How ARTEX spread: A new name every week
ARTEX is an autonomous, multi-agent AI penetration testing and offensive framework. It’s also open-source – and went from a GitHub release to in-the-wild attacks in under three months.
CrowdStrike tied it to intrusions at South Korean financial institutions on October 7, and Microsoft tied it to Storm-0940’s ConnectWise supply-chain compromise two weeks later (read the Censys ARC writeup). Another tool, Cairn, followed a similar arc. Forks and rebrands such as ScopeWeaver were circulating before the original ARTEX repository came down.
The origin story is murkier than “hobbyist tool gets abused.” On October 16, the Chinese security vendor ThreatBook said ARTEX began as a personal project by its RedAgents product lead, and acknowledged that the open-source version had been misused in major financial-sector incidents while lacking built-in security controls.
Two weeks before that, ThreatBook had acquired CyberStrikeAI outright, citing 6,600 GitHub stars and deployments in more than 2,300 networks. CyberStrikeAI is the other offensive framework Censys most often finds running beside ARTEX. So the two agentic attack tools that most often share a server also share a link to one company, which bills itself as China’s first threat intelligence vendor.
For most of a year, AI-accelerated offense was a worry without nouns. Now it has a vocabulary, and security leaders are about to receive lists of these names with one question attached: are we seeing any of this?
Answering that takes three facts about the Internet infrastructure: where it lives today, what it looked like last month, and what else runs beside it. An intel feed assembled from other vendors’ blog posts can only be as current as… the last blog post. The current state of the threat landscape must come from someone who scans the Internet directly.
Seven weeks before the report
CrowdStrike found its ARTEX operator through an open directory at 38.244.50[.]120:18899 that exposed a .claude folder, prompts, session histories, and ARTEX configuration files. Censys scan history shows that directory serving files starting August 18, 2026, seven weeks before the report went public (you could’ve found it yourself with Censys Enterprise). The file names in that directory also show the actor lining up payment and gaming services, well beyond the South Korean banks the report focused on.
Anyone whose intel came from reading that report learned about the host in October. Anyone querying the host directly could have watched it in August. The gap shows up today, too. New example:
Censys scores host at 43.255.159[.]10 as malicious despite no malicious flags from vendors on its IP or associated DNS resolution.
Censys flags new hosts every day with working attack consoles on them right now. A reputation lookup scores it as clean if no one has scanned it or written about it yet.
The churn makes this worse. ARC counted 32 open directories on ARTEX hosts during its research, and most lived for hours to a couple of days. Between November 3 and 5, ten closed and fifteen new ones appeared. A feed that refreshes when vendors publish never sees most of them.
What scanning it yourself buys
Plenty of threat intel is secondhand. Indicators are scraped from vendor reports, sandbox runs, and community submissions, then repackaged with a score. Each hop adds lag. Of the seven phishing domains Microsoft published for an RMM-abuse campaign in September, some were gone within a week. Blocklists built from them were partly blocking empty lots.
Censys ARC writes fingerprints of AI attack tools against the Censys Internet Map, which Censys builds by scanning and actively resolving DNS.
When we shipped the ARTEX label, for example, it landed on every matching host and web property at once (1,465 hosts) — and it keeps landing as new scans come in.
Adoption is climbing fast enough that the count a week from now will likely look different.
History matters because operators clean up. The Internet Map keeps four years of scan history queryable, so the file listing from a directory that closed on Tuesday is still readable on Friday. Responders can ask what an IP served while the attacker was inside, instead of what it serves after they left. That memory spans campaigns, too.
The map in Internet Map matters, too. A threat label sits on the same record as the host’s ports, certificates, DNS, JARM, web servers, open directory contents, ASN, and every other detection. This is foundational to a pivot that discovers the rest of the campaign. That’s how ARC found, in early November, that 155 of the 1,465 ARTEX hosts also ran another detected threat (Cobalt Strike, Adaptix C2, Vshell among them), and that 43 ran self-hosted LLM gateways such as CLIProxyAPI and New API.
ARTEX isn’t alone: The rest of the roster
Censys ARC fingerprints the agentic attack frameworks below and watches for new ones. Not every console belongs to a criminal; some are run by authorized testers. New frameworks and forks are appearing faster than the headlines can name them, and ARC adds fingerprints as they surface.
| Family | What is public |
| ARTEX | LLM-driven autonomous pentest framework in Go with a Next.js console, default port 8787. Attributed in October 2026 by CrowdStrike and Microsoft. |
| ScopeWeaver | Rebrand of ARTEX, circulating after the original repository was pulled. |
| CyberStrikeAI | AI pentest platform. The most common companion to ARTEX: 70 shared hosts. |
| PentAGI | Autonomous pentest agent. Seen with ARTEX, including beside a Cobalt Strike teamserver at 1.14.104[.]208. |
| HexStrike AI | AI attack framework seen co-located with ARTEX. |
| RedAmon | AI attack framework seen co-located with ARTEX. |
| Cairn | Open-source multi-agent engine abused against 100+ organizations; found because operators left panels exposed (CSA research note). |
Censys Platform query for every tracked family:
host.services.threats.name: {"ARTEX", "ScopeWeaver", "CyberStrikeAI", "PentAGI", "HexStrike AI", "RedAmon", "Cairn"}
or web.threats.name: {"ARTEX", "ScopeWeaver", "CyberStrikeAI", "PentAGI", "HexStrike AI", "RedAmon", "Cairn"}
Keying on page structure is what catches the variants: consoles localized into English, Korean, Japanese, Russian, and Portuguese beside the Chinese default, and renamed builds such as ARTEX MX and ARTEX v2 · Agent Security Workbench.
Also: Agents keep diaries
Coding agents write their context to disk: CLAUDE.md, AGENTS.md, GEMINI.md, a .claude/ folder of settings and session history, .mcp.json server configs. An operator who drives an attack framework through one of these agents leaves the files in the working directory. Then a short-lived Python HTTP server on a high port exposes that directory to anyone who asks, which is how CrowdStrike’s ARTEX actor got caught.
Those files hold the operator’s instructions in plain language: targets, scope, model endpoints, occasionally credentials.
Censys flags every suspicious host on the public Internet; narrowed to agent artifacts:
host.reputation.score > 0.5
and host.services.endpoints.open_directory.files: (name=~"(?i)^(claude\\.md|agents\\.md|gemini\\.md|\\.claude|\\.cursor|\\.codex|\\.mcp\\.json)$" or path=~"(?i)/\\.(claude|cursor|codex)/")
Putting it to work
- CTI. Save the roster query as a Collection and push it to your TIP over webhook (how). When a vendor publishes on a new framework, hand the report to Censys Investigator and let it expand the listed indicators into the cluster behind them.
- SOC triage. Zero reputation hits does not mean clean. Before closing an escalation, check what Censys knows about IPs or domains.
- DFIR. Query the window the attacker was inside your environment. Directories that closed after the intrusion still show their file listings in scan history.
- Detection engineering. Anchor on signals that cost the operator effort to change: the console fingerprint, port 8787, LLM proxies such as CLIProxyAPI on the same host. IPs rotate cheaply; deployments get rebuilt far less often. Scan history adds an earlier tell:
mitmproxybanners and short-lived Python HTTP servers on high ports often appear on a host before the ARTEX console does. - Network security. Watch egress for unfamiliar LLM gateways and API resellers; CrowdStrike’s actor bought model access through one. Then check your own ranges. Some of those 1,465 consoles belong to somebody’s red team, and a few belong to somebody who forgot.
- Exposure and Attack Surface Management. AI-assisted frameworks make it easier to probe your environment at scale. Continuously monitor what attackers can reach across your organization, and close consoles and services that should not be public.
ScopeWeaver was circulating before the ARTEX repository even came down, and the next framework will arrive with its own name and news cycle. It will still need a console that answers HTTP, and its operators will still leave directories open.
As AI lowers the expertise and cost required to launch attacks, new vibe-coded frameworks and forks will keep coming. When the next list of names lands in your inbox, ask your intel provider when they first saw the infrastructure, and ask them to show you the scan.
References
- Censys ARC, ARTEX: Agentic Asbestos
- Censys, Censys Is The OmniFeed: Crunch Your Own Threat Intelligence
- Censys, Censys AI Agents: Automate Investigations and Amplify Your Threat Intel
- Cloud Security Alliance, Detecting Autonomous Agent Intrusion Campaigns (Cairn)
- SecurityWeek, AI Platform Cairn Abused to Hack Over 100 Organizations
