ARTEX AI tool usage is far more widespread than reported, Censys finds

The use of an artificial intelligence offensive security tool called ARTEX is spreading well beyond initially identified campaigns, InfoSecurity Magazine reported on 6 November 2026. Censys estimated that deployment of the tool is much more widespread than previously known. The open-source, AI model-driven autonomous penetration testing framework was published on GitHub by a user named Autumn-27 in July 2026. [1][2]

The tool is written in Go and features an embedded Next.js web console, InfoSecurity Magazine reported. While the framework has been integrated into several known malicious campaigns since October 2026, internet traffic scans by Censys revealed far broader activity across the web. [1]

As FTMQ Security reported earlier, developer platform WorkOS recently suffered a cyberattack after an attacker used ARTEX to breach an internal sales application. The tool automated target reconnaissance and exploitation to access business contact records and customer communication summaries. WorkOS confirmed that production services and customer application data were not accessed. [5]

Censys is an internet intelligence provider created in 2015 at the University of Michigan that relies on perpetual scanning of the internet. It had 350,000 users as of 2023. [4]