Censys Found 1,465 Exposed Artex AI-Attack Consoles. A Page Title Gave Them Away
Book: Observability for LLM Applications Also by me: Thinking in Go (2-book series) — Complete Guide to Go Programming + Hexagonal Architecture in Go My project: Hermes IDE | GitHub — an IDE for developers who ship with Claude Code and other AI coding tools Me: xgabriel.com | GitHub The AI agent framework behind two of October's intrusion campaigns runs a web console, and a lot of those consoles…
Censys identified 1,465 exposed Artex AI-attack consoles on the open internet as of November 4, 2026. Artex is an open-source, LLM-driven autonomous penetration testing framework that runs a web console. A page title with "ARTEX" appeared to be the key indicator of these exposed consoles. The consoles are accessible without a password and are running in about 815 distinct deployments worldwide, with the majority located in the United States.
The consoles often co-exist with other threat software, such as CyberStrikeAI, Vshell, Cobalt Strike, and Adaptix C2. Some exposed consoles contain post-exploitation kits, stagers, and implants, including .ssh and .bash_history files. The consoles were found through ordinary web scanning techniques, as the page title and Next.js static assets were used to fingerprint them.
43 of the exposed consoles also ran self-hosted LLM gateway or reseller software, predominantly CLIProxyAPI and New API. If an organization notices unfamiliar LLM proxies or resellers in their egress logs, it should be investigated.
Written by urgent.news from Dev.to's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
