Cybersecurity researchers have uncovered hundreds of servers hosting an AI- powered penetration testing tool called ARTEX , and its control interfaces were available online without requiring authentication in a number of cases.
Hot Topics
The discovery raised concerns about the security of tools used in testing systems and networks, especially given the documented use of the platform in hacking operations targeting real organizations.
The importance of the issue lies in the nature of the tool, which relies on artificial intelligence agents to carry out multiple stages of penetration testing, including gathering information about systems, searching for vulnerabilities, and testing the possibility of exploiting them. These capabilities may turn into a means of carrying out offensive activities when they fall into the hands of unauthorized parties, or when the servers that run them are left without proper protection.
ArtX is a penetration testing platform that uses artificial intelligence models and agents to organize and execute security checks, and aims to help researchers and cybersecurity teams evaluate systems they own or are authorized to test.
According to an analysis published by Check Point Research on November 5, the platform combines planning capabilities, the operation of security tools, and results analysis, through a group of agents who undertake different tasks within the testing process.
The process begins by defining the objective, then dividing the task into steps that include surveying systems and gathering information about available services and applications, before searching for vulnerabilities and testing their exploitability. The platform then allows for recording and organizing the results, helping researchers assess the level of protection.
This mechanism differs from traditional scanning tools that execute predefined commands, as agents can organize interconnected steps and adjust the workflow based on results obtained during execution. However, this does not mean the tool can detect or successfully exploit all vulnerabilities without human intervention, as results depend on the nature of the target system, the test settings, and the tools used.
Censys said that, as of November 4, it had identified approximately 1,465 servers hosting online ArtX interfaces, and explained that around 650 of these servers fall within two sets of hosting environments with similar settings, making the number of seemingly premium deployments closer to 815.
The company also identified 155 servers hosting other tools associated with offensive activities, including reconnaissance, command, and control (C4C) tools. This does not mean that all of these servers were used in attacks, but it does indicate the existence of environments that combine multiple tools that can be employed in either security or offensive operations.
Tags:
technology
