Censys finds 800+ Artex open-source AI hacking tool deployments exposed on the web without password

Censys, an internet scanning firm, says it found more than 800 separate deployments of Artex, a Chinese-made open-source tool that uses AI to run penetration tests (simulated attacks) on its own, reachable from the internet with no login. Exposed items reportedly include attack tools such as implants and attack data. Artex has announced it is going closed-source, but dozens of copies of its code remain on code-sharing sites. The figure comes from a Censys blog post, relayed by TechCrunch with Censys researcher Silas Cutler as the named source. The extraction found no direct link to the blog post, so the method and exact count are unchecked here.

The main risk is that anyone who finds an open instance could use the attacker's own tooling, or read data that identifies the attacker's targets. That makes this a mixed problem for defenders: it may help them spot and track hostile infrastructure, and it also shows how easily AI-driven attack tools are being deployed carelessly. Security teams could use the exposure data to check whether their own organisation appears as a victim, and to update threat intelligence. The impact on most organisations is indirect, because this is a scan result and not a newly disclosed flaw or a confirmed wave of attacks.

The "AI hacking tool" framing suggests a new class of threat, but exposed admin panels on offensive tools are an old problem, and the exposure is a misconfiguration, not an AI breakthrough. The links to attacks on Korean finance and ConnectWise are older, secondhand context, and there is no evidence here that the exposed instances were used in those attacks. Mentions of CrowdStrike, Microsoft, Anthropic and OpenAI appear to be background, not parties to the finding.

1. 01Whether the Censys post gives its method and a breakdown of the 800+ instances (how many were live, how many held real attack data or victim details), and whether other scanners such as Shodan report similar numbers.
2. 02Whether the count of exposed Artex instances falls or rises over the next few weeks, and whether the move to closed source changes it or just pushes users to forks.
3. 03Whether any vendor, CERT or law enforcement body names victims found in the exposed data, or confirms that third parties have hijacked these instances in real attacks.