Censys Finds 1,465 Exposed Artex AI Attack Consoles Identified by Page Title

Censys reported on November 4, 2026 that it observed 1,465 hosts running an exposed console for Artex, an open-source LLM-driven autonomous penetration testing framework. The framework has been linked by Microsoft and others to recent intrusion campaigns, including a ConnectWise supply-chain compromise and an intrusion into WorkOS's sales tool. Roughly 650 of the hosts sit in two blocks of identically configured hosting, and Censys notes that some may be run by authorized testers. About one in ten hosts also ran other detected threats, and some exposed open directories containing session histories and configuration files. Censys located the consoles by matching HTML page titles beginning with "ARTEX" and Next.js static asset references, noting that customized consoles with different titles would not be captured.