What did Censys find on November 4, 2026?
Censys published research on November 5 describing 1,465 hosts that were running an exposed ARTEX console as of November 4. ARTEX is an open-source framework that uses large language models to run penetration tests with little human input. TechCrunch reported the finding a day later, on November 6.
The exposure data adds a different kind of evidence to earlier reporting. CrowdStrike and Microsoft had already described how attackers used ARTEX. Censys showed how widely the framework had been deployed, and how casually many operators had configured it.
The count is not a clean tally of separate operators. About 650 hosts sit in two blocks of identically configured hosting. Strip those out and roughly 815 deployments remain that look distinct, Censys said.
Exposure matters because the console has no reason to face the public internet. Censys wrote that the ARTEX console does not require public-facing access. A reachable console can be found by anyone scanning for it, and it fronts a tool built to scan, exploit and move through networks.
The research also found that operators leave evidence in the open. Censys observed 32 open directories on ARTEX hosts. They exposed post-exploitation kits, stagers and implants.
That combination is the story. A tool built to automate intrusions is spreading across rented servers, and some of its users are making basic configuration mistakes. The mistakes are what let researchers count the deployments in the first place.
The finding is not a single breach or a product launch. It is a census of an attack capability that has escaped the lab and is now sitting on ordinary hosting infrastructure, often with no password in front of it.
What is ARTEX, and how does it work?
ARTEX appeared on GitHub on July 26, 2026, under the AGPL-3.0 license. Its author uses the handle Autumn-27 and also built ScopeSentry, a Chinese asset-discovery and vulnerability-scanning platform with more than 2,000 GitHub stars.
The framework is written in Go and uses a Next.js web console backed by PostgreSQL. It works with Anthropic, OpenAI or any OpenAI-compatible model endpoint, according to Censys. Microsoft said the interface and output default to English but can switch to Korean, Mandarin, Spanish or Japanese.
The design is a multi-agent loop. A planner turns a stated goal into attack intents. Worker agents claim those intents, run tools such as nmap, and write results back. An event-driven engine repeats the explore-decide-execute cycle until the goal is met.
ARTEX keeps two graphs. One maps the target assets. The other tracks how much of that surface has been tested. ScopeSentry feeds domains, subdomains, IPs, ports and endpoints into the asset graph, and mitmproxy records traffic.
Censys noted that the default example task asks agents to "gain admin panel access or server privileges". That default says a lot about the intended use. The framework is not a scanner with an AI assistant bolted on. The agents are meant to pursue an objective across multiple steps.
Microsoft described the framework as able to run "from reconnaissance through data exfiltration" with little human interaction. CrowdStrike described it as an agentic pentesting tool developed in China.
The project grew quickly. Censys estimated it reached 1,500 to 2,000 GitHub stars within ten weeks of release. That is modest by open-source standards, but enough to seed copies, translations and derivatives.
How many ARTEX consoles are exposed, and where are they hosted?
Censys counted 1,465 hosts as of November 4. That figure reflects addresses it could see, not the total number deployed. Censys said global deployment is likely higher because not every console is exposed.
Hosting is heavily concentrated. PEG Tech (AS54600) accounted for 493 hosts. Yancy Limited (AS138415) accounted for 157. Together the two netblocks held about 44% of the total.
Censys said identical port layouts and server templates point to provisioning templates, not hundreds of separate operators. The same pattern showed up in earlier Censys reporting on Cobalt Strike listeners tied to Yancy. In both cases, a large host count may come down to a few real servers spread across many addresses.
For defenders, the concentration cuts both ways. A small number of hosting providers account for a large share of the visible deployments. That makes bulk notification possible, but it also means host counts can overstate the number of distinct actors.
Customized builds exist too. Censys found a renamed console reading ARTEX v2 · Agent Security Workbench, plus a handful of other renamed versions. Rebrands make simple name matching unreliable.
ARTEX hosts often carry other tools. On 155 hosts, or 10.6% of the total, Censys detected at least one additional threat. These included Cobalt Strike, Adaptix C2, Vshell and other AI pentesting frameworks.
CyberStrikeAI shared hosts with ARTEX on 70 machines. PentAGI, HexStrike AI and RedAmon also appeared. Some hosts mixed agent frameworks with conventional command-and-control and tunneling tools.
Yancy Limited and Zenixcloud also hosted proxy IP addresses listed in CrowdStrike's report, Censys said. That link does not prove the hosting providers knew about the activity. It does show that the same infrastructure keeps reappearing across unrelated campaigns.
Censys detects the consoles by matching the ARTEX page title with Next.js static assets. That method finds servers that still use the default branding. Renamed builds can slip past it, which is one reason the published count should be read as a lower bound.
Which attacks have been linked to ARTEX?
CrowdStrike published a report on October 7. It described a campaign against South Korean financial organizations between late September and early October 2026. At one bank, the actor breached a loan progress inquiry service used by financial brokers. At another, it compromised an employee mobile work-support system.
CrowdStrike said the number of affected organizations remained unconfirmed. It assessed the actor as likely a Chinese speaker who was financially motivated, and placed moderate confidence on that judgment.
The ARTEX instance used DeepSeek v4.1-flash as its main model. The operator also ran Claude Code sessions backed by GLM-5.3 from Zhipu AI and Grok 4.6. CrowdStrike said the actor likely bought DeepSeek access through an API reseller.
Microsoft's October 21 report described a larger operation. It attributed a ConnectWise Cloud Backup supply-chain compromise to Storm-0940, a China-state-aligned group active since 2021. Microsoft said the group used ARTEX to accelerate scanning, password spraying and OAuth application abuse.
ConnectWise published an initial advisory on October 16. Microsoft said Storm-0940 used ARTEX to attempt sign-ins to more than 2,250 tenants. In several attacks, the time from initial targeting to privileged cloud access was under three hours.
A separate password-spraying burst ran from October 10 to 14. It targeted 327 accounts at eight organizations. Microsoft recorded more than 151,000 failed logon events, peaking at 2,900 failures per minute on October 11, with more than 111,000 failures in a single day. That campaign produced no successful authentication.
Microsoft listed the target sectors in its report. They include aerospace and defense, automotive, chemicals, energy, financial services, government, legal, manufacturing, media, military, semiconductor, software, technology, and think tanks and non-profits.
Microsoft said the group's usual methods include exploiting internet-facing applications and adding credentials to OAuth applications to keep access. ARTEX made those steps faster and easier to repeat.
Why does agent speed change the defense problem?
Microsoft's central point is tempo. Agents can work around the clock, including weekends and holidays. They can try several breach paths at once, which shortens the gap between choosing a target and achieving an objective.
The volume creates a detection problem. Automated activity produces traffic and log data that may raise alerts. The speed leaves defenders little time to investigate and revoke access in a coordinated way.
Microsoft said most of Storm-0940's targeting failed. The group still achieved privileged cloud persistence at many organizations. That is a different pattern from one deep intrusion. It is a broad, fast sweep in which a few successes are enough.
The October spray also shows how the activity looks in logs. Lockout responses made up nearly 98% of the events, and 48 accounts received more than 1,000 failures. A defender watching those numbers has to decide quickly which alerts matter.
The ConnectWise case shows why third-party trust matters. After taking control of identities tied to ConnectWise cloud applications, the agents authenticated to customer environments through apps that already held permissions. No interactive sign-in was needed.
Microsoft said the activity did not result from a vulnerability in its own systems, products or services. It also cautioned that an affected application, or even a successful login, does not necessarily mean customer data was accessed.
Persistence is the harder problem. Microsoft said credential changes made by the agents can stay active as a backdoor even after remediation of the original compromised application. That is why the review has to cover identities and grants, not just the vendor application.
The practical change is scale. A small team can now run many intrusions in parallel, and the tooling costs little more than model API calls and a rented server. The bottleneck moves from human effort to target selection and follow-through.
That does not make every attempt succeed. It changes the economics of trying. When each attempt is cheap, a low success rate can still produce a meaningful number of compromised tenants.
What do the exposed consoles reveal about the operators?
The open directories are the most revealing part of the Censys report. Censys found directories on the ARTEX server named by CrowdStrike starting on August 18, 2026. That was seven weeks before the report appeared. The directories exposed exploit binaries and a .claude folder.
CrowdStrike said its analysis of operator-controlled directories uncovered Claude Code session histories, ARTEX configuration files and Claude memory files. Those artifacts gave investigators a direct view of how the actor planned and ran intrusions.
CrowdStrike described a two-server setup. One Hong Kong-based address served as the main attacker infrastructure. A second address hosted the ARTEX instance linked to the Korean attacks.
The sessions contained telling details. CrowdStrike said the operator asked Claude where threat actors sell Korean breach data and asked for help finding Korean Telegram sales groups. In another session, the operator asked Claude to draft a security researcher résumé listing the ARTEX results.
Exposure is usually temporary. Censys said most open directories stayed active for hours to a couple of days. Between November 3 and November 5, 10 closed while 15 new ones appeared on other hosts.
Censys keeps scan history, so file listings remain visible after an operator removes a directory. A short mistake becomes a lasting record for defenders and researchers.
The same pattern appears elsewhere in the dataset. Operators stack AI frameworks, reuse hosting templates and leave model configuration in place. The tooling is new, but the operational hygiene is familiar.
One caution belongs here. Censys said not every exposed ARTEX instance is malicious, and some are likely run by authorized testers. Exposure alone is not proof of an attack.
What happens to ARTEX next, and what should defenders watch?
The project did not survive the attention. On October 8, the day after CrowdStrike's report, the author posted a statement. They said they were not involved in the attacks and that ARTEX was meant for testing within authorized scopes. The author said the project would go closed-source.
The GitHub repository has since been taken down, according to Censys. Archived copies, translations and rebrands such as ScopeWeaver are still circulating. Removing the original does not remove the capability.
Censys published a detection query that matches the ARTEX page title and Next.js static assets. It flagged two hosting netblocks for further analysis. Blocking those addresses alone is not enough, because renamed and customized consoles exist.
Microsoft's guidance focuses on identity. It asks organizations to inventory the affected ConnectWise application IDs and review service-principal sign-ins and Entra audit records. It also asks them to look for new credentials and privilege changes.
Microsoft warns against deleting enterprise applications as a first response. Investigators should preserve configuration and evidence before making irreversible changes. It also recommends reviewing activity back to at least October 15, and earlier where records allow.
The wider lesson is that offensive agent frameworks are now ordinary infrastructure. They run on rented servers, call commercial model APIs and leave configuration files behind. The traits that make them cheap to deploy also make them easy to study.
The next signal to watch is vendor telemetry. Microsoft said it has seen multiple actors across regions using ARTEX. Censys said global deployment is likely higher than the number it can see. Both point to a tool that outlived its repository.
The market signal is just as important as the technical one. A capable multi-agent attack framework was free, open source and usable with commercial models. Its removal changed the distribution channel, not the underlying capability.
For security teams, the useful question is no longer whether agents will appear in an intrusion. It is whether the organization can spot machine-speed activity and revoke access before an agent finishes its task.