Censys Finds 1,465 Openly Exposed Consoles for Artex, the AI Hacking Framework Behind the Korean Bank and ConnectWise Attacks

Security firm Censys has identified 1,465 internet-exposed consoles for Artex, an open-source AI-driven penetration testing framework previously linked to attacks on South Korean financial institutions and the ConnectWise supply-chain compromise, according to a report published this week by principal researcher Silas Cutler. Because about 650 of those hosts sit in two blocks of identically configured template hosting, Censys estimates roughly 815 distinct deployments, none of which need to be publicly accessible to function.

Artex was published on GitHub in July 2026 by a developer using the handle Autumn-27, who is also the author of ScopeSentry, a widely used asset-discovery and vulnerability-scanning platform with more than 2,000 stars. The framework is written in Go with a Next.js console backed by PostgreSQL, and it orchestrates multiple AI sub-agents: a Planner converts a stated goal into attack intents, and Worker agents claim those intents, run tools such as nmap, and write results back. It works with Anthropic, OpenAI or any OpenAI-compatible model endpoint. Microsoft has described it as able to run attacks "from reconnaissance through data exfiltration with little needed human interaction."

The exposure census reads like an X-ray of the emergent AI attack ecosystem. The most exposed consoles sit in the United States at 726, followed by Hong Kong at 387 and China at 177. Some 155 hosts, 10.6 percent of the total, also carry other threat detections, including the CyberStrikeAI agent framework on 70 hosts alongside PentAGI, HexStrike AI, Vshell, Cobalt Strike and Adaptix C2. Forty-three hosts run self-hosted LLM gateways or API reseller software such as CLIProxyAPI and New API, the same reseller pattern CrowdStrike observed when a Korean-finance attacker bought DeepSeek access to power an Artex campaign.

The leaks cut both ways. Censys found 32 open directories on Artex hosts exposing post-exploitation kits, stagers, implants and operator histories. One exposed an operator's entire home directory including SSH keys and bash history; another hosted Windows lateral-movement tooling; a third served a man-in-the-middle root certificate authority private key alongside rogue HTA droppers. In the Korean case, the attacker's open directory had been exposed since August 18, seven weeks before CrowdStrike's report, and its file listings showed targets extending well beyond South Korean banks to payment and gaming companies.

Two October reports put the framework on the map. CrowdStrike tied Artex to a financially motivated, Chinese-speaking actor's breach of South Korean financial institutions in late September and early October, noting the actor ran Artex with DeepSeek as its main model alongside Claude Code sessions backed by GLM and Grok. Microsoft attributed the ConnectWise Cloud Backup supply-chain compromise to Storm-0940, a China state-aligned group, which used Artex to automate scanning and password spraying against more than 2,250 Microsoft 365 tenants at up to 2,900 sign-in attempts per minute, reaching privileged cloud access in under three hours in several cases.

Artex's author disclaimed involvement on October 8 and said the project would go closed-source, and the repository has since been taken down. It hardly matters: archived copies, translations and rebrands such as ScopeWeaver are already circulating, and dozens of copies remain on code-sharing sites usable in active attacks. Censys notes that not every exposed instance is malicious, as many belong to authorized testers, but the provisioning-template patterns in the data suggest far fewer distinct operators than the raw host count implies.

The lesson for defenders is less about Artex than about the operational culture growing around agentic attack tooling. Powerful autonomous frameworks are being deployed at the same misconfiguration rate as ten-year-old web panels, and their consoles leak exactly the material blue teams want: prompts, session histories, infrastructure and sometimes stolen data. Censys recommends hunting for Artex's default port 8787, co-located open directories and unfamiliar LLM proxies in egress logs, because when attackers cannot secure their own arsenals, their infrastructure becomes an intelligence source.