[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fqo60APFx0bAvWseSNxsryYnJBbSbUvz218wdb6O6aKw":3},{"article":4,"iocs":50,"watch_terms":71,"solutions":72,"lesson":160},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":32,"category":33,"article_tags":37},"4960fb95-14bb-4440-9972-49400c51a33b","ARTEX AI Hacking Framework Found on 1,465 Public Servers, Some Hosting Cyberattack Tools","artex-ai-hacking-framework-found-on-1-465-public-servers-some-hosting-cyberattac-efebeb","Security researchers have found ARTEX, an AI-powered penetration-testing framework, exposed on 1,465 internet-facing hosts. Some servers also hosted command-and-control tools, phishing software, and exploit files, showing how automated security-testing platforms are appearing alongside established attack infrastructure. The findings offer defenders a view of these environments, including files operators left publicly accessible. The count does not […] The post ARTEX AI Hacking Framework Found on 1,465 Public Servers, Some Hosting Cyberattack Tools appeared first on Cyber Security News.","Security researchers discovered ARTEX, an AI-powered penetration-testing framework, exposed on 1,465 internet-facing hosts. Some of these servers also contained command-and-control tools, phishing software, and exploit files, indicating the integration of automated security-testing platforms with existing attack infrastructure. While public exposure doesn't confirm malicious intent, the findings provide defenders with insights into these environments and the tools operators leave accessible.","AI hacking framework ARTEX found exposed on 1,465 servers, some hosting attack tools.","https:\u002F\u002Fcybersecuritynews.com\u002Fartex-ai-hacking-framework\u002F","https:\u002F\u002Fcybersecuritynews.com\u002Fwp-content\u002Fuploads\u002F2026\u002F11\u002FARTEX-AI-Hacking-Framework-Found-on-1465-Public-Servers-Some-Hosting-Cyberattack-Tools.webp","2026-11-06T09:02:33+00:00","2026-11-06T10:00:28.710745+00:00",7,[17,20,23,25,28,30],{"name":18,"type":19},"ARTEX","product",{"name":21,"type":22},"AI","technology",{"name":24,"type":19},"ScopeSentry",{"name":26,"type":27},"Anthropic","vendor",{"name":29,"type":27},"OpenAI",{"name":31,"type":19},"CyberStrikeAI","e7b231c8-5f79-4465-8d38-1ef13aea5a14",{"id":32,"icon":34,"name":35,"slug":36},null,"Threat Intelligence","threat-intelligence",[38,43,48],{"category":39},{"id":40,"icon":34,"name":41,"slug":42},"02371804-cf6d-4449-98de-f1a2d4d9b266","Tools","tools",{"category":44},{"id":45,"icon":34,"name":46,"slug":47},"839da5c1-3c34-47e2-9499-f7201640e3ac","AI Security","ai-security",{"category":49},{"id":32,"icon":34,"name":35,"slug":36},[51,55,57,59,61,63,65,67,69],{"type":52,"value":53,"context":54},"malware","FRP","Malware found on ARTEX-exposed servers.",{"type":52,"value":56,"context":54},"Vshell",{"type":52,"value":58,"context":54},"Cobalt Strike",{"type":52,"value":60,"context":54},"Adaptix C2",{"type":52,"value":62,"context":54},"Gophish",{"type":52,"value":31,"context":64},"AI security tool found alongside ARTEX on ARTEX-exposed servers.",{"type":52,"value":66,"context":64},"PentAGI",{"type":52,"value":68,"context":64},"HexStrike AI",{"type":52,"value":70,"context":64},"RedAmon",[26,29,18],{"controls":73,"vendors":153},[74,103,125],{"slug":75,"name":76,"problem":77,"products":78},"vulnerability-management","Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",[79,87,95],{"vendor_slug":80,"vendor_name":81,"vendor_logo":82,"product_slug":83,"product_name":84,"url":85,"description":86},"holm-security","Holm Security","\u002Fvendor-logos\u002Fholm-security.png","holm-security-platform","Holm Security Platform","https:\u002F\u002Fwww.holmsecurity.com\u002F","Vulnerability scanning of systems, web applications, cloud and the external attack surface, plus phishing simulation.",{"vendor_slug":88,"vendor_name":89,"vendor_logo":90,"product_slug":91,"product_name":92,"url":93,"description":94},"tenable","Tenable","\u002Fvendor-logos\u002Ftenable.png","tenable-vulnerability-management","Tenable Vulnerability Management","https:\u002F\u002Fwww.tenable.com\u002Fproducts\u002Fvulnerability-management","Cloud-based vulnerability scanning and prioritisation, built on Nessus.",{"vendor_slug":96,"vendor_name":97,"vendor_logo":98,"product_slug":99,"product_name":100,"url":101,"description":102},"axonius","Axonius","\u002Fvendor-logos\u002Faxonius.png","axonius-exposures","Axonius Exposures","https:\u002F\u002Fwww.axonius.com\u002Fplatform\u002Fexposures","Brings findings from different scanners together with asset and business context, to show what matters most and track fixes to the end.",{"slug":104,"name":105,"problem":106,"products":107},"attack-surface-management","External attack surface management (EASM)","You find your forgotten internet-facing systems before attackers do.",[108,109,117],{"vendor_slug":80,"vendor_name":81,"vendor_logo":82,"product_slug":83,"product_name":84,"url":85,"description":86},{"vendor_slug":110,"vendor_name":111,"vendor_logo":112,"product_slug":113,"product_name":114,"url":115,"description":116},"palo-alto-networks","Palo Alto Networks","\u002Fvendor-logos\u002Fpalo-alto-networks.png","cortex-xpanse","Cortex Xpanse","https:\u002F\u002Fwww.paloaltonetworks.com\u002Fcortex\u002Fcortex-xpanse","External attack surface discovery and remediation.",{"vendor_slug":118,"vendor_name":119,"vendor_logo":120,"product_slug":121,"product_name":122,"url":123,"description":124},"runzero","runZero","\u002Fvendor-logos\u002Frunzero.png","runzero-platform","runZero Platform","https:\u002F\u002Fwww.runzero.com\u002Fplatform\u002F","Finds and fingerprints everything on the network and in the cloud, including IoT and OT devices, without agents or credentials, and flags exposures.",{"slug":36,"name":126,"problem":127,"products":128},"Threat intelligence","Attack campaigns reach your sector, suppliers or software before your team hears about them.",[129,137,145],{"vendor_slug":130,"vendor_name":131,"vendor_logo":132,"product_slug":133,"product_name":134,"url":135,"description":136},"reliaquest","ReliaQuest","\u002Fvendor-logos\u002Freliaquest.png","greymatter-digital-risk-protection","GreyMatter Digital Risk Protection","https:\u002F\u002Freliaquest.com\u002Fsecurity-operations-platform\u002Fdark-web-and-digital-risk-protection\u002F","Watches the open, deep and dark web for threats aimed at an organisation and alerts its security team in real time.",{"vendor_slug":138,"vendor_name":139,"vendor_logo":140,"product_slug":141,"product_name":142,"url":143,"description":144},"google","Google","\u002Fvendor-logos\u002Fgoogle.png","google-threat-intelligence","Google Threat Intelligence","https:\u002F\u002Fcloud.google.com\u002Fsecurity\u002Fproducts\u002Fthreat-intelligence","Threat intelligence from Mandiant's frontline investigations, Google's threat analysts, open sources and Google's own visibility, in one service.",{"vendor_slug":146,"vendor_name":147,"vendor_logo":148,"product_slug":149,"product_name":150,"url":151,"description":152},"dataminr","Dataminr","\u002Fvendor-logos\u002Fdataminr.png","agentic-threat-intelligence-platform","Agentic Threat Intelligence Platform","https:\u002F\u002Fwww.dataminr.com\u002Fproducts\u002Fcyber-defense\u002Fagentic-threat-intelligence-platform\u002F","Threat intelligence platform, formerly ThreatConnect TI Ops, that collects, scores and structures intelligence and pushes it into security tools.",[154],{"slug":155,"name":156,"logo_path":157,"roles":158},"censys","Censys","\u002Fvendor-logos\u002Fcensys.png",[159],"reported_by",{"slug":161,"title":162,"body":163,"framework_refs":164,"framework_notes":172},"ai-hacking-framework-artex-exposed-on-1465-public-servers","AI Hacking Framework ARTEX Exposed on 1,465 Public Servers","ARTEX, an AI-powered penetration-testing framework, was found openly accessible on over 1,400 internet-facing servers, with some co-hosting command-and-control tools, phishing kits, and exploit files. The root issue is poor configuration management: operators failed to restrict public access to sensitive security tooling, effectively handing adversaries a window into their infrastructure and attack capabilities. Whether used by red teamers or malicious actors, exposing such tools without authentication or network controls is a critical operational failure. This matters because dual-use security tools left unprotected can be discovered, hijacked, or replicated by threat actors to accelerate their own campaigns.",[165,166,167,168,169,170,171],"CIS Control 7: Continuous Vulnerability Management","CIS Control 12: Network Infrastructure Management","NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control","ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities","MITRE ATT&CK T1566: Phishing","NIST SP 800-53 SI-2: Flaw Remediation","NIS2 Article 21(2)(b)",{"NIS2 Article 21(2)(b)":173,"MITRE ATT&CK T1566: Phishing":174,"NIST SP 800-53 SI-2: Flaw Remediation":175,"CIS Control 12: Network Infrastructure Management":176,"CIS Control 7: Continuous Vulnerability Management":177,"ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities":178,"NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control":179},"NIS2 requires operators of critical services to implement risk-proportionate security measures including access controls, which would obligate organizations to prevent public exposure of sensitive security infrastructure like ARTEX.","The discovery of phishing software co-located on the exposed servers confirms active attack staging; network controls limiting public exposure would have disrupted this infrastructure.","A flaw remediation process requiring timely identification and correction of configuration weaknesses would have addressed the misconfiguration exposing these servers to the public internet.","Proper network segmentation and infrastructure controls would have prevented penetration-testing frameworks from being reachable from the public internet in the first place.","Regular vulnerability and exposure scanning would have detected ARTEX and associated tools publicly accessible on these hosts, triggering remediation before adversaries could exploit or weaponize the exposure.","A formal process for identifying and remediating technical vulnerabilities and misconfigurations—including publicly exposed tooling—would have flagged these servers before external researchers did.","Applying authentication and access control to all internet-facing services would have blocked unauthenticated public access to the ARTEX framework instances discovered by researchers."]