ARTEX Offensive AI Tool Activity Found to Exceed Reported Campaigns, Raising Cybersecurity Concerns
The use of ARTEX, an open-source, AI model-driven, autonomous penetration testing framework, is significantly more widespread than previously reported, according to a new report by internet traffic scan provider Censys. Released on GitHub in July 2026 by a user known as 'Autumn-27,' ARTEX has been integrated into several malicious campaigns since October. Censys's research, published on November 5, found 1465 internet-exposed ARTEX hosts globally, with approximately 815 distinct deployments, indicating a much broader footprint. The tool, written in Go with an embedded Next.js web console, functions as an offensive command-and-control (C2) platform that communicates with AI agents and can integrate with large language models (LLMs). Notably, 155 of these hosts (10.6%) also run other threat artifacts, including AI attack frameworks, reconnaissance platforms, tunneling tools, and traditional malicious C2 servers like Vshell and Cobalt Strike. The original GitHub repository for ARTEX was taken down in October ...
