Censys finds 1,465 hosts exposing the ARTEX AI hacking console
Announced · Published · By Contractor AI Shop
Censys found 1,465 internet-facing hosts running the ARTEX AI hacking console as of Nov 4. About 650 sit in two identically configured hosting blocks (~815 distinct deployments); 155 (10.6%) also run other threat tooling.
Key facts
- As of Nov 4, 2026, Censys observed 1,465 hosts running an exposed ARTEX console (open-source AI-agent pentest framework). Censys (Silas Cutler)
- About 650 of those hosts sit in two blocks of identically configured hosting, which leaves roughly 815 distinct-looking deployments. Censys (Silas Cutler)
- 155 ARTEX hosts (10.6%) also run at least one other threat that Censys detects. Censys (Silas Cutler)
- Censys notes some exposed hosts are used for authorized testing; overall global deployment is likely higher because the console does not require public-facing access. Censys (Silas Cutler)
- Security press (TechCrunch, Infosecurity) covered the Censys findings on Nov 6. TechCrunch (Zack Whittaker)
Our take: what it means for contractors
Self-hosted AI agents left open on the internet expose both the operator and their targets. Same lesson for anyone running a local agent stack: don't put the console on a public port.
What we don't know yet
- How many exposed hosts are authorized testers vs. attackers
- Whether operators have since closed the consoles after the Nov 5 report
Sources
- Censys (Silas Cutler) · ARTEX: Agentic Asbestos · 2026-11-05 · Primary
- TechCrunch (Zack Whittaker) · Hundreds of Artex AI hacking tools found publicly exposed to the web · 2026-11-06 · Secondary
- Infosecurity Magazine (Kevin Poireault) · ARTEX Offensive AI Tool Activity Far Exceeds Reported Campaigns, Censys Finds · 2026-11-06 · Secondary