Censys has put numbers on how widely ARTEX, the open-source AI pentesting framework, is deployed: 1,465 internet-facing consoles, 32 open directories exposing attacker tooling, and 155 hosts that also run other threat software. The Censys report of November 5, 2026 is a measurement, not a vulnerability. There is nothing to patch. It tells defenders what the tool looks like from the outside and gives hunting pivots. For people who run coding agents, it also shows how an operator's own agent files ended up public.
| Question | Short answer |
|---|---|
| Am I affected? | Only if you are a target of an ARTEX operator. The report is about attacker infrastructure, not a flaw in your software |
| Is there a fix? | No. This is a measurement of a dual-use tool. Defenses are credential, network and detection controls |
| How big is it? | 1,465 hosts; about 815 distinct-looking deployments after removing two cloned hosting blocks |
| Is every host malicious? | No. Some are likely authorized testers. 155 hosts (10.6%) also run other threat tooling |
| Does data leave my machine? | Not from a local coding agent because of this report. The risk is to servers and cloud tenants ARTEX is pointed at |
What ARTEX is, briefly
According to Censys, ARTEX was published on GitHub as Autumn-27/ARTEX on July 26, 2026 under the AGPL-3.0 license. Its author also wrote ScopeSentry, a widely used Chinese asset-discovery and vulnerability-scanning platform, and ARTEX works as an agent layer on top of that recon foundation: assets found by ScopeSentry (domains, subdomains, IPs, ports, endpoints) sync into ARTEX's own asset graph.
The framework is written in Go with a Next.js web console and a PostgreSQL database. An operator defines a task with a scope, test accounts and a goal; the default example is "gain admin panel access or server privileges." A Planner agent turns the goal into attack intents, worker agents claim those intents and run tools such as nmap (shipped in the Docker image), and an event-driven loop repeats explore, decide, execute until the goal is met. ARTEX tracks an asset graph and an exploration graph, includes mitmproxy for traffic recording, and works with Anthropic, OpenAI or any OpenAI-compatible endpoint.
On October 8, the day after CrowdStrike published its report, the author said they were not involved in the attacks and that the project would go closed-source. The repository has since been taken down, but Censys notes archived copies, translations and rebrands such as ScopeWeaver still circulate. For the defender's view of the same tools, see our posts on what Google and Mandiant saw and Wiz's seven fingerprints of agentic attacks.
Related: Check Point's look inside ten operator consoles shows what the agents actually did.
What Censys measured
Censys detects consoles by the page title (localized versions start with "ARTEX" followed by a space, colon or dash) combined with Next.js static assets. As of the early-November snapshot, that matched 1,465 hosts. The key numbers from the report:
- Ports: the ARTEX default 8787 is the most common console port (1,931 endpoints), then 8790, 443 and 80.
- Geography: United States 726 hosts, Hong Kong 387, China 177, Japan 51, Singapore 38, South Korea 21. The Chinese default language dominates, with English, Korean, Japanese, Russian and Portuguese localizations also present.
- Cloned hosting: two netblocks account for about 44% of hosts. PEG Tech (AS54600) has 493 hosts sharing one of two identical port layouts across 13 /24 networks; Yancy Limited (AS138415) has 157 hosts sharing one CyberPanel-plus-mail-server template. Excluding them leaves roughly 815 deployments.
- Customized builds: four adjacent hosts run "ARTEX MX," and others run renamed consoles such as "ARTEX v2 · Agent Security Workbench."
Censys draws a careful conclusion from the cloned blocks. It had seen the same pattern with Cobalt Strike listeners on Yancy in December 2025, assessed then as likely a couple of unique instances across hundreds of IP aliases. A large host count may be a few real servers. Headlines saying "1,465 hacking groups" would be wrong; the report itself says the console does not require public-facing access, so true deployment is probably higher.
What else runs on those hosts
Of the 1,465 hosts, 155 carry at least one other Censys threat detection. Censys highlights three patterns.
Operators stack AI attack frameworks. CyberStrikeAI shares hosts with ARTEX on 70 hosts, and PentAGI, HexStrike AI and RedAmon also appear. Our post on CyberStrikeAI and the Kaspersky domain-takeover case covers one of those companions.
AI tooling sits beside conventional C2. Some hosts pair ARTEX with Cobalt Strike, Adaptix C2, Vshell, FRP, NPS or Gophish. One host in the report runs ARTEX and PentAGI next to a Cobalt Strike teamserver and an Adaptix listener; another has five identically configured addresses, each running ARTEX, CyberStrikeAI, ARL and Vshell, which Censys reads as either multiple IPs on one device or a cloned image.
LLM access is part of the stack. 43 ARTEX hosts also run self-hosted LLM gateway or reseller software, mainly CLIProxyAPI (19) and New API (18). In the CrowdStrike case, the actor bought DeepSeek access through an API reseller. For defenders, Censys suggests unfamiliar LLM proxies and resellers in egress logs are worth investigating.
The open directories
The most concrete finding is the exposed files. Censys saw 32 open directories on ARTEX hosts, exposing post-exploitation kits, stagers and implants. Examples in the report include a Windows lateral-movement kit (GodPotato, Invoke-TheHash, SMBExec/WMIExec, pass-the-hash scripts, a MSSQL UDF DLL), a public exploit for CVE-2021-3156 (the sudo "Baron Samedit" bug) with brute-force scripts, three Linux beacon builds with reverse-shell scripts on a host also running FRP and CyberStrikeAI, a c2.py with stager source, about 18 HTA droppers with a MITM root CA private key, and one operator's entire home directory including .ssh and .bash_history.
Most directories lasted hours to two days. Between November 3 and 5, 10 closed and 15 new ones appeared on other ARTEX hosts. Because Censys keeps scan history, listings stay searchable after the operator takes them down.
The CrowdStrike connection
CrowdStrike's October 7 report said an unattributed, probably financially motivated Chinese-speaking actor used ARTEX against South Korean finance firms from late September to early October, and was found because it left open directories exposing a .claude folder, prompts, session histories and ARTEX configuration. Censys's scan history shows open directories on that same host from August 18, seven weeks before CrowdStrike published, exposing exploit binaries and a .claude folder. We covered the incident in the South Korean bank case. The Microsoft side, where Storm-0940 reportedly used ARTEX in the ConnectWise compromise, is in our Storm-0940 post.
What this means if you run AI coding agents
ARTEX targets servers, Active Directory and cloud tenants, not your coding agent. But three lessons carry over.
- Your agent's files are sensitive. The .claude folder, prompts and session histories gave investigators the whole operation. On your machine the same kinds of files can hold pasted secrets, file paths and tool output. Never serve a project or home directory over a quick
python -m http.server, and check that session and config folders are not inside a web-served or synced-public path. - Rotate what agents have seen. If a session ever displayed an API key or token, treat the transcript as holding it. Short-lived, narrowly scoped credentials limit what any automation, hostile or not, can do with them.
- Watch egress to LLM endpoints you did not choose. Censys's point about unfamiliar LLM proxies and resellers applies in both directions: it helps find attacker infrastructure, and it is a reminder to know which model endpoints your own tooling calls.
For your own network, the practical hunting steps from Censys are: look for consoles on 8787, 8790, 443; look for co-located open directories, Vshell or FRP listeners and CLIProxyAPI or New API on the same host; and review scan history for mitmproxy banners and short-lived Python SimpleHTTP servers on high ports, which Censys says often appear before the console. Indicators from CrowdStrike and Microsoft (proxy IPs, the xcai[.]pro reseller, Storm-0940 addresses) are listed in the Censys post; match them against logs rather than blocking blindly.
What Beam can and cannot do here
Beam does not detect or block ARTEX on the network; that is a job for exposure management and your SOC tooling. Where it applies is the developer machine: Beam watches what Claude Code and Codex do and flags risky actions such as credential exposure and destructive commands, scans skills and MCP configs before you run them, and keeps data on-device with redaction before storage. Its hook-based deny works for PreToolUse hooks only, the skill and MCP scan is heuristic, and it is not a kernel sandbox. See how Beam watches agents and local-first storage.
What developers and defenders should take from it
The report is useful because it separates signal from headline. A raw count of consoles overstates operators; the cloned-block adjustment and the 155 co-hosted hosts are the better indicators. Short-lived open directories mean historical scan data matters more than a single snapshot. And operator mistakes, not clever detection, remain how many of these campaigns get exposed. For wider context on how fast these frameworks move once inside, read our Google and Mandiant summary. The secondary write-up at Cyber Security News matches the Censys figures.
Frequently asked questions
How many ARTEX consoles did Censys find exposed?
Censys reports 1,465 hosts running an exposed ARTEX console as of early November 2026. About 650 sit in two blocks of identically configured hosting, leaving roughly 815 distinct-looking deployments. Global deployment is likely higher.
Does an exposed console mean an attacker is behind it?
No. Censys says some instances are probably run by authorized testers. The count is hosts, not threat groups, and 155 hosts (10.6%) also carry another detected threat.
What did the open directories contain?
Post-exploitation kits, stagers, implants, exploit code and, in one case, an operator home folder with SSH material and shell history. Most lasted hours to a couple of days.
How can defenders look for ARTEX?
Search for page titles starting with ARTEX plus Next.js assets, check ports 8787, 8790 and 443, and pivot to open directories, Vshell or FRP listeners and LLM proxy software on the same host.
Why does this matter to people who run AI coding agents?
The CrowdStrike case was found because an operator left a .claude folder, prompts and session histories public. Keep agent session data and config off any web-served path.
Related reading
- Google and Mandiant on ARTEX and friends
- South Korean banks, ARTEX and an open directory
- Vapor Panda and ARTEX
Figures are from Censys's report of November 5, 2026 and may change as new scans run. Check the linked sources for current numbers.