On November 9, 2026, GitGuardian published a field guide to roughly 45 open-source agentic penetration-testing frameworks—not another ARTEX recap alone, but a catalog of siblings that share the same mechanical idea: wire a frontier or local model into a loop that runs tools and acts on output until an operator's goal is met. Secondary coverage the same week (including Dark Reading's November 10 piece) points at the same shift GitGuardian measured: forks of ARTEX and dozens of lookalike projects still automate credential attacks and cloud pivots at machine speed. If you run Claude Code, Codex, or Cursor with MCP, you are not installing PentAGI—but you already operate the benign half of that architecture on your laptop. This post translates GitGuardian's numbers into checks defenders and agent operators can run today.
explainx.ai has broader AI news context on how agentic coding changes risk posture on developer machines.
Update (November 11, 2026): Unit 42 behavioral hallmarks
Palo Alto Networks Unit 42 published defender-focused ARTEX research the same day, with 609 internet ARTEX hosts and 1,323 CyberStrikeAI services (October 2026 counts) plus Table 2 operator traits such as think-then-act HTTP cadence and canary usernames. Beam's breakdown is Unit 42 ARTEX: behavioral hallmarks and what defenders hunt.
Update (November 11, 2026): AntiFox in live IIS and AWS intrusions
On November 10, 2026, Arctic Wolf Labs published an open alert pack documenting AntiFox—an ARTEX v0.1.1 fork in the same fork lineage this catalog warns about, though AntiFox itself is not one of the ~45 counted projects—used from Alibaba Cloud against IIS applications and AWS accounts. The pack describes hundreds of cross-service API calls in ~30 minutes, GetSecretValue success against a production secret, and w3wp.exe deploying ASPX shells that parsed web.config credentials. That is the operational mirror of GitGuardian's exposure statistics: forks do not stay in lab mode. For the full attack chain and hunting guidance, see AntiFox AWS credential theft: Arctic Wolf's November breakdown.
TL;DR
| Question | Answer |
|---|---|
| Am I affected? | Indirectly if you store API keys where agents or attackers can reach them; directly if you run an offensive framework console on the public internet |
| Is there a patch? | No single CVE—this is open-source tooling and mis-exposed services |
| Does data leave my machine? | Attack frameworks exfiltrate; your coding agent can too if misconfigured—Beam watches local actions, not Shodan |
| What is new here? | A counted catalog, secret-hunting grades, and Shodan fingerprints dated 2026-11-07 |
| What should I do? | Rotate exposed keys, close agent UIs, scan skills/MCP, read Railway's ARTEX-speed incident for why speed matters |
What GitGuardian measured
GitGuardian states the research question plainly: ARTEX was one framework; the field holds about 45 more, each with public source code and the same control loop. Researchers read code at pinned commits for a secret-hunting shortlist and queried Shodan with 56 fingerprint records across builds that expose a distinct web interface.
ARTEX baseline and takedown
Per GitGuardian, ARTEX's creator removed the original repository on 2026-10-08, 74 days after the first commit, after reports that threat actors used it to hunt secrets and move laterally. The takedown did not stop spread: 102 forks and ARTEX-named repositories appeared in the takedown week alone. Google Threat Intelligence Group, Microsoft, Wiz, CrowdStrike, and others have published on ARTEX itself—Beam covered Google and Mandiant's incident-response findings, Wiz's seven fingerprints, and Censys on exposed consoles.
GitGuardian's November post is the first systematic sibling list with exposure telemetry attached.
Five families (mechanism)
GitGuardian groups 32 of ~45 projects into families (the rest are forks or variants):
- Network kill chain — end-to-end recon and exploitation, often from a Kali container (PentAGI, RedAmon, DarkMoon with 50 specialist agents, and others).
- Web-app and API — autonomous app testing or source-guided review (Strix, Shannon, PentestGPT).
- C2-integrated — LLM operators inside Mythic or ARTEX forks with consoles (Pojun, FORANG, ScopeWeaver).
- Harnesses — offensive wrappers around Claude Code, Codex, Hermes (RAPTOR, CyberStrike, cyber-harness, Nebula, Cybermes).
- Research prototypes — academic agents (Incalmo, VulnBot, and similar).
Three additional projects appear repeatedly in threat reporting and in the catalog: Cairn (shared fact graph, no authentication by default), HexStrike (an MCP server exposing 150+ offensive tools to any MCP client, no authentication by default), and Agent Zero (general-purpose agent, also no authentication by default).
That last line matters for MCP-heavy coding stacks: an unauthenticated offensive MCP endpoint is the mirror image of plugging an unknown MCP server into Claude Code—broad tool surface, one prompt away.
Secret hunting: what ships vs what models improvise
GitGuardian short-listed frameworks likely to hunt secrets on public GitHub and assigned grades after code review:
| Grade | Meaning |
|---|---|
| Provisioned | Scanner named and reachable by the agent by default |
| Text only | Recipes or skills, no wired scanner |
| Unwired | Scanner code present, nothing calls it |
| None found | Reviewed, no hunting path |
| Not reviewed | Outside the shortlist |
Image: GitGuardian
Four tools ship a real scanner wired to the agent: Pojun, Cybermes, Xalgorix, and AIRecon. GitGuardian stresses a uncomfortable corollary: none contains a GitHub fetcher, yet almost every framework hands its agent a shell and web access, so a GitHub dork, a downloaded gitleaks binary, or a found key passed to the next tool call is one improvised step away. Cybermes, for example, ships its own secret_scan binary (48 regex patterns) plus credential validators for AWS, GitHub, Slack, OpenAI, Anthropic, and others as default skills—per GitGuardian's pinned-commit review.
For defenders, the lesson is not "only four repos matter." It is that capability follows the model plus shell, which is also how a well-tooled coding agent behaves when asked to "check this repo for leaks."
Shodan exposure on 2026-11-07
GitGuardian classified 41 frameworks for Shodan matchability:
- 11 serve a web UI by default on a network port.
- 18 expose a UI only in some setups or nothing distinctive at the root.
- 12 have no listener.
ARTEX-family services led the count at 1,428 count-only Shodan matches on November 7, 2026. Other standouts in GitGuardian's table include 419 PentAGI matches (233 with a default certificate), 173 Agent Zero (134 at a login page, 39 open), 43 ScopeWeaver, and 41 Cairn.
GitGuardian publishes query patterns (page titles, favicon hashes, HTML snippets) so defenders can find their own exposed consoles—GitGuardian deliberately does not ship a target list. Examples in the primary post include http.title:"PentAGI" (521 matches on the scan date), http.title:"Agent Zero" (173 matches), and HTML fingerprints for ScopeWeaver and RedAmon dashboards. Those numbers are snapshots, not guarantees your perimeter is clean, but they give blue teams vocabulary to ask whether any matching service lives in your cloud accounts.
If your security team runs purple-team agents, treat an internet-facing PentAGI or Agent Zero panel like RDP without a password: assume compromise, not research. GitGuardian also notes redcell and cyber-harness HTML theme markers surfaced 59 and 75 matches respectively—smaller counts that still represent full operator UIs if left unauthenticated.
Attack chain in the wild (how this connects to incidents)
GitGuardian frames the catalog next to active abuse: its related posts describe ARTEX hunting public GitHub secrets and moving into cloud tenants in minutes, aligning with Microsoft's ARTEX reporting and Railway's November 10, 2026 report describing defender races against abliterated models and an ARTEX-class harness.
Mechanically, the chain GitGuardian and vendors describe looks like this:
- Objective in natural language ("find cloud keys for this org").
- Tool loop — shell, scanners, cloud CLIs, sometimes MCP tools.
- Credential pivot — stolen keys feed the next agent call (LLM API abuse, cloud control planes, or SaaS secrets).
- Operator console — web UI steering parallel workers (often exposed per Shodan counts).
None of that requires a zero-day in your IDE. It requires keys in the wrong place and automation that does not sleep.
What this means if you run AI coding agents
Concrete checks grounded in GitGuardian's findings and Beam's incident corpus:
1. Assume your agent loop matches attacker harnesses
GitGuardian's Harness family explicitly names Claude Code, Codex, and Hermes. Your agent already has shell, repo access, and often MCP. Difference is intent and policy—not mechanics. After incidents like Qubole's trusted-role exfiltration or Railway's env-var decryption, rotate provider keys and remove secrets from dotfiles agents read.
2. Treat MCP like offensive tool servers
HexStrike in GitGuardian's catalog is an unauthenticated MCP server of offensive tools. On the defensive side, mirror that risk: only enable MCP servers you would trust with passwordless shell. Beam's MCP scanning heuristics include version-pin checks and patterns for risky endpoints—but scanning is not malware analysis.
3. Hunt your own exposure before Shodan does
If you experiment with pentest agents internally, bind consoles to localhost, require auth, and block outbound callbacks you do not need. GitGuardian's data shows dozens of live consoles without real barriers—CERT-IN's ARTEX guidance stresses the same for government defenders.
4. Watch for agent-speed probing on your perimeter
Wiz's Cyber Model Arena and CyberStrikeAI education-sector reporting show orchestrators chaining the same families GitGuardian lists. Short-lived credentials and behavioral detection remain the controls Google Mandiant emphasizes in the ARTEX deep dive.
What Beam can and cannot do here
Beam is local-first observability for coding agents: it heuristically scans skills and MCP configs (11 patterns plus MCP version-pin checks), flags risky PreToolUse actions on Claude Code and Codex when workspace policy is cached, and redacts known secret shapes before persistence. It does not scan Shodan, fingerprint PentAGI consoles, or block outbound attacks from an attacker-operated framework in your cloud tenant. It helps you notice when your agent reads .env, pipes curl to bash from a new skill, or exfiltrates tokens—patterns that overlap GitGuardian's Provisioned secret hunters.
How Beam handles overlapping agent-guardrail products
Enterprise platforms such as Bay's November 10 runtime hooks vet actions org-wide. Beam targets individual developers who want on-device logs and optional deny without a cloud control plane. For supply-chain-shaped risks in offensive agent stacks—malicious skills, compromised MCP, permission escalation via social engineering—the relevant Beam controls are pre-run scans and hook-based deny, not kernel sandboxing. Policy is fail-open when cached enforce rules expire; plan accordingly.
Frequently asked questions
What are agentic AI pentesting tools?
Per GitGuardian, they are open-source projects that wire a language model into a loop that runs tools and acts on their output. About 45 exist in the catalog, grouped into network, web/API, C2, harness, and research families.
Do these tools only matter if I install them?
No. They matter when your secrets are public, when attackers run the tools against you, or when your legitimate coding agent reproduces the same loops locally. GitGuardian's Shodan section is about attacker-operated infrastructure, not your laptop IDE.
How does this relate to Dark Reading's November 10 headline?
Dark Reading's story summarizes the same ecosystem GitGuardian measured—ARTEX forks plus ~45 siblings capable of credential attacks at machine speed. GitGuardian's post is the primary catalog and telemetry; use it for repo names, grades, and queries.
Should I ban Claude Code because harnesses exist?
GitGuardian's point is structural: harnesses wrap coding agents attackers already target for settings.local.json leaks. Banning agents is rarely practical; governing keys, MCP, and skill provenance is.
Related reading
- ARTEX and Friends: Google and Mandiant findings
- Wiz: seven agentic attack fingerprints
- Railway October incident: ARTEX-class speed
- Storm-0940, ARTEX, and ConnectWise
- Black October: stolen AI keys on developer platforms
- Recorded Future: 103 AI-linked incidents and coding-tool footholds
- Beam landing: what Beam watches locally
Version details, Shodan counts, and repository metadata reflect GitGuardian's publication date of November 9, 2026, and GitHub API snapshots dated November 7, 2026, unless a linked vendor updates them later.