Censys detects 1,465 exposed ARTEX autonomous AI offensive consoles across global internet

Key facts

From theoretical threat to 1,465 active command consoles

Internet wide telemetry published by the Censys Advanced Research Collective (ARC) has revealed that ARTEX, an open source autonomous artificial intelligence penetration testing framework weaponized by threat actors, has achieved a massive operational footprint across the public internet. As of 3 November 2026, Censys telemetry identified 1,465 public hosts operating an active ARTEX management console. The census establishes that autonomous offensive AI frameworks are no longer confined to isolated research labs or bespoke nation-state intrusions. Instead, threat actors are deploying industrial grade agentic infrastructure at scale, frequently co-hosting ARTEX alongside traditional command and control (C2) platforms, companion AI exploitation tools, and self-hosted large language model (LLM) gateways.

The investigation, led by principal security researcher Silas Cutler, follows recent high-profile disclosures linking ARTEX to intrusions across North American cloud environments and Indian financial payment rails. Microsoft documented state-aligned group Storm-0940 abusing ARTEX to orchestrate high-speed password spraying against more than 2,250 ConnectWise customer tenants, peaking at 2,900 sign-in attempts per minute. Concurrently, the Indian Computer Emergency Response Team (CERT-In) issued Critical Advisory CIAD-2026-0058 warning that adversary CRAFTY FALCON chained ARTEX with three other autonomous tools to breach staging clusters and siphon banking settlement application programming interfaces (APIs). The Censys findings demonstrate that these public campaigns represent only the visible fraction of a widely deployed offensive agent ecosystem.

Zoom

Censys ARC global census of ARTEX offensive infrastructure (as of 3 November 2026)

Infrastructure Dimension	Observed Count	Proportion / Metric	Technical and Operational Significance
Total Exposed Hosts	1,465 Public Nodes	100.0% census	Internet-wide reach via Next.js title and static asset signature
Mass-Hosted Netblocks	~650 Hosts	44.4% (derived)	Concentrated in Yancy Ltd (AS138415) and Zenixcloud alias clusters
Bespoke Deployments	~815 Hosts	55.6% (derived)	Distinct operational nodes distributed across global cloud providers
Multi-Threat Co-Locations	155 Hosts	10.6% (derived)	Paired with Cobalt Strike, Vshell, Adaptix C2, and ScopeSentry
Agentic Stacking (CyberStrikeAI)	70 Hosts	4.8% (derived)	Co-deployed with automated script mutator for exploit generation
Self-Hosted Model Gateways	43 Hosts	2.9% (derived)	CLIProxyAPI (19) and New API (18) for API reseller routing
Public Open Directories	32 Hosts	2.2% (derived)	Leaking .claude folders, session logs, stagers, and target lists
48-Hour Directory Churn	25 Endpoints	10 closed, 15 opened (derived)	High operational volatility across adversary staging nodes

ARTEX was originally published on GitHub on 26 July 2026 under the AGPL-3.0 license by developer Autumn-27. The author previously created ScopeSentry, an asset discovery and vulnerability scanning framework with more than 2,000 GitHub stars. ARTEX was constructed as an autonomous agentic decision layer atop ScopeSentry, ingesting discovered domains, subdomains, network addresses, ports, and web endpoints directly into its internal relational state engine.

Autonomous C2 mechanics: dual dynamic graphs and execution loops

The platform is engineered in Go, utilizing a Next.js web dashboard backed by PostgreSQL and an embedded mitmproxy instance for real-time network traffic interception. When an operator initiates an intrusion, they define high-level Tasks specifying the target scope, credential sets, and operational objectives, such as gaining administrative panel control or acquiring root cloud privileges.

ARTEX processes objectives through an event-driven explore-decide-execute loop managed by specialized AI sub-agents. The Planner Agent queries connected foundation models through Anthropic, OpenAI, or compatible endpoints to decompose macro attack goals into granular intents. Worker agents claim specific intents, dispatch containerized tools (including nmap and ffuf), parse command output, and write structured findings back to the database.

Zoom

The engine maintains two independent state graphs to prevent redundant operations and steer execution. The Asset Graph catalogs discovered perimeter topology, while the Exploration Graph logs testing completeness, path successes, execution failures, and harvested authentication tokens. Following widespread reports of malicious weaponization by CrowdStrike in early October 2026, Autumn-27 removed the public repository on 8 October 2026, stating the tool was designed exclusively for authorized penetration tests. However, the framework proliferated rapidly across community mirrors, generating localized distributions such as ScopeWeaver and commercial variants marketed as ARTEX PRO.

Multi-threat convergence and operational exposure

Censys telemetry establishes that threat groups rarely operate ARTEX in isolation. Out of the 1,465 discovered hosts, 155 nodes (10.6%, derived) co-host at least one additional artifact officially categorized by Censys as an active malicious threat. Operators systematically stack agentic tooling: 70 hosts run ARTEX alongside CyberStrikeAI, while companion frameworks PentAGI, HexStrike AI, and RedAmon appear across multiple clusters.

In total, 43 ARTEX hosts operate self-hosted LLM gateway or reseller services, primarily CLIProxyAPI (19 hosts) and New API (18 hosts). Because major foundation model providers enforce safety filters and monitor API abuse, adversaries purchase token access through unregulated third-party API pools and route model interactions through self-hosted proxies to maintain persistence and bypass tenant bans.

Despite deploying advanced agentic software, threat actors operating ARTEX frequently commit fundamental operational security errors. Censys researchers discovered 32 distinct ARTEX hosts maintaining publicly accessible web directories that expose internal files without authentication, including stored .claude configuration folders, prompt templates, agent conversational histories, plaintext configuration files, and staged exploitation kits.

Defensive engineering directives against autonomous agent swarms

Traditional security operations playbooks built around human reaction times cannot contain autonomous attack pipelines that progress from reconnaissance to cloud exfiltration in minutes. Organizations must implement defense-in-depth measures specifically calibrated against agentic architectures.

Zoom

Required defensive engineering controls against autonomous offensive agents

Defensive Pillar	Technical Architecture	Implementation Standard	Strategic Mitigation Objective
1. Ingress Perimeter C2 Blocking	Censys ARC Threat Ingestion	Block 1,465 known ARTEX consoles and Yancy/Zenix ASNs	Drops inbound probing and terminates proxy relay connections
2. Model Gateway Egress Audits	Encrypted TLS Egress Inspection	Detect connections to CLIProxyAPI and New API pools	Prevents internal compromised nodes from routing agent prompts
3. Agent Budget Exhaustion	Recursive Directory Tarpits	Inject infinite pseudo-API paths and synthetic tokens	Drains adversary token budget and induces model hallucination failure
4. Static Secret Elimination	Managed Workload Identities	Replace client secrets with IAM Roles and IP CIDR ACLs	Invalidates stolen OAuth credentials across cloud tenants

Security leadership must enforce burst rate-limiting on authentication endpoints, deploy synthetic honey-tokens to trip detection instantly, and eliminate long-lived client secrets in cloud environments, ensuring that autonomous credential discovery cannot translate into machine-speed lateral movement.