815 exposed Artex servers hand out AI pentest tools to anyone

A security engineer at a company that runs offensive AI tools has a new thing to check on Friday afternoon. Censys says it watched 1,465 Artex consoles sit on the public internet without a password on 3 November 2026. About 815 of those were distinct deployments, after Censys stripped out two large hosting blocks of templated copies.

Artex is an AI penetration testing framework released in July 2026. Its agents run reconnaissance, scan ports, try passwords, and move from a first foothold through to data exfiltration. The default console port is 8787. Censys says the default install has no sign-in page.

What Censys found on the open servers

Silas Cutler, a principal security researcher at Censys ARC, published the count on 5 November 2026. His team scanned the internet for Artex's web console banner and matched 1,465 hosts. 155 of them, or 10.6 percent, also ran other attacker software on the same box: Cobalt Strike, Vshell, and several command-and-control platforms. 32 hosts exposed open file listings that held exploit kits, loader programs, implants, and private keys.

The report says operators are stacking several AI attack frameworks on one server. That tells a defender two things. The operator is cost-conscious. One box is cheaper than many. The operator has not spent much time on operational security. A single wrong setting now hands over every tool they use.

What a defender does this week

Censys says to watch for port 8787 on any host in your range that should not have it. It also lists the other signs of an Artex box. Open directories of staged payloads. Vshell listeners. FRP server traffic. The marks of LLM proxy software like CLIProxyAPI and New API. Censys and Shodan both show port 8787 as a search filter. A security team can test its own addresses in a few minutes.

If your company runs Artex on purpose, the fix is a short list. This covers a licensed red team or an internal exercise. Put the console behind a login. Put the login behind a VPN. Keep the implant staging area off any path a web server will return.

TechCrunch's Zack Whittaker, who reported the story, puts the Artex release in a wider frame. Microsoft linked Artex to a Chinese threat group's supply chain attack through ConnectWise on 21 October 2026. CrowdStrike reported an Artex-backed campaign against South Korean banks on 9 October 2026. The tool is now a named weapon on three continents, so a loose console is not a curiosity.

A reader at a software company that uses AI agents can take one lesson here without touching Artex. An agent that can reach your production systems is useful to you. It is also useful to an attacker who finds its console. Review the agent's permissions, its logs, and its sign-in as if an attacker already has the URL. On this week's evidence, for over 800 teams, they do.

Source

• ARTEX: Agentic Asbestos, Censys, by Silas Cutler
• Hundreds of Artex AI hacking tools found publicly exposed to the web, TechCrunch, by Zack Whittaker