Shodan results for the default ARTEX console title, showing 813 exposed services and top ports 8787, 443 and 80

Tempo, not technique: hunting the AI harnesses behind today’s intrusions

Nov 2, 2026

RST Labs · data as of 2 November 2026

The speed problem

The intrusions making headlines this autumn are not clever. They are fast.

Microsoft reported that Storm-0940 used ARTEX to attempt sign-ins to more than 2,250 tenants following the ConnectWise compromise. In multiple ARTEX-driven attacks, the actor gained privileged cloud access within three hours of initial targeting. Separately, Microsoft observed a password-spraying campaign targeting 327 accounts across eight organizations, but found no successful sign-ins ^[1]. CrowdStrike tracked VAPOR PANDA, also running ARTEX, across more than 200 organisations from 17 October ^[2]. One Cairn operator studied by VULONE burned through roughly 36.7 billion tokens running 66 projects against government targets in four countries ^[3].

None of these campaigns needed a new exploit. They needed an orchestrator that could take a goal, split it into tasks, hand them to LLM agents, and keep going around the clock. Three open-source projects now do exactly that: Cairn, ARTEX and PentAGI.

They are also easy to find. On 2 November 2026 we counted more than 1,300 internet-exposed consoles for these three harnesses, verified and deduplicated across Shodan and Netlas. Many will belong to testers. Some don’t, and from the outside the consoles look the same.

What the harnesses are

	Cairn	ARTEX	PentAGI
Upstream	oritera/Cairn ^[8]	Autumn-27/ARTEX (hidden Oct 2026)	VXControl
Stack	Python, uvicorn, Alpine.js	Next.js behind nginx	React SPA, self-signed TLS
Default port	8000	8787	8443
Auth by default	None	HTTP Basic (realm “ARTEX”) on some hosts	Login page, default credentials
Licence / model	Open source	AGPL, forks	Open source + commercial
Notable derivatives	VulnFlow IoT, “Zero”, WorkerAnt	ScopeWeaver, BaaRai ARTEX, ARTEX v2, Korean build, AegisLoop	Renamed builds (“AI Pentest”, “Specter”)

All three plan, run tools, read the output and decide the next step without a human in the loop. The operator sets the target and the rules; the harness supplies the tempo.

A login page is not the same as being safe to expose. Many ARTEX hosts answer with an HTTP Basic auth challenge (realm “ARTEX”), and PentAGI presents a sign-in screen with default credentials to change on first use; Cairn ships with none. But our scans read every console’s title, body, certificate and favicon without authenticating, so the consoles counted here are reachable on the public internet regardless, and an unprotected or default-credentialed panel is exactly what NorForge saw hijacked ^[6].

The Cobalt Strike pattern

We have seen this before. Cobalt Strike was built for red teams, and it became the most common post-exploitation framework in criminal and state intrusions. The AI harnesses are following the same path, faster.

Dual use is the default. Red teams, CTF players, researchers, criminal crews and state actors all run the same code. Public reporting is weighted towards China-nexus actors, but they are the most visible users, not the only ones.
Forks multiply. ARTEX has a backup mirror (mhtsec), a mirror of the mirror under a generic name (kutukam/autonomous-pentest-agent), an English/Korean fork (cskwork/scopeweaver, around 770 stars and 660 forks) ^[9] and an English translation (BaaRai/ARTEX, around 320 stars and 170 forks) ^[10]. The BaaRai fork adds a browser extension that captures the operator’s authenticated sessions, so agents can reuse a login after one MFA prompt.
Takedowns don’t stick. ARTEX’s author hid the original repository in October after reports of abuse ^[4]. That changed who maintains ARTEX, not who can run it. Renamed mirrors don’t show up in name searches, just as rebranded consoles don’t show up in title searches.

How they are used

Cairn: one endpoint to full takeover. ReliaQuest followed a Cairn-driven intrusion from a single exposed Spring Batch endpoint to server takeover, with data leaving in 1,800-byte chunks. The attacker’s own Cairn panel was live on the attack-origin IP ^[5].

Cairn: a credit-farmed government campaign. VULONE describes a China-linked, financially motivated operator running 66 Cairn projects against government networks in Vietnam, Taiwan, Indonesia and India. A rule in the operator’s prompts forced ASCII-only payloads, and the LLM bill was paid by farming CodeBuddy credits ^[3].

ARTEX: bursts, probes and poisoned logs. Google’s threat intelligence team saw ARTEX activity arrive in bursts 2 to 25 seconds apart, ArtexProbe markers, MySQL log poisoning and 491 webhook.site callback URLs. GTIG also names ScopeWeaver and an “ARTEX PRO” variant ^[4].

ARTEX: VAPOR PANDA. CrowdStrike reports VAPOR PANDA using ARTEX against more than 200 organisations, with operator instructions marked by 【人类指令】 (“human instruction”) tags. The actor looked specifically for hosts without an EDR agent, and deployed BLOODALCHEMY afterwards ^[2].

ARTEX: Storm-0940. Microsoft links Storm-0940 to ARTEX after a ConnectWise supply-chain compromise. ARTEX drove sign-in attempts at more than 2,250 tenants and Microsoft Graph reconnaissance, and in several intrusions reached privileged cloud access within three hours of initial targeting. A separate password-spraying campaign against eight organisations produced no successful sign-ins ^[1]^[7].

The hunters get hunted. NorForge documents two clusters, AIA0009 and AIA0010, hijacking exposed Cairn panels to steal API keys and SSH keys and to deploy Poseidon ^[6]. An open harness console is a target in its own right.

Hunting guide

Internet exposure

Every harness can be found by more than one feature. The strength of each, weakest to strongest:

title → port → favicon → certificate → body/template code

The default fingerprints below are easy to change, so publishing them costs nothing; operators who care about being found have already changed them. They are a starting point for defenders who have not begun looking.

Harness	Starting-point fingerprint	Notes
Cairn	Shodan `product:"Cairn"`; title `Cairn` with `server: uvicorn`	Title alone is noisy, see below
ARTEX	Title `ARTEX — 自主渗透测试控制台`	The em dash (U+2014) matters
ARTEX	HTTP Basic auth realm `ARTEX` (`WWW-Authenticate` header)	Title-independent; present where the console is behind Basic auth
ARTEX	Titles `ARTEX: Autonomous Penetration Testing Console`, `Agent Security Workbench`	English build, v2
PentAGI	Cert issuer CN `PentAGI CA`	Default self-signed cert
PentAGI	Favicon: Shodan `http.favicon.hash:-1596753120`, Netlas SHA-256 `2a620e3c5f7b49dfc6f5278352607f7931f8c38ef9d4689908af65538dd95366`	Shodan uses MurmurHash3, Netlas SHA-256
All	Default ports: Cairn 8000, ARTEX 8787, PentAGI 8443	Roughly a third of consoles run elsewhere

Shodan results for the query product:"Cairn", showing 12 exposed Cairn consoles with China, the United States, Czechia, Ireland and the Netherlands in the country list — Shodan’s built-in product filter for Cairn returns only the stock configuration.

A single Shodan result for an English-language ARTEX v2 build titled "Agent Security Workbench", served by Next.js — An English build, “ARTEX v2 · Agent Security Workbench”, which a default-title search misses.

Netlas results for PentAGI's default self-signed certificate issuer, certificate.issuer.common_name "PentAGI CA" — 171 hosts, the first of them serving the console on port 8443, with the United States, China, Hong Kong, Singapore and Germany leading the country breakdown — Netlas: PentAGI default certificate issuer, the strongest single PentAGI fingerprint.

Netlas: PentAGI by favicon hash; favicons are often not indexed, so this undercounts.

The durable fingerprints are in the page code, and we are deliberately not publishing them. They are functions from each harness’s data model and distinctive UI elements that forks inherit even after renaming the app, and they are what found VulnFlow IoT, Zero and ScopeWeaver. Printing the exact strings would tell fork authors precisely what to change. RST Cloud tracks exposed Cairn, ARTEX and PentAGI consoles, including renamed builds and forks, and delivers them to customers as part of the RST Threat Feed.

Three lessons from building these:

Titles alone are noise. title:"Cairn" returned 407 hosts; only 56 were Cairn. The rest were holiday cottages, a trekking firm, a fit-out company and an unrelated app on Amazon S3.
OR independent features for recall, then AND a family-specific marker for precision, then deduplicate by IP.
Generic framework strings are filters, not fingerprints. Class names and internals from Next.js, Vite or Tailwind appear in thousands of unrelated apps. Use them only to narrow results that a harness-specific feature has already found.

How each kind of variation is caught:

Variation	What catches it
Default install	Title or product search
Renamed title	Body or template strings
Rebranded fork (VulnFlow, ScopeWeaver, ARTEX v2)	Framework code shared by derivatives
Non-standard port	Full-port targeted scans
Own certificate	Title/favicon union

Forks are a bigger blind spot than renaming. Searching on Cairn’s template code surfaced consoles titled VulnFlow IoT, WorkerAnt, Zero and cf作战平台, none of which a title search for “Cairn” would return. Some, like VulnFlow IoT, are separate products built on Cairn rather than disguised copies of it.

Netlas results grouped by page title, listing Cairn alongside forks named VulnFlow IoT, WorkerAnt, Zero and cf作战平台 — Searching Cairn’s template code surfaces rebranded forks a title search misses.

Victim telemetry

Static markers are the easiest to hunt and the easiest for a fork to remove. Behaviour survives changes of model, prompt and branding, so weight it more heavily.

Static markers (ARTEX) ^[4]^[1]

Files named artex-probe-*, and accounts named ArtexProbe.
artx or artex in command lines, cloud role names and working directories (for example C:\ProgramData\artx5v\).
Callbacks to rotating webhook.site URLs; GTIG counted 491.

Behavioural patterns

Machine cadence. Commands or requests arriving seconds apart, around the clock, with no human pauses. ARTEX bursts land 2 to 25 seconds apart ^[4].
Self-correcting payloads. A sequence of near-identical commands where each one fixes the previous error. Humans rarely retry this fast or this tidily.
Machine-formatted output. Scripts that print pipe-delimited results, explicit exit codes or banners, and throwaway code with comments explaining its own reasoning.
Fixed-size exfiltration. Output leaving in uniform chunks (about 1,800 bytes in the ReliaQuest case), often through sequentially named jobs or files with offsets ^[5].
ASCII-only payloads with no language artefacts ^[3].

Cloud and identity ^[1]

A new sign-in followed within minutes by Microsoft Graph enumeration, and bursts of failed sign-ins across many accounts (spraying), even when none succeed.
python-requests or Python-urllib user agents in Graph and sign-in logs.
A service principal signing in, then assigning itself a role.
Bursts of permission dry-runs and deployment validation calls with no deployment following.

Targeting

Hosts without an EDR agent picked first ^[2].

Harnesses hijacked

Cairn ships with no authentication. NorForge shows what happens next: other actors take over the panel, steal the operator’s LLM API keys and SSH keys, and turn the infrastructure against its owner ^[6]. If you run these tools for legitimate testing, put them behind a VPN or authenticating proxy, and never expose the console port.

What the internet shows

Exposed consoles, 2 November 2026

Harness	Verified hosts	Shodan only	Netlas only	Both
Cairn	56	25	16	15
ARTEX	834	754	28	52
PentAGI	459	242	59	158
Total (unique IPs)	1,341

For comparison, Censys alone shows 1,261 hosts tagged with ARTEX software, 506 PentAGI consoles and 30 Cairn consoles (2 Nov 2026), nearly 1,800 in all. We could not deduplicate these against our data, so they are not included in the totals.

Where they run

	Top hosting countries	Default port share
Cairn	US 21%, CN 14%, NL 12%, IR 7%	95% on 8000
ARTEX	US 55%, CN 14%, HK 9%, JP 6%	65% on 8787
PentAGI	US 43%, HK 11%, CN 11%, DE 7%	69% on 8443

Hosting is concentrated. Roughly 300 ARTEX consoles, more than a third of the total, sit in a single network (AS54600), and about 90 PentAGI consoles sit in another (AS398823). Both blocks are registered to Cogent in WHOIS, but neither is announced by Cogent’s own network, so the concentration points to a reseller or VPS provider rather than Cogent itself.

Country is where the server is hosted, not where the operator sits. The US leads because that’s where the cloud capacity is.

What the numbers say

No scanner sees everything. For the same ARTEX title, Netlas found 37 hosts, Shodan 708 and Censys 1,223. Each figure here is a lower bound.
Some consoles show no title at all. 96 ARTEX hosts answer only with an HTTP Basic auth challenge (realm “ARTEX”), so a title or body search never sees them. The authentication header was the only evidence, and it added more than a tenth to the ARTEX count.
Combining sources matters most for small populations. Shodan found 40 Cairn hosts and Netlas 31, but only 15 were seen by both: merged, the count is 56.
Non-default ports are common. About 35% of ARTEX and 31% of PentAGI hosts run only on non-default ports, and PentAGI has large clusters on 8666 and 8765.
Titles are not enough. For every harness we found consoles that a default-title search misses. We did not set out to find them all, and the examples below are a sample, not a census:

Harness	Examples found under other titles
Cairn	VulnFlow IoT, WorkerAnt, Zero, cf作战平台, “Cairn · 事实图谱协同探索”, “Cairn（中文界面）”
ARTEX	Korean builds (“ARTEX: 자율 침투 테스트 콘솔”), “AegisLoop — 攻防安全运营”, “ARTEX v2 · Agent Security Workbench”, “ScopeWeaver — Autonomous Penetration Testing Console”, a lower-case “artex — 自主渗透测试控制台”
PentAGI	“AI Pentest”, “Specter”, “xhackai”, “PentestAI”, “天融信 AI渗透测试系统”

Netlas results grouped by page title, listing the default ARTEX console alongside ScopeWeaver, AegisLoop and Korean-language ARTEX builds — Grouping ARTEX-family consoles by title surfaces localised and renamed builds.

Each was found through a stronger feature: template code, certificate, favicon or a family-specific body string. Anyone hunting these tools by title alone will miss them.

Shodan results for the default PentAGI title, showing 491 services, 269 of them in the United States, and top ports 8443, 8666 and 8765 — Shodan: PentAGI default title, 491 services; non-console pages included until filtered.

Reputation of what we found

An exposed console is not malware, so we did not expect antivirus engines to flag these hosts. We checked a sample on VirusTotal anyway, to see whether reputation data tells defenders anything the exposure data does not. Two groups: hosts that only surface when you hunt past the default title (renamed builds, forks, and servers running two harnesses at once), and a baseline of stock default-title consoles.

Hunted hosts (renamed, forked, or multi-harness)

Host	What it is	Port	Country	VT
23.226.135.117	PentAGI as “xhackai”	8443	US	8/92
1.14.104.208	ARTEX + PentAGI on one server	8443/8787	CN	7/92
43.139.50.42	ARTEX v2 · Agent Security Workbench	3000	CN	6/92
51.158.154.152	ARTEX + PentAGI on one server	8443/8787	NL	3/92
156.240.236.6	Cairn as “cf作战平台”	8001	HK	2/92
8.216.41.60	Cairn as “Zero”	8000	JP	1/92
84.247.152.233	ARTEX + PentAGI on one server	8443/8787	NO	0/92
5.255.124.144	ARTEX as “ScopeWeaver”	8080	NL	0/92
119.45.26.102	PentAGI as “天融信 AI渗透测试系统”	18089	CN	0/92
123.57.3.71	Cairn as “VulnFlow IoT” (live, confirmed 2 Nov)	8000	CN	0/92

Baseline (stock default-title consoles)

Host	Harness	Port	Country	VT
176.65.144.71	Cairn	8000	DE	15/92
43.250.53.42	Cairn	8000	AU	12/92
117.72.220.70	ARTEX	8787	CN	12/92
31.57.47.29	Cairn	8000	NL	6/92
38.11.221.26	ARTEX	8787	US	0/92
111.228.36.150	ARTEX	8787	CN	0/92
82.25.190.221	PentAGI	8443	NL	0/92
124.223.104.170	PentAGI (live, confirmed 2 Nov)	8443	CN	0/92
23.95.170.215	PentAGI	8443	US	0/92

Exposure is not reputation. The scores do not separate the hunted hosts from the stock ones. Several renamed and multi-harness panels carry detections (up to 8/92), but so do plain default consoles (up to 15/92), while other live, confirmed-exposed consoles, including a running Cairn fork, sit at 0/92. The detection count tracks the hosting more than the tool: the highest scores here are on abused or shared VPS ranges that would score high whatever they ran, and a console on a clean provider scores zero even when it is live and findable. A VirusTotal zero does not mean safe; it means unreported. For infrastructure like this, a raw reputation count is a weak signal on its own, and needs weighting by hosting context, exposure and the dual-use nature of the tool before it can drive any action.

Methodology

Data was collected passively from Shodan, Netlas and Censys. No console was accessed.
The unit is a unique IP; services (IP plus port) are reported separately.
A host is counted only if a family-specific query found it, or if a title/port match also had a family marker in its stored body, favicon or certificate. Lookalike pages (for example a PentAGI prompt-explainer page that copies the stock favicon) are excluded by hand.
A targeted Netlas scan of selected ranges, covering non-standard ports, added hosts that the public crawls missed.
An exposed console is not proof of malicious use, and tool presence is not attribution.

Netlas results for a targeted scan on the default ARTEX console title — seven hosts answering on non-standard ports such as 18789 and 48644, with a top-ports panel listing 8081, 80, 443, 8899 and 18789 — A targeted Netlas scan reaches ARTEX consoles on non-standard ports that public crawls miss.

Defensive takeaways

Plan for tempo. Hours, not weeks, from first touch to privileged access. Automate containment for password-spray and Graph-recon patterns.
Close the EDR gaps. At least one actor goes looking for unmanaged hosts first.
Hunt the harness, not the exploit. Burst timing, probe markers, webhook callbacks and fixed-size exfiltration chunks survive changes of model and prompt.
Watch your own exposure. Red teams running these tools should never expose the console. A hijacked harness hands your keys and access to someone else.
Track forks, not names. Fingerprint body and template code, and expect the next rebrand.