More than 800 Artex AI hacking tool deployments exposed online, researchers say | Межа

Censys found more than 800 Artex deployments accessible online without a password. The exposure could allow outsiders to launch cyberattacks against unsuspecting targets.

Artex is an open-source autonomous penetration-testing tool that automatically probes computer systems for weaknesses. Since its public release in July, it has been linked to several cyberattacks. Anyone can download and run it on their own servers, and it has become popular among people unable to access Anthropic or OpenAI’s most advanced cybersecurity AI models for finding vulnerabilities.

This is reported by TechCrunch .

Microsoft has described Artex as a system of AI agents capable of carrying out cyberattacks “from reconnaissance through data exfiltration with little needed human interaction.” In a blog post, cybersecurity firm Censys said it had identified more than 800 distinct deployments accessible from the web without a login password.

Silas Cutler, Censys’s principal security researcher and author of the post, said not every Artex instance was operated maliciously and that many were used by authorized testers. But it is unclear why hundreds are exposed online, since the software does not require them to be accessible from the internet.

Publicly accessible instances can expose attack tools, including implants – hidden malicious software used to compromise a victim’s network and maintain persistent access. The findings also show how misconfigurations can leave powerful tools open to anyone, increasing the chance they will be found and misused.

Security companies have linked Artex to several large-scale attacks, including attacks on South Korea’s finance industry in September. CrowdStrike attributed those attacks to a Chinese-speaking hacker who used an Artex instance; one reason was that the hacker had left an “open directory” hosting the system. Censys said its data showed that instance had been publicly exposed for months and appeared to contain attack data “well beyond South Korean banks,” including data on payment and gaming companies.

Artex was also used in an attack on IT support company ConnectWise in October. The attack allowed Chinese-linked hackers to spy on thousands of organizations whose data and files are hosted in Microsoft’s cloud. Microsoft, which had visibility into the attack, said the hackers used Artex to break into customers’ cloud environments and steal data so quickly that defenders had “little time to detect and respond.”

Many attacks linked to Artex involved exploiting simple weaknesses, such as guessing weak or known passwords and the absence of multi-factor authentication. Artex has since announced it would go closed-source, effectively limiting further releases for paying customers. Dozens of copies of its code remain available on code-sharing sites and can still be used in active attacks.

A Pentagon personnel system breach exposed unencrypted personal records of 2.8 million living people and nearly 300,000 deceased, including Social Security numbers and military service details.

OpenAI will provide Ukraine with free access to Daybreak, an AI-powered cybersecurity system designed to detect vulnerabilities and protect hospitals, power plants, and other civilian infrastructure from cyberattacks.