Red Team

Censys finds 1,465 exposed ARTEX AI attack consoles online

Censys counts 1,465 exposed ARTEX AI attack consoles, some beside Cobalt Strike and Vshell. What UK defenders can hunt for and fix now.

Radar graphic with the headline 1,465 ARTEX AI attack consoles exposed

Internet scanning firm Censys has counted 1,465 hosts exposing a console for ARTEX, the open-source AI attack framework, and found some of them sitting next to Cobalt Strike, Vshell and other C2 kit. For UK defenders the report is less a headline number than a working hunting guide to the infrastructure behind agent-driven intrusions.

What happened

On 5 November 2026 Silas Cutler, principal security researcher at Censys ARC (the company’s Advanced Research Collective), published a report titled “ARTEX: Agentic Asbestos”. It measures how far ARTEX has spread beyond the campaigns vendors have already named.

The answer is: a long way. As of 3 to 4 November, Censys saw 1,465 internet-facing hosts serving an ARTEX web console. Roughly 650 of those sit inside two hosting blocks built from identical templates, which Censys thinks point to provisioning templates or a few real servers answering on many addresses. Strip those out and around 815 distinct-looking deployments remain, and Censys says global use is likely higher.

Censys is careful to say that this is not 1,465 criminal crews. ARTEX is dual-use, and legitimate testers run it too. But a meaningful slice of the population is anything but benign: 155 hosts, or 10.6%, also carry at least one other artefact Censys classes as a threat, and 32 were serving open directories full of attack tooling when the report was written.

The technical picture

ARTEX appeared on GitHub on 26 July 2026 under an AGPL-3.0 licence. It was written by the developer behind ScopeSentry, an asset discovery and scanning platform, and essentially bolts AI agents onto ScopeSentry’s data. The stack is a Go backend, a Next.js web console and a PostgreSQL database. An operator sets a target, a scope and an objective; a planner agent breaks that goal into tasks, worker agents run familiar tools such as nmap, and the loop continues until the objective is met.

The author removed the repository in October after it was linked to real attacks, saying they had no part in them, but forks and rebrands such as ScopeWeaver and a paid “ARTEX PRO” continue to circulate. The Telegraph reported last month that the code had been copied by upwards of 12,000 people before it vanished.

The detail in the Censys data is where it gets useful. The default port, 8787/tcp, is the most common, with 8790, 443 and 80 also seen. The United States (726 hosts), Hong Kong (387) and China (177) lead the country table. The UK does not appear among the listed countries. Two providers dominate the templated clusters: PEG Tech (AS54600) with 493 hosts and Yancy Limited (AS138415) with 157.

The co-located software tells the story. CyberStrikeAI shares 70 hosts with ARTEX, and PentAGI, HexStrike AI and RedAmon also turn up. Alongside them Censys found conventional C2 and tunnelling tools including Cobalt Strike, Vshell, Adaptix C2, FRP and NPS, plus the Gophish phishing framework. As Cutler put it, “operators appear to be using multiple agent frameworks side by side.”

The 32 open directories offered the clearest view of intent. Inside were stagers, Linux implants, reverse shells, Windows tools for moving between machines and a public sudo exploit for privilege escalation. One exposed an operator’s entire home folder, SSH material and shell history included. Censys also showed that a server CrowdStrike later tied to attacks on South Korean banks had been publishing open directories, including a .claude folder, from 18 August, about seven weeks before that report landed.

A final finding deserves attention: 43 ARTEX hosts also run self-hosted LLM gateway or resale software, chiefly CLIProxyAPI (19) and New API (18). Model access is becoming one more component of the attacker’s infrastructure, sitting next to the C2 server and the tunnelling tools.

Key figures from the Censys ARTEX report: 1,465 exposed consoles, about 815 distinct deployments, 155 hosts with other threats, 32 open directories, 43 LLM gateways

Why it matters for UK organisations

The UK is not on Censys’s list of hosting countries, but that says where consoles live, not where they point. ARTEX has already featured in a campaign that may have reached British organisations: Microsoft attributed ARTEX-assisted scanning, password spraying and OAuth abuse against ConnectWise cloud backup customers to the China state-aligned group Storm-0940. According to The Telegraph, the NCSC is understood to be working with Microsoft to establish whether UK organisations were compromised, and ConnectWise notified the ICO.

The wider lesson is about scale and cost. Agentic frameworks strip most of the labour out of reconnaissance and initial access, so opportunistic attackers can behave like a thorough testing team across thousands of targets at once. UK SMEs that relied on being too small to bother with lose that cover. Anything internet-facing with a weak password, an unpatched web application or a secret left in a public repository will be found and probed.

Expert view

When we run an external infrastructure test, the first day is spent on exactly what ARTEX automates: enumerating assets, fingerprinting services, trying the obvious credentials and noting what looks exploitable. The difference is that we stop at the scope boundary and write it up. In my experience the techniques these agents use are not new; what is new is that they are tireless and cheap, and they do not get bored on the four-hundredth host.

The encouraging part of this report is how sloppy much of the operator infrastructure remains. Default ports, predictable page titles and open directories are a gift to defenders. Treat a match against an ARTEX console as a strong lead, not proof, and correlate it with your own authentication and network logs.

If your own testers or suppliers use ARTEX or its forks, ask how the console is protected. An exposed testing console holding a client’s asset graph is a breach waiting to happen.

What to do now

  1. Reduce what agents can find. Review your external attack surface and remove or restrict admin panels, test environments and forgotten services. This maps directly to the Cyber Essentials firewalls and secure configuration controls.
  2. Close the credential path. Enforce MFA on every internet-facing login, block legacy authentication and watch for password spraying patterns. That is the user access control requirement in Cyber Essentials in practice.
  3. Patch internet-facing systems quickly. Agent frameworks pick up newly disclosed flaws fast, so the 14-day patching rule in Cyber Essentials should be treated as a ceiling, not a target.
  4. Hunt for the infrastructure. Feed known ARTEX, Vshell, Adaptix C2 and FRP indicators into your SIEM, and look for outbound connections to unfamiliar LLM proxies or resellers in egress logs.
  5. Govern your own AI testing tools. If your team or a supplier uses agentic pentest frameworks, require them to run on authenticated, non-public infrastructure with a clear scope and logging.
  6. Sign up for NCSC Early Warning. It is free and will notify you if your addresses show up in malicious activity feeds.

Bottom line

Censys has turned a vague worry about “AI hacking tools” into a measurable footprint: around 815 distinct-looking deployments, about one in ten also flagged for other threats such as C2 kit, and dozens leaking their own attack files. ARTEX has not invented new techniques, but it has made old ones cheaper and faster. For UK organisations, the response is not exotic: shrink your exposed surface, harden every login, patch quickly and use the attackers’ own carelessness as hunting material.

Sources

Related Posts