Censys reports that ARTEX, an open-source, AI-driven autonomous penetration testing framework, may be far more widely used than earlier reports showed. The tool was released on GitHub by a user known as "Autumn-27" in July 2026.
Censys researcher Silas Cutler found 1,465 hosts worldwide exposing an ARTEX console to the public internet. About 650 of these sit within two blocks of identically configured hosting, leaving roughly 815 distinct-looking deployments.
Censys telemetry showed that 155 of the exposed ARTEX hosts (10.6%) also run at least one other artifact Censys categorizes as a threat. These include other AI attack frameworks, reconnaissance platforms, tunneling tools, and traditional command-and-control servers such as Vshell, Cobalt Strike, and Adaptix C2.
Cutler said operators appear to be using multiple agent frameworks side by side. CyberStrikeAI appeared alongside ARTEX on 70 hosts. Censys also identified 32 ARTEX hosts with publicly accessible directories containing tools for different stages of cyberattacks.
Earlier in October, CrowdStrike linked ARTEX