A Chinese-made AI hacking toolkit is sitting open on the public internet — hundreds of times over.
On November 6, 2026, TechCrunch reported that Censys identified more than 800 distinct deployments of Artex accessible from the web without a password. Artex is an open-source autonomous penetration-testing framework released publicly in July. Microsoft has described it as a system of AI agents that can run cyberattacks from reconnaissance through data exfiltration with little human interaction.
Why exposure matters
Censys principal security researcher Silas Cutler noted that not every instance is malicious — many are used by authorized testers — but the software does not need to be internet-reachable. Public consoles can also expose implants and other attack tooling used to keep access on victim networks.
Linked campaigns
Security firms have tied Artex to broad attacks on the Korean finance industry in September; CrowdStrike attributed one campaign to a Chinese-speaking actor who left an open directory hosting the system. Censys said that instance had been exposed for months and appeared to hold attack data beyond South Korean banks, including payment and gaming companies.
Artex was also used in an October attack on IT support giant ConnectWise that let Chinese-linked hackers spy on organizations whose data sat in Microsoft’s cloud. Microsoft said attackers used Artex to break into customer cloud environments and steal data at a speed that left defenders little time to respond. Many linked attacks abused weak or known passwords and missing multi-factor authentication.
Artex has since said it would go closed-source for paid customers, but dozens of code copies remain on code-sharing sites.
Why it matters
Agentic offensive tooling plus misconfiguration is a double exposure problem — for targets and for operators. Security vendors and MSPs should brief customers on internet-facing AI red-team stacks and MFA hygiene.
For B2B security marketers, this is a concrete case study: open directories, passwordless consoles and agent speed compress detection windows — perfect for ABM content aimed at CISOs and MSPs.
Source: TechCrunch, Censys. Written by the xRapid Media LLP team.
About xRapid Media
xRapid Media LLP is a High Tech B2B Marketing company for technology businesses: software and SaaS companies, IT services and managed service providers, and hardware and IT product vendors. Our team combines positioning and content, account-based marketing, paid ads funnels, verified B2B data, intent signals, email and LinkedIn outreach and appointment setting to help you reach the right buyers and turn their attention into qualified leads and meetings.
Want help putting ideas like these into practice? Email [email protected] or book a time with our team.