Censys says it found about 815 ARTEX installations that appeared to be separate and were exposed to the internet.
Some of the servers also showed attack tools and other files. In a report published November 5, the cybersecurity firm counted 1,465 internet-connected systems displaying an ARTEX console. ARTEX is an AI-powered system for testing computer security that was released in July.
Censys said roughly 650 of those systems had identical setups in two groups of internet hosting. The firm said the total therefore does not show how many separate operators were involved. Censys also found at least one other detected threat on 155 systems, including tools that can remotely control systems.
Thirty-two servers had folders accessible online containing files such as tools for exploiting weaknesses, software put onto systems, and programs used to prepare later attack steps. ARTEX is designed to coordinate AI programs that can carry out parts of security testing. Censys warned that exposure by itself does not prove malicious activity.
Legitimate security testers may also use the software. Security firms have linked ARTEX to attacks on South Korean financial institutions and to activity involving ConnectWise customer environments. The findings show the risk of leaving hacking and security-testing consoles and related files accessible on the public internet, even when the software is used for authorized testing.
Censys said ARTEX does not need to be accessible from the public internet to work.