Check Point looked inside exposed ARTEX servers: AI agents ran break-ins almost alone, for a few hundred dollars

Check Point Research published on November 5, 2026 a look inside the attackers' side of ARTEX, an AI "agentic hacking" platform: by reading the databases of ten misconfigured attack servers, it saw operators set a goal and let AI agents do almost everything else, for a few hundred to about $1,500 per campaign. The victims were mostly gray-market web shops, but the way in was ordinary — hardcoded passwords, APIs with no login, classic injection bugs — so any organization with an internet-facing web app should treat this as a reason to check those basics now.

What happened, in plain English

ARTEX is an open-source penetration-testing platform from China. Penetration testing ("pentesting") means attacking your own systems, with permission, to find weaknesses. ARTEX hands that job to AI: a large language model (LLM — the kind of AI behind chatbots) coordinates several AI "agents" that plan the attack, run security tools and record what they find, while a human watches a web dashboard.

According to Check Point, after ARTEX turned up in attacks on South Korean banks reported by CrowdStrike, its developer made it closed-source — but forks and backups are still freely available. Check Point found 2,557 systems that host or once hosted an ARTEX panel, 1,608 of them live at the time of research (its key points cite "more than 1,800" exposed instances; the report does not reconcile the two figures).

Ten of those servers left their whole database exposed. That gave the researchers the operators' instructions, the AI models they picked and every step the agents took. Three campaigns stand out: theft of Apple code-signing certificates from iOS "signing shops", an attempt to drain cryptocurrency that failed, and theft of more than 190,000 mobile-game account credentials.

Think of it as hiring a tireless burglar who tries every door and window on the street, all night, and only calls you when something opens. The doors it found open were the kind every IT team knows it should have locked.

Are you affected? What to do now

Check Point does not name corporate victims beyond the gray-market shops, crypto and gaming services it describes, and it names no threat group. Most readers are not known victims. But the techniques are generic, so the useful action is to make sure your own web-facing systems would not be easy pickings for an automated attacker that never gets bored.

Who should care most: teams running public web apps, APIs, admin panels or cloud storage buckets — especially small sites and side projects that skip security review.

Checklist, in order:

• Search client-side code for secrets. The agents repeatedly found admin passwords hardcoded in JavaScript and HTML served to browsers. Scan your front-end bundles; remove and rotate anything found.
• Require authentication on every API endpoint, and check object-level authorization (that user A cannot fetch user B's record by changing an ID — a flaw called IDOR, insecure direct object reference).
• Fix injection bugs: command injection and server-side template injection (SSTI) gave the agents remote code execution in several cases. Prioritize these in scanner and pentest findings.
• Keep sensitive files out of web roots. One shop left a 21.5 MB plaintext credential file where anyone could download it.
• Do not expose admin panels or databases to the internet; put them behind a VPN or an identity-aware proxy.
• Scope cloud credentials tightly. In one case an unauthenticated API leaked storage credentials with write access to a bucket serving app downloads — a supply-chain risk. Use read-only, per-purpose keys.
• Expect volume. Check Point warns that a targeted organization "can expect to be exposed to a high volume of attacks". Operators used residential proxies to get around web application firewall (WAF) rules and IP blocks, so blocklists alone will not stop this; rate-limit and alert on bursts of probing against one app.
• Optional threat hunting: Check Point published clustering hints for ARTEX command servers — version tags sco-fix2, dev-db-resilience-20261031 and 0.3.15-pro.*, on networks AS54600, AS152918 and AS36352. Specific IP addresses are in the report. It notes a shared tag alone is only a clustering hint, and gives no file hashes or detection rules.

The expert view

What is new. Earlier ARTEX reporting — including Microsoft's on Storm-0940 and TrendAI's on attacks in Japan — was built from victim-side telemetry. This is the first detailed view from the operator's console. It confirms what defenders suspected: "Most attacks were fully autonomous besides the initial goal setup." Operator prompting was minimal — mostly progress checks in the certificate campaign, nothing beyond initial goals in the other two.

The economics. The certificate campaign ran from October 14 to 29 on two consoles in parallel and consumed about 36 billion tokens, mostly cheap cached input, for an estimated $700–$1,500. The gaming campaign took about five days and an estimated $180–$360; roughly 3.3% of the stolen credentials still worked, about 6,000 accounts by Check Point's estimate. The cost estimates are based on DeepSeek's API prices. The takeaway is not that AI found clever bugs — it is that exhaustive, patient scanning of a whole target list is now very cheap.

Model choice and guardrails. Chinese models dominated the ten exposed instances, with the DeepSeek Flash family most common; Kimi was also used. American models were configured on three instances, and Check Point saw guardrails triggered only with Anthropic's Opus 5.5 — after which the operator switched to more permissive Chinese models. The models showed no guardrails under ARTEX's "Pentest" framing. For defenders, the lesson is that provider-side refusals are a speed bump, not a control you can rely on: operators simply swap the model.

Agents fail too. The crypto campaign generated 230 findings and 400,791 agent messages across 292 objectives, yet the attacker's wallet shows no funds. Check Point classifies the reported cash-out bugs as hallucinated findings: agents judged success from API "success" responses. In a third wave, an agent found leaked storage credentials and reasoned about poisoning an iOS app distribution path; the bucket owners later restored the original files. That is the worrying edge — agents improvising supply-chain moves beyond the initial brief, which Check Point says it observed "in some cases".

How it fits the trend. It matches the pattern our recent coverage has tracked: AI agents scaling up old, well-known weaknesses rather than inventing new ones. Check Point also names similar frameworks (CyberStrike, Cairn, PentAGI) and a custom one it calls "PZZ", so blocking ARTEX specifically will not be enough.

What is still unknown. Who the operators are, how representative ten self-exposed databases are of the 1,600+ live servers, and how many of the 292 crypto domains were actually compromised. The report also gives two dates for the project's withdrawal (deleted September 8; made closed-source October 8) without explaining the gap.

Official sources

• Check Point Research — "Hacking on Autopilot: Inside ARTEX Cybercrime Campaigns" (November 5, 2026)
• Microsoft Threat Intelligence — Storm-0940 uses ARTEX agentic AI in ConnectWise supply-chain compromise (October 21, 2026)
• TrendAI — Not only ARTEX: the different levels AI is used in attacks targeting Japan
• Coverage: Cyber Security News — ARTEX AI agents steal 190,000 gaming credentials and hundreds of Apple code-signing certificates