ARTEX AI Pentesting Platform: How It Works and Why Defenders Should Care

No fluff. Just the config that works.

Executive Summary

Objective: Explain what the ARTEX AI pentesting platform is, how its agents plan and run an intrusion, how threat actors have turned it against real organizations, and what defenders should change because of it. This is the “know your enemy” post. Deployment and hands-on use come in a follow-up post.

Target audience: Security engineers, SOC analysts, network and firewall admins, and red teamers who need to brief leadership or customers on agentic AI attack tooling.

In four months, ARTEX went from a GitHub repo for authorized testers to a tool named in reports from CrowdStrike, Microsoft, Google, Check Point and Censys. The attacks it runs are not new. The speed and the lack of required skill are.

Prerequisites and Architecture

Assumed knowledge: Basic penetration testing phases (recon, exploitation, post-exploitation), how LLM APIs are called, Docker basics, and familiarity with web vulnerabilities such as RCE.

Lab requirements for this post: None. This is a reference post. The hunting commands near the end run against your own assets only, using lab addressing 198.18.0.0/15 for internet-facing hosts and 10.0.0.0/16 for internal LANs.

What Is the ARTEX AI Pentesting Platform?

ARTEX is an open-source autonomous penetration testing framework published on GitHub on July 26, 2026 by a Chinese developer who goes by Autumn-27. The same author maintains ScopeSentry, an asset discovery and vulnerability scanning platform, and ARTEX layers decision-making AI agents on top of that discovery base. It shipped under the AGPL-3.0 license with a one-line Docker install.

The stated purpose was legitimate: let a security team point a crew of AI agents at systems it owns or is authorized to test, and get back evidence-backed findings. The default example goal in the task form is reaching an admin panel or gaining server privileges.

Then it showed up in real intrusions. On October 8, 2026, after reporting tied it to attacks on South Korean banks, the developer announced the project would go closed source with no further updates. That did not put the genie back in the bottle. Forks, backups, renamed copies and a commercial edition called ARTEX PRO keep circulating.

How ARTEX Works: Planner, Workers and Two Graphs

Figure 1: ARTEX architecture: operator console, planner agent, worker agents, tools, dual graphs and LLM backends

The loop is simple, which is exactly why it scales:

1. Task definition. The operator enters scope (domains, IP ranges), any test accounts, and a goal in plain language.
2. Planning. The planner agent reads the goal and the current state of the graphs, then emits intents such as “enumerate subdomains of the target” or “test this login form for SQL injection.”
3. Execution. Worker agents claim intents and run real tools: Bash, Nmap, curl, HTTP clients, ripgrep. Traffic passes through a recording proxy so every request and response is kept as evidence.
4. Write-back. Results land as facts and findings in the exploration graph, and any new hosts or services land in the shared asset graph. Anchors link each intent to the assets it touched.
5. Re-plan. The planner sees the new facts and issues the next intents. Workers can search each other’s transcripts so parallel branches do not duplicate work.

That loop runs until the goal is met, the operator intervenes, or the token budget runs out. In one VAPOR PANDA intrusion, the planning agents alone consumed roughly 1.4 billion input tokens.

Why the dual graph matters

Most “AI hacking” demos are a chatbot with a shell. ARTEX keeps two separate memories. The asset graph is global, so recon from one engagement feeds the next. The exploration graph is per task, so each goal keeps its own lineage of what was tried and why. For an attacker running dozens of targets at once, that is the difference between a script and a team.

Why the browser extension matters

Traditional proxies such as Burp break on certificate pinning and struggle with CAPTCHA, OAuth and 2FA. ARTEX sidesteps that by capturing traffic from a real, already-authenticated browser session. If a human (or a stolen session) gets past the login once, the agents inherit that position.

Timeline: From GitHub Repo to Nation-State Tooling

The Threat in Practice: Four Campaigns

1. South Korean financial organizations

CrowdStrike found the operator’s own open directories, holding Claude Code session histories, ARTEX configuration files and Claude memory files. The ARTEX instance ran on DeepSeek v4.1-flash, likely bought through an LLM API reseller, with GLM-5.3 and Grok 4.6 used in additional Claude Code sessions. CrowdStrike assessed the actor as a financially motivated Chinese speaker with moderate confidence. The session logs even show the operator asking where Korean breach data is usually sold.

2. Storm-0940 and ConnectWise Cloud Backup

Microsoft says the China state-aligned group Storm-0940 used ARTEX as early as September 2026 to automate scanning, password spraying and OAuth application abuse. During the ConnectWise supply chain compromise, the group reached more than 2,250 tenants at 2,900 sign-in attempts per minute, and some intrusions reached privileged cloud access in under three hours.

3. VAPOR PANDA

CrowdStrike tracked the China-nexus group VAPOR PANDA running ARTEX mainly on DeepSeek, plus a second commercial model it could not identify, against more than 200 organizations in at least 14 countries in under two weeks. Post-exploitation was confirmed at nine. A human operator issued instructions in Chinese and stepped in at decision points, running several engagements at once.

4. Check Point: cybercrime on autopilot

Check Point Research read the databases of 10 misconfigured ARTEX consoles and found operators mostly set a goal and then just checked progress. The agents did the rest:

• iOS app-signing services: more than 300 signing certificates and their passwords stolen.
• Gaming marketplaces: 13 targeted, more than 190,000 Honor of Kings credentials taken, with about 3.3% estimated to still work.
• Crypto-related domains: 292 targeted. An unauthenticated API exposed AWS keys with write access to an S3 bucket of iOS app distribution files, and the agents modified them.

Two details stand out. Some agent-reported “cashout successes” were hallucinations based on API responses that only looked like success. And the only model whose guardrails fired was Opus 5.5, after which the operator simply switched to a more permissive Chinese model.

What Changes, and What Doesn’t

Google’s read is the right one: the techniques are the same old ones, compromised credentials and unpatched systems. What changes is speed and scale.

Three takeaways for defenders:

• The skill floor dropped. Check Point’s conclusion is that these systems let attackers move at unprecedented speed without deep technical knowledge.
• Model guardrails are not a control you own. ARTEX is model-agnostic, and operators switch providers the moment one refuses.
• Exposure windows shrink to hours. An internet-facing RCE that sits unpatched over a weekend is now probed, exploited and pivoted on by software that never sleeps.

The Tool Is Exposed, Too

ARTEX operators are not great at OPSEC. Censys counted 1,465 hosts exposing an ARTEX console as of November 4, roughly 815 distinct deployments once two identically configured hosting blocks are removed. Check Point counted 1,608 live panels at the time of its research. The console does not need to be public at all, so real deployment is likely higher.

• Geography (Censys): United States 726, Hong Kong 387, China 177.
• Co-located tooling: 155 hosts (10.6%) also run other threats Censys tracks, including CyberStrikeAI, PentAGI, HexStrike AI, Cobalt Strike, Vshell and Adaptix C2.
• LLM resellers: 43 hosts also run self-hosted LLM gateway or reseller software such as CLIProxyAPI and New API.
• Open directories: 32 hosts exposed post-exploitation kits, stagers and implants.

Censys says some of these hosts are likely authorized testers. Do not assume every console is hostile.

The backdoored Docker image

When the original repo went dark, people went looking for copies. One widely starred fork changed a single line in docker-compose.yml to pull the Docker Hub image tomicdd/artex. According to the researcher who found it, a hidden routine in the login handler checks the CAPTCHA field, and if the value starts with a secret marker, the rest runs as root via sh -c before any credential check. The source code in the fork was clean, so it would never show up in a code review. The image saw roughly 9,000 pulls, and 62 internet-facing consoles served the backdoored build between November 2 and 4.

Defending Against Agentic Attacks

None of the controls below are new. The difference is that they now have to hold at machine speed, every time.

Virtual patching for internet-facing apps

If an app cannot be patched tonight, put an IPS sensor focused on server-side signatures on the inbound policy that publishes it. Replace the placeholders with your values.

config ips sensor
    edit "PUBLIC-APPS-VPATCH"
        set comment "Virtual patching for internet-facing apps"
        config entries
            edit 1
                set location server
                set severity medium high critical
                set status enable
                set action block
            next
        end
    next
end
config firewall policy
    edit <INBOUND_VIP_POLICY_ID>
        set utm-status enable
        set ips-sensor "PUBLIC-APPS-VPATCH"
    next
end

GUI verification: Security Profiles > Intrusion Prevention shows the sensor, and the inbound VIP policy lists it under Security Profiles. Log & Report > Intrusion Prevention starts showing blocked events once probes arrive.

Verification and Validation: Hunting for ARTEX

Run these against assets you own or are authorized to assess.

Find exposed consoles in your own address space

ARTEX defaults to TCP 8787 (Censys also saw it on 8790, 443 and 80). Shadow red-team or contractor deployments are a real risk.

nmap -Pn -sV -p 8787,8790 --open 198.18.0.0/24
curl -s http://198.18.0.10:8787/ | grep -io "artex" | head -1

Expected success output: no open hosts on 8787 or 8790, and no “artex” string in any response. An unexpected hit means find the owner, take it off the internet, and check the image source.

Hunt for backdoored images and compose files

docker images --digests | grep -iE "artex"
grep -rnE "tomicdd/artex|congdonglinux/artex|trhhubsd" \
  --include="*.yml" --include="*.yaml" /srv /opt

Expected success output: no matches. If tomicdd/artex or congdonglinux/artex appears, isolate the host, rebuild from known-good media, and rotate every credential the console stored or could reach, including LLM API keys.

Host indicators from reported intrusions

Reporting on VAPOR PANDA lists artx or artex in command-line parameters, cloud role names starting with artx, admin-command comments starting with art18-, and an artx5v directory under Windows ProgramData.

Get-ChildItem C:\ProgramData -Directory -Filter "artx*"
Get-CimInstance Win32_Process |
  Where-Object { $_.CommandLine -match "artx|artex" } |
  Select-Object ProcessId, CommandLine

ps -eo pid,args | grep -iE "artx|artex" | grep -v grep

Expected success output: no results. Hits warrant a full incident response engagement, not a cleanup.

Network IOCs from the South Korean campaign

CrowdStrike listed the ARTEX host 38.244.50[.]120 (open directory on port 18899) and the LLM reseller domain xcai[.]pro. IOCs like these age fast; use them for retro-hunting in FortiAnalyzer or your SIEM, not as your primary control.

Troubleshooting and Gotchas

Gotcha 1: “We blocked DeepSeek, so we’re fine”

ARTEX talks to Anthropic, OpenAI, any OpenAI-compatible endpoint, local Ollama models, and resellers that proxy all of them. The model runs on the attacker’s infrastructure, not yours. Blocking AI vendors at your egress does nothing against an inbound attack. Spend the effort on patch velocity and identity controls instead.

Gotcha 2: A scanner hit on 8787 is not proof of an attacker

Censys explicitly notes that some exposed consoles belong to authorized testers, and port 8787 is used by other software too. Before escalating, confirm the response actually contains ARTEX markers, then identify the owner. If it is your own red team or a contractor, the finding is still real: the console should not be public.

Gotcha 3: Spray detection tuned for humans misses machines

A rule that fires on 10 failures in 5 minutes from one IP sees nothing when an agent spreads 2,900 attempts per minute across thousands of tenants, accounts and proxy IPs. Correlate on the target side (many accounts, few attempts each, short window) and alert on successful logins that follow a spray burst, plus any new credentials added to apps or service principals.

What’s Next

The follow-up post will deploy ARTEX in an isolated lab, safely: digest-pinned image from a vetted source, console bound to localhost behind a VPN, a scoped target VM in 10.0.0.0/16, and a walkthrough of what the planner and workers actually do on the wire. Seeing it from the operator’s chair is the fastest way to build detections for it.

Sources

• CrowdStrike: Unknown Threat Actor Uses AI-Driven ARTEX to Target South Korean Finance
• Cloud Security Alliance: Trojanized Offensive AI Tooling, The ARTEX Docker Backdoor
• Let’s Data Science: Check Point Details Autonomous ARTEX Attacks by Cybercriminals
• eSecurity Planet: ARTEX Cyberattacks, AI Agents Steal Credentials and Signing Certificates
• Let’s Data Science: Censys Finds 1,465 Exposed Hosts Running ARTEX
• Infosecurity Magazine: ARTEX Offensive AI Tool Activity Far Exceeds Reported Campaigns, Censys Finds
• LabMemo: Censys ARTEX exposure analysis (Japanese)
• Let’s Data Science: ARTEX AI Hacking Framework Spreads to Another China-Linked Group (VAPOR PANDA)
• Silicon UK: Microsoft Ties ConnectWise Attack to Storm-0940 and ARTEX
• Let’s Data Science: Google Says Threat Actors Abuse ARTEX Agentic Pentesting Frameworks
• jwatte.com: How ARTEX Works, A Defender’s Guide to Agentic Attacks
• Hermes AI: Open-Source ARTEX Turns AI Agents Into Autonomous Hacking Teams