Censys researchers discovered over 800 publicly exposed instances of the hacking tool Artex, which allows attackers to conduct automated penetration testing without authentication. Microsoft identified the open-source tool as an AI agent system capable of executing cyberattacks with minimal human interaction. CrowdStrike linked the tool to a September cyberattack against the Korean finance industry.
Chinese-linked hackers used Artex to break into thousands of organizations’ cloud environments in October, exploiting weak passwords and a lack of multi-factor authentication. The tool was used to target cloud infrastructure, and Dozens of copies of the code remain available on public sites for active use. Artex announced it would switch to a closed-source model for paid customers.
Security teams must audit their cloud environments for exposure to this automated agent system. The persistence of open-source code on public sites means the threat remains active despite the company’s pivot to a closed-source model. Developers should enforce strict authentication and multi-factor authentication to prevent these automated intrusions from succeeding.
