# AI Penetration Testing Tool ARTEX Sees Rapid Global Expansion

*Published November 9, 2026*
*Source: [https://www.infosecurity-magazine.com/news/artex-activity-exceeds-reported/](https://www.infosecurity-magazine.com/news/artex-activity-exceeds-reported/)*

## Executive Summary

Censys research has found that the use of the ARTEX AI penetration testing tool is much broader than initially reported, with 1465 hosts worldwide exposing its console. The tool has been linked to several high-profile cyber campaigns, indicating a rapid expansion and adoption among threat actors.

*This is a Premium edition: its actionable insights are available to sec-news.ai Premium members —*
*[read the story](https://www.sec-news.ai/news/ai-penetration-testing-tool-artex-sees-rapid-global-expansion) or [see plans](https://www.sec-news.ai/pricing).*

## Article

Research from Censys has revealed that the ARTEX AI-powered penetration testing tool is being used far more broadly than initially reported. Released as an open-source project on GitHub by a user known as Autumn-27 in July 2026, ARTEX is designed for autonomous security testing. However, it has quickly become a tool of choice for cybercriminals, expanding beyond the few campaigns that were first identified.

The tool was linked to several high-profile operations in October. In early October, CrowdStrike identified its use in an attack on South Korean financial institutions, where it was employed alongside Anthropic's Claude AI model. Later that month, Microsoft connected ARTEX to a large-scale compromise of ConnectWise customer tenants, attributing the attack to a China-state-aligned group known as Storm-0940. In November, CERT-In warned that a group called Crafty Falcon targeted financial and cryptocurrency sectors using ARTEX among other AI-driven tools.

Although the original ARTEX GitHub repository was taken down due to misuse, the framework continues to spread through community forks. Censys research identified 1465 hosts worldwide with ARTEX consoles exposed to the internet. This widespread presence contradicts earlier assumptions that ARTEX was limited to a few isolated systems. Additionally, 155 of these hosts were found running other malicious artifacts, indicating a sophisticated network of AI-driven cyber tools.

ARTEX is also sharing infrastructure with other AI penetration-testing tools like CyberStrikeAI and PentAGI. The Crafty Falcon campaign saw ARTEX used alongside these tools, revealing a trend of deploying multiple frameworks together. The rise of AI in offensive operations is further evidenced by the 43 ARTEX hosts found running self-hosted LLM gateway software, highlighting the integration of AI models into attack infrastructures.