![ARTEX Hacking Tool: 1,465 Exposed Hosts, 12K Forks [2026]](https://shattered.io/wp-content/uploads/2026/11/artex-hacking-tool-1465-exposed-hosts-12000-forks-2026-gen.webp)
The ARTEX hacking tool, an open-source AI-driven penetration-testing framework developed in China, now circulates in copies its author can no longer pull back. TechRadar reports that copies of the Chinese-made tooling leaked online for anyone to grab and reuse in further attacks. The reporting does not pin down how many copies exist, but the numbers around it are large: more than 12,000 forks before the original code was withdrawn, and 1,465 hosts with exposed ARTEX consoles that Censys counted on November 4, 2026.
The story arrives in a month already crowded with exposure incidents. Readers who followed how Claude Code settings files exposed 1,379 secrets on GitHub will recognize the pattern: a developer tool built for productivity ends up leaking access, and the cleanup never catches the copies. ARTEX differs in one important way. This tool was designed to attack systems, and it was built to run on its own.
This analysis walks through what is confirmed about the ARTEX leak, what remains unproven, who is reported to have used it, and what security teams should do this week. It also looks at the market impact for vendors of autonomous testing products, and it closes with four predictions and a short FAQ.
Don't miss new tech stories on Google
Add Shattered once in the Google app and our stories show up in your news suggestions.
What the ARTEX Leak Is and Why It Matters #
ARTEX is an open-source, autonomous penetration-testing framework that uses AI to plan and run attack steps against a target. A GitHub user going by Autumn-27 developed it and released it on July 26, 2026. In the months that followed, the project drew enough attention to collect more than 12,000 forks, a figure reported before the original code came down.
The repository and the Docker image were reported removed on October 11, 2026. That removal did not end the tool’s life. Copies, forks, mirrors, translations and rebranded versions stayed available, which is why TechRadar frames the situation as a leak: the code left the original author’s control and spread into places no takedown request reaches.
Why does this matter beyond the usual breach cycle? Because the barrier to entry for a capable attack tool dropped. A framework that automates reconnaissance and exploitation decisions shifts the skill requirement from the operator to the software. A crew that once needed experienced hands can point a packaged tool at a target list and let it run.
Two reported uses show the scale. CrowdStrike said VAPOR PANDA, a China-nexus group, used ARTEX against more than 200 organizations in an 11-day period, mostly government and defense bodies. Reporting also links the Microsoft-tracked actor Storm-0940 to ARTEX use in the ConnectWise Cloud Backup supply-chain compromise, with attempted sign-ins reported against more than 2,250 tenants.
| Item | Reported figure | Attributed to |
|---|---|---|
| Initial release | July 26, 2026 | Reporting on the project |
| Forks before withdrawal | More than 12,000 | Reporting on the project |
| Exposed ARTEX consoles | 1,465 hosts (as of November 4, 2026) | Censys |
| Repository and Docker image removal | October 11, 2026 | Reporting on the project |
| VAPOR PANDA targets | More than 200 organizations in 11 days | CrowdStrike |
| Storm-0940 attempted sign-ins | More than 2,250 tenants | Reporting tied to Microsoft tracking |
| License | AGPL-3.0 | Reporting on the project |
What ARTEX Is: An AI-Driven Pentest Framework #
Penetration-testing frameworks have existed for decades. They let security teams probe their own systems, find weak points, and fix them before an attacker does. ARTEX belongs to a newer class that adds autonomy. Instead of a human choosing each step, the software uses AI to decide what to try next, run it, read the result, and continue.
That design matches where the wider industry is heading. Concern about machine-speed offense has moved from conference talk to policy warnings, and one example is the AI chief’s warning of an AI cyber crisis within months. ARTEX gives that concern a concrete, named artifact. It is not a lab demo or a research paper. It is a working framework with a public release history, a fork count, and documented use by threat groups.
Dual-use by design
Every tool in this category cuts both ways. A defender wants automated testing because manual testing is slow and expensive. An attacker wants the same speed. The code does not know who is holding it. That is the core tension in open-sourcing an autonomous testing framework, and ARTEX is a live example of the downside.
The developer’s choice of license adds a wrinkle. ARTEX shipped under AGPL-3.0, a copyleft license that gives anyone who holds the code the right to use, modify and redistribute it. Once a copy exists, withdrawing the original repository does not revoke those rights for the people who already downloaded it. Legal reach and practical reach are two different things here.
Timeline: From July 26 Release to the Nov. 4 Censys Count #
The dated events make the pace clear. ARTEX went from first release to a withdrawn repository in 77 days. From the withdrawal to the Censys scan took another 24. By today, November 9, the tool had been in circulation for 106 days, and the original code had been officially gone for 29 of them. The day counts below are simple arithmetic on the reported dates.
| Date | Event | Days since release |
|---|---|---|
| July 26, 2026 | Autumn-27 publishes ARTEX | 0 |
| October 11, 2026 | GitHub repository and Docker image reported removed | 77 |
| November 4, 2026 | Censys identifies 1,465 hosts with exposed consoles | 101 |
| November 9, 2026 | TechRadar reports the leak (today’s coverage) | 106 |
| Not dated in reporting | Autumn-27 announces move to closed source | Unknown |
| Not dated in reporting | VAPOR PANDA 11-day campaign window (CrowdStrike) | Unknown |
| Not dated in reporting | Storm-0940 use in ConnectWise Cloud Backup compromise | Unknown |
Three rows carry no date in the cited reporting, and this article does not guess at them. That gap matters for analysis. If the threat-actor campaigns fell after the October 11 removal, the takedown failed to slow misuse. If they fell before, the removal looks like a reaction to abuse that was already underway. The available reporting does not settle which sequence is true.
1,465 Exposed Consoles: What Censys Found #
Censys, the internet-scanning firm, identified 1,465 hosts running exposed ARTEX consoles as of November 4, 2026. Reporting says those deployments were reachable from the internet without password protection. In plain terms, anyone who found one of those consoles could reach the control interface of a running ARTEX instance.
This is a second layer of risk, separate from the code leak. The first layer is that attackers can obtain the tool. The second is that people running it, whether defenders testing their own estate or operators with other aims, left the front door open. An exposed console of an attack framework can reveal targets, queued tasks and findings. It may also hand a stranger the ability to steer the tool.
Censys also noted a related product from the same author. ScopeSentry, also written by Autumn-27, is described by Censys as a Chinese asset-discovery and vulnerability-scanning platform. The link suggests a small developer ecosystem around one author, where an asset-discovery product and an autonomous testing framework could feed each other. The reporting stops short of describing how the two connect in practice, so treat that as an open question.
How to read the 1,465 figure
The count is a snapshot from one scan date. It tells readers how many consoles Censys saw on November 4, not how many existed before or after. Hosts get patched, firewalled or switched off, and new ones appear. It also counts hosts, not organizations or people, so a single operator could account for several entries. The honest reading is that more than a thousand instances sat visibly open on one day, with no password in the way.
The Developer’s Closed-Source Pivot #
After the repository came down, Autumn-27 stated: “The ARTEX project will no longer be updated and will be converted to a closed-source model. There will be no further public releases or maintenance support.” The statement is attributed to the developer in the reporting, and this article quotes it as written.
Read closely, the statement changes the picture in two ways. First, it removes the one party who could have shipped security fixes to the public code. Any copy now in the wild will not get patches from the original author. Defenders cannot count on an upstream update to close holes in the console, and attackers cannot expect new features either, unless forks add them.
Second, a move to closed source signals a business turn. Open-source projects that gain traction sometimes convert to paid or restricted models once the audience is built. Reporting names two circulating versions, ScopeWeaver and ARTEX PRO, as rebranded or commercial variants. The reporting does not establish any purchase price, and it does not confirm who sells them. Readers should not assume the closed-source plan and those variants share an owner.
The identity of Autumn-27 is not established in the cited reporting either. A GitHub handle tells us who published the code, not who the person is, where they work, or whether any legal action is pending. This article makes no claim about any of those points.
Forks, Mirrors and Rebrands: ScopeWeaver and ARTEX PRO #
More than 12,000 forks existed before the original code was withdrawn. A fork is a full copy of a repository under a different account, so each one preserves the code at the moment it was taken. Removing the source repository does not touch any of them. That is the arithmetic behind every failed takedown of open-source code: the number of copies grows faster than any one party can chase them.
Beyond forks, reporting lists mirrors, translations and rebranded versions. Translations matter more than they sound. Documentation and interface strings in other languages widen the pool of people who can operate the tool without reading the original. A rebrand, meanwhile, breaks name-based detection and search. A defender hunting for the string ARTEX may miss ScopeWeaver or ARTEX PRO unless they look for behavior and code features instead of the name.
Not every fork is a live weapon. The fact sheet behind this story is explicit that no source establishes all leaked copies as usable for attacks. Many forks sit unused, and some may be broken or incomplete. The risk lies in the working subset, and the reporting does not size that subset. A fair summary: the code is widely replicated, the number of operational copies is unknown, and the reported threat-actor use shows that at least some copies work.
For anyone tracking exposure, the practical takeaway is to stop treating the project name as the indicator. The name changed, the hosting changed, and the language changed. Detection has to follow what the software does on the wire and on the host.
VAPOR PANDA: 200 Organizations in 11 Days #
CrowdStrike said VAPOR PANDA, a China-nexus group, used ARTEX against more than 200 organizations during an 11-day period, mostly government and defense bodies. Spread evenly, that works out to roughly 18 organizations a day. The even spread is this article’s arithmetic, not a CrowdStrike claim, but it conveys the tempo an autonomous framework can sustain.
The target mix deserves attention. Government and defense organizations usually run mature security programs and still sat inside the campaign’s reach. That does not prove the tool defeated those defenses, and the cited reporting does not say how many attempts succeeded. It does show that a state-linked group chose an openly available framework for work against sensitive sectors, rather than building something private.
That choice carries analytical weight. Open frameworks give a group deniability, because the same tooling shows up in unrelated incidents, and they cut development cost. They also blur attribution. If ten different crews run the same code, a tool signature no longer points to one operator. Analysts have to lean on infrastructure, targeting and tradecraft to tell the groups apart.
Note the careful wording CrowdStrike’s description requires: China-nexus describes a link to China, not a confirmed state order. This article repeats the label as reported and goes no further.
Storm-0940, ConnectWise and 2,250 Tenants #
The second named actor is Storm-0940, a designation used by Microsoft’s threat tracking. Reporting links Storm-0940 to ARTEX use in the ConnectWise Cloud Backup supply-chain compromise, and describes attempted sign-ins against more than 2,250 tenants. The word attempted carries weight. The figure counts tries, not confirmed account takeovers.
Supply-chain compromises magnify impact because one foothold opens doors to many downstream customers. A backup product sits close to sensitive data, and it often holds broad permissions. When an attacker pairs that position with an autonomous framework, the sign-in attempts can scale across a customer base far faster than a person could manage by hand. The 2,250-tenant figure is more than ten times the 200-organization VAPOR PANDA figure, though the two numbers describe different incidents and different units, so they are not directly comparable.
Managed service providers and their customers should read this as a reminder about trust paths. If a vendor’s cloud service can reach your tenant, then an attacker inside that vendor can try to reach you too. Conditional access rules, sign-in monitoring and strict limits on delegated permissions all reduce that exposure. None of them depends on knowing which tool the attacker used.
What We Know and What We Don’t #
Breaking stories attract loose numbers, so a clean separation helps. The table below sorts claims by how well the cited reporting supports them. Anything in the right-hand column should stay out of headlines, tickets and board slides until a named source backs it.
| Claim | Status |
|---|---|
| ARTEX is an open-source, AI-driven pentest framework from China | Reported across multiple sources |
| Autumn-27 developed it, first release July 26, 2026 | Reported |
| 1,465 hosts exposed consoles on November 4, 2026 | Reported by Censys |
| Exposed deployments had no password protection | Reported |
| Repo and Docker image removed October 11, 2026 | Reported |
| VAPOR PANDA hit 200+ organizations in 11 days | Reported by CrowdStrike |
| The exact number of leaked copies | Not established |
| Real-world identity of Autumn-27 | Not established |
| Any purchase price for ScopeWeaver or ARTEX PRO | Not established |
| All leaked copies are usable for attacks | Not established |
The headline framing of hundreds of leaked copies, as TechRadar presents the story, fits the forks-and-mirrors picture. Still, the cited reporting does not give an exact count, and this article does not supply one. What the evidence supports is breadth: many copies, in many forms, across many hosts, with documented misuse by at least two tracked actors.
Why Pulling an Open-Source Repo Doesn’t Stop Misuse #
The October 11 removal is a useful case study in the limits of takedowns. A repository host can delete a project in minutes. It cannot delete a copy sitting on someone’s laptop, a private server, or a mirror in another jurisdiction. Once code has been public long enough to collect 12,000 forks, the original repository is no longer the source of truth. It is one copy among thousands.
History in offensive security tooling offers a steady lesson here. Powerful red-team products have repeatedly escaped their makers’ control, through leaks, cracks or abandoned open releases, and criminal groups have picked up the resulting copies. The pattern repeats because the tooling is valuable to both sides and the copying cost is near zero. ARTEX fits the pattern with one twist: the AI layer lowers the operator skill that older leaks still demanded.
The licensing angle
AGPL-3.0 is a strong copyleft license. In general terms, it lets recipients run and modify the software, and it asks that modified versions offered over a network make their source available to users. That clause pushes toward openness, not secrecy. It also means a rebranded or translated fork can circulate legitimately under the same terms, which complicates any effort to label every derivative as illicit. Whether a particular fork follows the license is a legal question this article does not try to answer.
Market Impact: Autonomous Testing Vendors and Buyers #
The leak lands in a market where autonomous testing has become a selling point. Vendors pitch continuous, AI-run assessment as a cheaper alternative to periodic human-led engagements. ARTEX shows the other side of that pitch: the same automation, free and copied widely, running against real organizations. Expect buyers to ask harder questions about how commercial products restrict scope, log actions and prevent misuse.
Three effects look likely, and all three are analysis, not reported fact. Procurement teams will probably add misuse-control requirements to RFPs. Insurers and auditors may start asking whether an organization’s own pentest tooling sits behind authentication, since 1,465 open consoles gave them a vivid example. And defensive vendors will market detection for AI-driven attack traffic, a category that already draws attention across the security coverage on this site.
The cost side matters too. When a free framework can cover 200 organizations in 11 days, the price of broad, noisy scanning falls toward zero. Smaller targets that once escaped attention because they were not worth a human’s time now fit inside an automated sweep. Organizations with thin security staff carry the most new exposure, which is a reason to focus on the basics covered below.
Competitive Comparison: ARTEX Against Other AI Offense Tools #
This article does not publish benchmark scores for ARTEX, because the cited reporting contains none. A comparison can still sort tools by category and by control. Three buckets matter: commercial autonomous testing platforms, frontier AI models with offensive-security evaluations, and open frameworks like ARTEX. The buckets differ mainly in who controls the tool and who can stop it.
Frontier model providers now publish evaluations of offensive capability and describe guardrails. OpenAI’s cyber work, covered in our piece on GPT-6 Cyber’s rules-of-engagement scope score, is one example of a vendor trying to keep an AI tool inside authorized boundaries. Independent testing is emerging as well, and the Vals cyberoffense results in our write-up of an open model scoring 72.8% on a hacking test show how capable open weights have become.
By contrast, an open framework carries no vendor off switch. Nobody can revoke a license key, update a policy filter, or suspend an account. The control point shifts to defenders, hosting providers and network operators. That difference is the real competitive point: commercial and frontier-model tools can be governed by their makers, while a spread-out open framework can only be countered at the target.
| Category | Who controls access | Can the maker stop misuse? | Main counter |
|---|---|---|---|
| Commercial autonomous testing platform | Vendor (accounts, licenses) | Yes, by suspending accounts | Contract terms and scope checks |
| Frontier AI model with offensive evals | Model provider (API, policy) | Partly, through filters and bans | Provider guardrails and monitoring |
| Open framework such as ARTEX | Whoever holds a copy | No, once copies exist | Detection and hardening at the target |
| Rebranded or closed-source forks | Unknown sellers or operators | Unclear | Behavioral detection, not name matching |
Defender Checklist: What to Do This Week #
Defenders cannot block a tool by name, so they need steps that work regardless of branding. Start with your own exposure. If your team runs any autonomous or open-source testing console, confirm it sits behind authentication and a private network path. The Censys finding rests on consoles that had neither.
- Inventory every internet-facing web console you operate and confirm each one requires a password or sits behind a VPN or zero-trust gateway.
- Search your tooling and CI environments for ARTEX, ScopeWeaver, ARTEX PRO and ScopeSentry, then remove or isolate anything you did not approve.
- Review sign-in logs for bursts of failed attempts across many accounts, the pattern reported in the Storm-0940 activity.
- Audit vendor-delegated access, especially cloud backup and remote-management products, and cut permissions to the minimum.
- Turn on alerts for rapid, wide-ranging scans against your public footprint, since an autonomous framework favors breadth and speed.
- Tell your SOC that name-based indicators will miss rebrands, and ask them to hunt on behavior.
A quick self-check helps with the first item. The snippet below lists open common web ports on a range you own. Adjust the range and ports to your environment, and run it only against assets you are authorized to scan.
nmap -Pn -p 80,443,3000,5000,8000,8080,8443 --open YOUR_OWN_RANGE -oG exposed-web.txt
grep "open" exposed-web.txt
Small teams cannot do all of this at once. Prioritize the first two items, then the vendor-access review. Teams short on staff can find affordable options in our roundup of seven vulnerability scanners for teams of one to three people, which helps with the inventory work. Remember that scanning your own estate is the point: attackers already run the same sweeps.
Four Predictions for AI Attack Frameworks #
These are analysis, not reported fact, and each one carries uncertainty. They follow from the dated events and the reported threat-actor use.
- More rebrands will surface. ScopeWeaver and ARTEX PRO already circulate, and forks give anyone a starting point. Expect additional renamed variants, which will make name-based blocklists less useful within weeks.
- More threat actors will adopt it. Two tracked actors, VAPOR PANDA and Storm-0940, are tied to ARTEX in reporting. Free, capable tooling tends to spread across criminal and state-linked groups, so reports of further users are likely.
- Exposed console counts will drift, not vanish. The 1,465 figure is one snapshot. Some hosts will close after the publicity, and new ones will appear as copies get redeployed. A single clean scan would not mean the problem ended.
- Regulators and buyers will press on misuse controls. Procurement language around autonomous testing tools will likely tighten, and policy debate on dual-use AI security software will get a concrete case to cite.
One further expectation sits outside the numbered list: attribution will get harder. When many groups share one framework, a shared tool signature stops identifying a single operator. Incident responders should plan to use infrastructure and tradecraft evidence alongside any tool-based clues.
The Takeaway #
The ARTEX hacking tool shows how fast an AI-driven attack framework can slip beyond its author. It took 77 days from the July 26 release to the October 11 removal, and by then the code had more than 12,000 forks. Censys still found 1,465 open consoles on November 4, and CrowdStrike tied the framework to a campaign against more than 200 organizations in 11 days.
The unknowns deserve equal weight. Nobody has established how many leaked copies exist, who Autumn-27 is, what any commercial variant costs, or how many copies actually work for attacks. Until named sources fill those gaps, the responsible position is to treat the exposure as real and wide, and to keep claims about its size within what the reporting supports. For defenders, the work is plain and familiar: lock down consoles, watch sign-in patterns, tighten vendor access, and hunt on behavior instead of names.
Frequently Asked Questions #
What is the ARTEX hacking tool?
ARTEX is an open-source, autonomous, AI-driven penetration-testing framework developed in China. GitHub user Autumn-27 released it on July 26, 2026 under the AGPL-3.0 license.
How many copies of ARTEX leaked?
The cited reporting does not give an exact number. TechRadar reports that copies leaked online, and the project had more than 12,000 forks before the original code was withdrawn. Mirrors, translations and rebranded versions also remained available.
How many ARTEX consoles were exposed to the internet?
Censys identified 1,465 hosts running exposed ARTEX consoles as of November 4, 2026. Reporting says the deployments were reachable without password protection.
Who has used ARTEX in attacks?
CrowdStrike said VAPOR PANDA, a China-nexus group, used ARTEX against more than 200 organizations over 11 days, mostly government and defense bodies. Reporting also links the Microsoft-tracked actor Storm-0940 to ARTEX use in the ConnectWise Cloud Backup supply-chain compromise, with attempted sign-ins to more than 2,250 tenants.
Is ARTEX still available?
The GitHub repository and Docker image were reported removed on October 11, 2026. Copies, forks, mirrors, translations and rebranded versions such as ScopeWeaver and ARTEX PRO remained in circulation. The developer said the project would move to a closed-source model with no further public releases.
Can defenders block ARTEX by name?
Not reliably. Rebrands and translations break name-based detection, so teams should hunt on behavior, such as rapid wide scans and bursts of failed sign-ins, and should harden any console they run.
Who is Autumn-27?
The cited reporting identifies Autumn-27 only as the GitHub user who developed ARTEX and ScopeSentry. The person’s real identity and any legal status are not established, and this article makes no claim about either.