OPEN LINK ↗
// 40m agoSECURITY INCIDENT
ARTEX Leaves 800 Hacking Consoles Exposed
Censys found 1,465 internet-facing ARTEX consoles, roughly 815 distinct-looking deployments, many reachable without authentication; 32 hosts also exposed directories containing exploit kits and implants. ARTEX was released as open source in July, but its original repository was pulled after CrowdStrike and Microsoft linked it to real attacks.
// ANALYSIS
The bigger issue is operational hygiene: agentic offensive tooling is being deployed like ordinary web software, turning forgotten consoles into attacker force multipliers.
- –ARTEX decomposes natural-language goals into reconnaissance, exploitation, and reporting through coordinated LLM agents.
- –The 815 distinct-looking deployments matter more than the inflated 1,465-host total, but exposed directories and adjacent C2 tools show genuine risk.
- –Removing the original repository will not stop distribution; forks and commercial variants continue circulating.
- –Developers should isolate agent runners, require MFA, restrict egress, log every action, and enforce scope in code rather than trusting prompts.
// TAGS
artexagenttool-usesecuritysafetyopen-source
DISCOVERED
40m ago
2026-11-07
PUBLISHED
1h ago
2026-11-07
RELEVANCE
9/ 10
AUTHOR
AnotherCodingX