Censys says it found 1,465 systems with publicly exposed ARTEX control panels in early November 2026, representing roughly 815 distinct-looking deployments after setting aside systems with matching server setups. ARTEX is an AI-driven framework for testing computer systems for security weaknesses. Source
In its November 5 report, Censys said ARTEX’s control panel doesn’t need to be accessible from the public internet. TechCrunch subsequently reported that more than 800 deployments were accessible without a login password, potentially allowing outsiders to misuse the tool. Why hundreds of control panels were exposed remains unclear. Source Source
Censys’s published findings don’t document login checks or establish that outsiders could control every deployment. Neither report establishes that outsiders took over these installations to launch attacks. Source Source
Hundreds of deployments, not hundreds of confirmed attackers
Released as open-source software in July 2026, ARTEX lets an operator set a goal, then uses a planning agent and worker agents to choose actions, run tools and feed results back into a repeating workflow. The operator doesn’t have to direct every step. Source
About 650 of the systems Censys observed were clustered in two hosting networks with repeated configurations. Those patterns suggest reused server setups rather than hundreds of separate operators; excluding those systems leaves roughly 815 distinct-looking deployments. Neither figure establishes how many independent people were running ARTEX. Source
Censys says some exposed installations likely belong to authorized security testers. A public control panel is an exposure finding, not a confession. Source
The attack tools were on display, too
Censys also found 32 publicly accessible folders on systems hosting ARTEX, exposing tools for delivering code, maintaining access to compromised systems and moving between computers on a network. The files included scripts for running commands remotely. Those remote-access tools were themselves open to visitors, though their presence doesn’t prove they were used against a victim.
