Censys finds 800+ exposed Artex AI hacking tool deployments

Artex emerged as a free alternative for security professionals who cannot access the most advanced cybersecurity AI models from Anthropic or OpenAI. Its open-source nature made it easy to download and run, but also easy to misconfigure. Censys's finding that more than 800 deployments are reachable without a password suggests many users left the tool exposed, even though it does not need to be internet-accessible. That exposure matters because the same systems can host implants and other attack tools, effectively lowering the barrier for anyone who finds them. The tool has already been tied to real-world incidents: CrowdStrike attributed a September attack on the Korean finance industry to a Chinese-speaking hacker who used an Artex instance, and Microsoft reported that hackers used Artex in an October breach of ConnectWise to steal data from cloud environments at high speed. Many of those attacks exploited simple weaknesses like weak passwords and missing multi-factor authentication. Artex's move to closed-source may slow new releases, but copies of its code remain on code-sharing sites and can still be used in active attacks.