Censys found about 815 AI hacking consoles open to the web. The attacks they ran mostly used weak passwords and missing MFA

AI attack tools are getting faster, but the doors they walk through are the same old ones.

What happened

Artex is an open source autonomous penetration testing tool released in July. It uses a planner agent and worker agents to probe systems, and it works with Anthropic, OpenAI or any OpenAI compatible model endpoint. Censys reported that as of November 4 it saw 1,465 hosts running an exposed Artex console. About 650 sit in two blocks of identical hosting, leaving roughly 815 distinct looking deployments. TechCrunch reports these were reachable without a password, even though the software does not need to be public. Censys says not every instance is malicious, and some are likely run by authorized testers.

The tool has been linked to real attacks. Per Censys, Microsoft tied it to a China aligned group's compromise of ConnectWise customer tenants. The group used it to automate scanning, password spraying and OAuth application abuse, attempted sign-ins to more than 2,250 tenants, peaked at 2,900 attempts per minute, and some victims saw privileged cloud access in under three hours. TechCrunch notes that many Artex linked attacks exploited simple weaknesses such as weak or known passwords and a lack of multi-factor authentication. The author has said the project will go closed source, but copies are still circulating.

My take

Automation builders hold a lot of keys: admin logins for CRMs, OAuth connections into Microsoft 365 and Google, API keys inside n8n or Make. An attacker running at 2,900 attempts per minute does not need anything clever if one of those accounts has a reused password and no MFA.

The other lesson is about exposure. Censys says the Artex console never needed to be on the internet, and still was. The same mistake happens with self hosted automation tools.

A short checklist for client systems this month:

1. MFA on every admin and integration account, no exceptions.
2. Review which OAuth apps have consent in the client's Microsoft or Google tenant, and remove what nobody recognizes.
3. Use one service account per integration, so you can revoke one without breaking everything.
4. Put self hosted tools behind a login and a VPN or allowlist, never wide open.
5. Rotate keys stored in old workflows nobody owns.