or OpenAI.

The response

Censys principal security researcher Silas Cutler stated that many Artex instances are used by authorized testers and are not operated with malicious intent. It is unknown why so many of these Artex systems are publicly accessible, given that the software does not mandate internet connectivity. Cutler noted that the public accessibility of these systems raises the likelihood that they will be discovered and exploited.

What the evidence means

Exposed systems also reveal offensive utilities, including implants designed to breach and sustain long-term entry into a target's network. Security firms have connected Artex to multiple large-scale cyberattacks, such as those targeting South Korea's financial sector in September. CrowdStrike linked the attacks to a Chinese-speaking hacker who utilized an Artex instance, noting that the hacker had left an open directory hosting the system. Censys data indicated that the Artex instance had been publicly accessible for months and held attack information reaching beyond South Korean banks to include payment and gaming firms.

In practice

For enterprise IT buyers, the presence of over 800 password-free Artex deployments indicates a significant risk of misconfigured infrastructure.reported Users must verify that their own penetration testing environments are not publicly accessible. The tool’s ability to conduct attacks with little human interaction means that exposed instances can be leveraged for reconnaissance and data exfiltration without direct operator involvement. Access to the tool is free and open-source, but its misuse by unauthorized actors poses a direct threat to network security.