- Book: Observability for LLM Applications
- Also by me: Thinking in Go (2-book series) — Complete Guide to Go Programming + Hexagonal Architecture in Go
- My project: Hermes IDE | GitHub — an IDE for developers who ship with Claude Code and other AI coding tools
- Me: xgabriel.com | GitHub
The AI agent framework behind two of October's intrusion campaigns runs a web console, and a lot of those consoles are sitting on the open internet. On November 5, Censys published the count: "As of November 4, 2026, Censys observed 1,465 hosts running an exposed ARTEX console."
These posts have followed Artex since WorkOS said it was likely behind an intrusion into its sales tool. The Censys post adds a census of where the consoles run and what runs beside them, plus the model traffic they leave behind. That last part you can check in your own logs today.
What Censys counted
Artex is an open-source, LLM-driven autonomous penetration testing framework, released on GitHub in July 2026. Microsoft describes it as "a system of LLM-driven agents that run an autonomous penetration test from reconnaissance through data exfiltration," and on October 21 tied it to a ConnectWise supply-chain compromise by a group it tracks as Storm-0940. Censys notes that CrowdStrike and Microsoft attributed malicious use to two separate campaigns that month.
The 1,465 hosts are not 1,465 operators. Censys says "about 650 sit in two blocks of identically configured hosting, which leaves roughly 815 distinct-looking deployments." TechCrunch reports those as more than 800 distinct deployments reachable from the web without a password.
By country, Censys lists 726 hosts in the United States, 387 in Hong Kong and 177 in China. It also says "some of the hosts publicly exposed are likely operated by authorized testers," so an exposed console is not proof of a crime. And it adds that "the ARTEX console does not require public-facing access, and overall global deployment is likely higher."
What sat next to the consoles
About one in ten consoles had company. According to Censys, 155 of the 1,465 Artex hosts (10.6%) also ran at least one other threat that Censys detects, led by CyberStrikeAI on 70 hosts, plus Vshell, Cobalt Strike and Adaptix C2.
Some operators also left files out. Censys counted 32 open directories on other Artex hosts at the time of writing, holding post-exploitation kits, stagers and implants. In the case CrowdStrike investigated, "the actor left open directories exposing a .claude folder, prompts, session histories, and ARTEX configuration files." Censys also describes one exposed home directory with .ssh and .bash_history in it, and another host exposing a MITM root CA private key.
Censys found the consoles the way any scanner finds a web app: by what the page says about itself.
A page title gave them away
The fingerprint is ordinary. Censys matched hosts whose HTML page title starts with "ARTEX" followed by a space, colon or dash, and whose page body references Next.js static assets under _next/static. The title half of its query reads:
web.endpoints.http.html_title=~"^ARTEX[ :—]"
The default console port is 8787/tcp, "with 8790 and 443 common," per Censys, which counted 1,931 endpoints on 8787 alone. It also sees customized builds, such as "ARTEX MX" on four adjacent hosts, plus a handful of other renamed consoles. A console whose title no longer starts with "ARTEX" falls outside this query.
None of that is specific to attack tooling. A self-hosted agent dashboard, an eval viewer or a prompt playground on a dev box announces itself the same way, through its title and its framework's asset paths. If it listens on every interface and the host has a public IP, a scanner can index it. Two standard commands show which address each listening port is bound to (lsof on macOS and Linux, ss on Linux):
# macOS or Linux: every listening TCP socket
lsof -nP -iTCP -sTCP:LISTEN
# Linux: same, with the owning process
ss -ltnp
A local address of 127.0.0.1 or ::1 means loopback only. *, 0.0.0.0 or [::] means every interface, and that is the one to look at twice before you leave the machine running.
Check your egress logs for LLM proxies
The detail most relevant to anyone who ships LLM features is about model traffic. "43 ARTEX hosts also run self-hosted LLM gateway or reseller software, mainly CLIProxyAPI (19) and New API (18)," Censys writes. It says the actor in the CrowdStrike case used DeepSeek as the main model, likely bought through an API reseller, and ran Claude Code sessions backed by GLM and Grok. It also says Artex supports Anthropic, OpenAI and OpenAI-compatible endpoints.
The Censys advice for defenders is about the side pipe: model traffic going somewhere you didn't pick.
Its recommendation is one line: "For defenders, unfamiliar LLM proxies and resellers in egress logs are worth investigating." That only works if you know which model endpoints your own services are supposed to call. If every LLM call in your stack goes through one client or gateway that logs the base URL, a request to a reseller domain nobody chose stands out on the first query. If calls are scattered across services with their own SDK config, it is much harder to spot.
The rest of the hunting list from Censys, for teams that run detection:
- Search for the title fingerprint on 8787/tcp, then 8790 and 443.
- Check flagged hosts for co-located open directories, Vshell or FRP listeners, and LLM proxy software such as CLIProxyAPI or New API.
- Review scan history for mitmproxy banners and short-lived Python
SimpleHTTPservers on high ports, which Censys says often appear before the console. - Block or monitor the indicators it publishes, including the CrowdStrike and Microsoft IPs and the
xcai[.]prodomain.
Closed source won't make it go away
The Artex author later stated the project would go closed-source with no further releases, and the repository has since been taken down, according to Censys. The same post says archived copies and rebrands are still circulating, and TechCrunch reports dozens of copies remain on code-sharing sites. TechCrunch also notes that many of the linked attacks got in through weak or known passwords and missing multi-factor authentication.
Rebrands will drift off the title fingerprint. The model calls still have to leave the network, so the egress log keeps showing them.
Do you know today which LLM endpoints your production services call, or would a reseller domain in your egress logs go unnoticed? Tell me in the comments.
If this was useful
The Censys advice comes down to one question: can you see where your model traffic goes? Observability for LLM Applications is my book on answering that for LLM features in production, from tracing every call to tracking cost and catching quality regressions. If the egress section above made you realize you couldn't list your own LLM endpoints, that's the visibility it helps you build.
I also build Hermes IDE, so weigh this mention with that in mind. It's a free, source-available desktop app for macOS, Windows and Linux that runs Claude Code, Codex and other coding agents side by side, each in its own terminal, and each task can get its own worktree. It's on GitHub, and it isn't affiliated with Nous Research, Anthropic, OpenAI or any agent vendor.
Top comments (0)