{
  "id": 18640530,
  "title": "Censys Found 1,465 Exposed Artex AI-Attack Consoles. A Page Title Gave Them Away",
  "url": "https://urgent.news/2026/11/07/censys-found-1-465-exposed-artex-ai-attack-consoles-a-page-title-gave",
  "topic": "ai",
  "section": "AI",
  "published": "2026-11-07T05:01:24.000Z",
  "source": {
    "name": "Dev.to",
    "slug": "dev-to",
    "url": "https://dev.to/gabrielanhaia/censys-found-1465-exposed-artex-ai-attack-consoles-a-page-title-gave-them-away-l9p"
  },
  "original_language": "en",
  "account": "Censys identified 1,465 exposed Artex AI-attack consoles on the open internet as of November 4, 2026. Artex is an open-source, LLM-driven autonomous penetration testing framework that runs a web console. A page title with \"ARTEX\" appeared to be the key indicator of these exposed consoles. The consoles are accessible without a password and are running in about 815 distinct deployments worldwide, with the majority located in the United States. The consoles often co-exist with other threat software, such as CyberStrikeAI, Vshell, Cobalt Strike, and Adaptix C2. Some exposed consoles contain post-exploitation kits, stagers, and implants, including .ssh and .bash_history files. The consoles were found through ordinary web scanning techniques, as the page title and Next.js static assets were used to fingerprint them. 43 of the exposed consoles also ran self-hosted LLM gateway or reseller software, predominantly CLIProxyAPI and New API. If an organization notices unfamiliar LLM proxies or resellers in their egress logs, it should be investigated.",
  "summary": "Book: Observability for LLM Applications Also by me: Thinking in Go (2-book series) — Complete Guide to Go Programming + Hexagonal Architecture in Go My project: Hermes IDE | GitHub — an IDE for developers who ship with Claude Code and other AI coding tools Me: xgabriel.com | GitHub The AI agent framework behind two of October's intrusion campaigns runs a web console, and a lot of those consoles…",
  "key_points": [],
  "editors_take": "The widespread exposure of these autonomous penetration testing consoles creates significant security risks by allowing unauthorized access to sensitive post-exploitation kits and command-and-control software through simple web scanning.",
  "illustration": null,
  "coverage": {
    "outlets": 1,
    "also_reported_by": []
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}