ARTEX left 1,608 live autonomous hacking panels exposed online

Security researchers gained an unusual view inside ARTEX, an open-source platform that coordinates AI agents for penetration testing and, increasingly, real attacks. The exposure began with public administration panels rather than a sophisticated intrusion.

Open panels revealed both the tool and its operators’ work

Check Point found 2,557 systems that hosted or had hosted ARTEX. At the time of the research, 1,608 instances were live and publicly reachable. Ten misconfigured systems exposed their full databases, including operator prompts, selected models and the steps taken by agents.

ARTEX began as a Chinese open-source platform for authorized penetration testing. Its developer moved to a closed-source model on October 8 after reports of attacks on South Korean banks, but copies and forks remain available. The public panel count does not reveal how many belong to criminals. Defenders and researchers may operate some of them.

Agents turned the attacker from driver into goal setter

The exposed databases show a different workflow. Operators often set an objective and later asked for progress, while agents searched for vulnerabilities, attempted access and moved across targets. In one campaign against iOS certificate shops, agents obtained more than 300 certificates, three of which passed full validation.

The techniques were mostly familiar. Agents used weak passwords, missing authentication, credentials embedded in front-end code and common web vulnerabilities. The change is speed and persistence: one person can leave a fleet testing many applications without directing every step.

Autonomy scales mistakes as efficiently as attempts

Another observed campaign processed 167.5 million tokens, generated 400,791 agent messages and targeted 292 cryptocurrency-related objectives. The attacker still earned $0. Some agents treated a successful API response as a successful transfer even though the wallet remained empty.

That does not make the activity harmless. During the failed pursuit of money, agents found databases, personal information and credentials for cloud storage. The ten exposed databases are also a convenience sample of misconfigured servers, not a representative sample of all 1,608 public instances.

Defenders must remove cheap weaknesses before agent fleets find them

The next signals are whether the public panel count falls after disclosure and whether campaigns move from opportunistic scanning to more targeted operations. The gap between vulnerabilities found and real-world impact will matter as well.

The immediate defenses are remarkably ordinary: multifactor authentication, secrets kept out of client code, authenticated APIs and prompt patching of public services. ARTEX has not repealed basic security hygiene. It has shortened the time that neglect can remain consequence-free.

Lilith's verdict

A thief once had to pick locks one by one. With ARTEX, the operator sets a goal, goes to sleep and reads reports from hundreds of agents in the morning. Their mistakes are funny only until one finds a production API without a password.