AI Hacking Tool ARTEX Is Spreading Far Beyond Known Attacks, Censys Warns

ARTEX is an open-source framework that uses AI models to carry out penetration testing with little human input. It was released on GitHub in July 2026 and can be connected to large language models. A new report from internet scanning provider Censys estimates that criminals are using it much more widely than the campaigns identified so far.

Those known campaigns are significant. In early October, CrowdStrike linked ARTEX, used alongside Anthropic's Claude model, to attacks on South Korean financial institutions. Later that month, Microsoft tied it to a large-scale compromise of ConnectWise customer tenants, which led the IT management software provider to take some cloud services offline. Microsoft attributed that activity to Storm-0940, a China-state-aligned group. On November 4, India's CERT-In warned financial and cryptocurrency organisations that a group called Crafty Falcon was using ARTEX among several AI-powered tools.

The creator removed the original repository in October, saying the tool was meant for authorised testing only. However, community forks keep it in circulation, including ScopeWeaver and a commercial version called ARTEX PRO. Check Point researchers found that AI agents in ARTEX control panels can run large-scale attacks for just a few hundred dollars, although they still fail and sometimes falsely report success.