Security researchers have found hundreds of copies of a Chinese-made AI hacking tool exposed on the public internet, where anyone could reach them and potentially use them to launch cyberattacks. The software, called Artex, is an open source autonomous penetration testing tool that automatically probes computer systems for weaknesses. It has been linked to several cyberattacks since its public release in July. Because it is open source, anyone can download it and run it on their own servers, making it popular among users who cannot access the most advanced cybersecurity AI models from Anthropic or OpenAI. Microsoft has described Artex as a system of AI agents capable of carrying out attacks from reconnaissance through data exfiltration with little human involvement.
Censys, a cybersecurity firm that scans the internet for exposed or vulnerable systems, said in a blog post that it found more than 800 separate Artex deployments reachable from the web without a password. Silas Cutler, a principal security researcher at Censys who wrote the post, said not every Artex instance is run with malicious intent and that many are used by authorized testers. Still, it is unclear why hundreds of these systems are exposed to the web, since the software does not require internet accessibility.
The findings highlight how even powerful hacking tools can be misconfigured so that anyone can reach them, raising the odds that someone will find and misuse them. The exposed systems also make available attack tools such as implants, hidden malicious software used to compromise a victim's network and keep persistent access.
Security companies have tied Artex to several broad-scale cyberattacks, including one against the Korean finance industry in September. CrowdStrike attributed those attacks to a Chinese-speaking hacker who used an Artex instance, partly because the hacker had left an open directory hosting the system. Censys said its data showed that instance had been publicly exposed for months and appeared to hold more attack data extending well beyond South Korean banks, including payment and gaming companies. Artex was also used in an attack on IT support giant ConnectWise earlier in October, which allowed Chinese-linked hackers to spy on thousands of organizations whose data and files are hosted in Microsoft's cloud. Microsoft said in a blog post that the hackers used Artex to break into customers' cloud environments and steal data at a speed that left defenders little time to detect and respond.
Many of the attacks linked to Artex relied on simple vulnerabilities, such as guessing weak or known passwords, and a lack of multi-factor authentication. The findings show that simple vulnerabilities, including misconfigurations, can expose both the attacker and their targets. Artex has since announced it would go closed-source, effectively limiting further releases to paid customers. Dozens of copies of Artex's code remain available on code-sharing sites and can still be used in active attacks.
More cybersecurity news from TechManNews.
