Security firm Censys has identified more than 800 distinct deployments of ARTEX, an open-source autonomous penetration-testing tool that TechCrunch describes as Chinese-made, that are reachable from the web without a password, according to TechCrunch, which reported the finding on November 6, 2026. Censys principal security researcher Silas Cutler wrote the blog post, per the report, and said not every instance is operated maliciously, since many are used by authorized testers.

What ARTEX is

  • Software that automatically probes computer systems for weaknesses, publicly released in July. TechCrunch says it has been linked to several cyberattacks and is popular with people who cannot access advanced cybersecurity AI models from Anthropic or OpenAI, because it is free.
  • Microsoft has described it as a system of AI agents that can conduct cyberattacks “from reconnaissance through data exfiltration with little needed human interaction,” as TechCrunch quotes.

What Censys found

  • The publicly accessible systems also expose attack tools, including implants (hidden malicious software used to compromise a victim’s network and keep access to it), per TechCrunch.
  • Censys said one ARTEX instance linked to attacks on South Korean banks had been exposed for months and appeared to hold attack data reaching “well beyond South Korean banks,” including payment and gaming companies.
  • TechCrunch says it is unclear why so many instances are exposed, since the software does not require internet access.

Attacks linked to the tool

  • South Korean financial industry (September): CrowdStrike attributed the attacks to a Chinese-speaking hacker who used an ARTEX instance, partly because the hacker left an “open directory” hosting the system, according to TechCrunch.
  • ConnectWise (early October): Microsoft said Chinese-linked hackers used ARTEX to break into customer cloud environments and steal data quickly, leaving defenders with “little time to detect and respond,” per the report.
  • TechCrunch says many ARTEX-linked attacks exploited simple weaknesses, such as weak or known passwords and a lack of multi-factor authentication.

Where the tool stands

ARTEX has announced that it will go closed-source and limit further releases to paying customers. TechCrunch says dozens of copies of its code remain on code-sharing sites and can still be used in active attacks.

Sources and notes

This post is based on TechCrunch’s report by Zack Whittaker (10:44 a.m. PST, November 6, 2026). Lens did not read Censys’s blog post or the CrowdStrike and Microsoft reports the article cites, and the deployment count is a figure Censys reported as of its scan. The article does not name ARTEX’s developers.

Image: a laptop keyboard with purple backlighting in a dark room, by Oboy2009 via Wikimedia Commons, licensed under CC BY-SA 4.0; cropped. Stand-in photo; it is not related to ARTEX and does not show the events described.