800+ Artex AI hacking tools exposed: the way in is still passwords

Even the attackers leave the door open. Security firm Censys found more than 800 deployments of Artex, the open-source AI hacking tool, reachable from the internet with no password, TechCrunch reported on November 6. Artex runs autonomous agents that can carry an attack from recon to data theft with little human help. The detail that matters for you is less exotic: many Artex-linked attacks got in through weak or known passwords on accounts without multi-factor authentication.

What actually happened

Artex is an autonomous penetration testing tool, released publicly in July. Per TechCrunch:

• 800+ exposed instances. Censys principal researcher Silas Cutler counted more than 800 distinct Artex deployments open to the web without a login. Not all are malicious. Many belong to authorized testers. But the software doesn't need to be internet-facing at all.
• Attack data out in the open. Exposed systems included implants, the hidden software attackers use to keep access to a victim's network.
• Linked to real breaches. CrowdStrike tied a September campaign against Korean financial firms to a Chinese-speaking attacker running Artex, partly because that attacker left an open directory. Censys says that instance was exposed for months and held data reaching beyond Korean banks, including payment and gaming companies.
• ConnectWise. Artex was also used in the October attack on IT support firm ConnectWise. Microsoft said the speed left defenders little time to respond.
• Still circulating. Artex says it's going closed-source, but dozens of copies of the code remain on code-sharing sites.

We covered the Microsoft 365 side of the Artex campaign last month.

Why it matters for your business

AI made the attack faster. It didn't make the entry point smarter. An agent that tries leaked passwords against every login it finds is just a tireless version of an old attack. MFA still stops it.

So the checklist is boring, and it works:

1. MFA on everything with a login. Email, payroll, your store admin, your domain registrar, your IT provider's portal. Prefer passkeys or an authenticator app over SMS.
2. Kill reused and default passwords. A password manager for the team, and a check for accounts that appear in known breach lists.
3. Ask your IT provider how they're protected. ConnectWise-style attacks hit the vendor first and you second.
4. Never expose admin tools to the internet. That includes your own security and AI agent tools. If a dashboard doesn't need to be public, put it behind a VPN or an identity-aware proxy.

The exposed Artex instances are a reminder that misconfiguration hurts everyone, attackers included. Don't make the same mistake with your own tools.

Sources: TechCrunch.