Hundreds of Artex AI Hacking Tools Found Open to the Public Web

Security researchers have found hundreds of servers hosting a Chinese-made AI hacking tool exposed to the internet without a password, letting anyone access the software. The open-source autonomous penetration testing tool, called Artex, automatically checks computer systems for weak spots and has been linked to multiple cyberattacks since its public release in July.

Findings

Cybersecurity firm Censys reported finding more than 800 distinct deployments of Artex accessible from the web without a login. Silas Cutler, principal security researcher at Censys, stated that not every instance is run maliciously and many are used for authorized testers, but noted it remains unclear why so many systems are left exposed since the software does not require internet access to function.

Past Attacks

Security companies have tied Artex to several broad-scale cyberattacks, including a September strike against the Korean finance industry. CrowdStrike attributed those attacks to a Chinese-speaking hacker who left an open directory hosting the system, which Censys data showed had been publicly exposed for months and contained attack data extending beyond South Korean banks to payment and gaming companies. Artex was also used in an October attack on IT support giant ConnectWise, enabling Chinese-linked hackers to spy on thousands of organizations whose data is hosted in Microsoft's cloud.

Context

Autonomous AI hacking tools allow users to scan and probe computer systems for vulnerabilities at high speeds with minimal human help. When these tools are misconfigured or left without proper passwords, they can create major security risks by allowing unauthorized individuals to launch cyberattacks or expose sensitive data.