Criminals using the AI hacking platform ARTEX mostly set a goal, then leave the agents to it. That is the picture from new research by Check Point Research, which found ten ARTEX servers misconfigured to expose their full databases, including the prompts operators typed and the steps their agents took. Most operators barely spoke to their agent fleets beyond asking, again and again, what the progress was.
ARTEX is a Chinese open-source penetration testing platform that uses large language models to coordinate teams of AI agents. Earlier reporting on its abuse, including Google's look at AI agents running real break-ins and its links to breaches at South Korean banks, was built from what victims saw. Check Point's material comes from the operator consoles themselves.
More than 1,600 panels sit on the open internet
Check Point counted 2,557 systems hosting or having hosted ARTEX panels, 1,608 of them live and publicly reachable at the time of the research. The largest share of live servers was in the US (882, 54%), followed by Hong Kong (295, 18%) and China (103, 6%). New ARTEX servers spiked in mid-October, which the researchers note coincided with prominent public reporting about the project. The developer has since made the project closed-source, but forks and backups keep it in circulation.
In the ten exposed databases, Chinese models dominated, with the DeepSeek Flash family the most common. American models were configured on three instances, and Check Point saw guardrails triggered only with Anthropic's Opus 5.5, after which that operator switched to more permissive Chinese models.
A certificate heist that ran itself
One operator ran two consoles for about two weeks, from 14 to 29 October 2026, pointing agents at ten gray-market shops that sell Apple iOS code-signing certificates, with the goal "get a p12 certificate + password". The agents got in through hardcoded admin passwords in JavaScript bundles, unauthenticated web APIs, command injection, server-side template injection, insecure direct object references and weak credentials, then validated what they stole. More than 300 certificates and passwords were taken; three passed every check and could be used to sign arbitrary iOS apps. Check Point estimates the roughly 36 billion tokens consumed cost between $700 and $1,500.
A second operator chasing cryptocurrency set tasks against 292 payment-infrastructure domains. Across 230 findings and 400,791 agent messages, the attacker's wallet received nothing, and some reported cash-out successes turned out to be hallucinations based on API responses that simply said "success". The agents did find a supply chain opening, leaked AWS S3 credentials with write access to a bucket of iOS app landing pages, and wrote to it before the owners restored the file. A third operator aimed agents at shops trading hijacked mobile game accounts and recovered more than 190,000 credential sets for Honor of Kings alone, of which Check Point estimates around 6,000 were still valid.
Find exposed panels, and fix the boring bugs
None of these campaigns needed a novel exploit. The agents won on hardcoded secrets, missing authentication and injection flaws, tested patiently across every endpoint, so closing exactly those gaps pays off most. Check Point also grouped three clusters of ARTEX infrastructure, with high confidence, by shared version tags and hosting:
- 38[.]11[.]173[.]1 to 125, 38[.]11[.]221[.]1 to 125 and 198[.]200[.]59[.]85 to 89 (AS54600, tag sco-fix2, 255 hosts)
- 103[.]122[.]245[.]194 and nine other addresses in the same range (AS152918, 10 hosts)
- 192[.]236[.]172[.]197, 198[.]44[.]123[.]66, 204[.]44[.]66[.]81 and 104[.]168[.]112[.]237 (AS36352, 5 hosts)
Check Point cautions that a shared tag only means the builds came from the same or a similar commit, so treat it as a clustering hint rather than an identifier. The larger lesson sits in the prompt logs: the skill these operators lacked, the agents supplied, and the humans contributed little beyond the target list.
This briefing is provided by IntelFusions for informational and defensive purposes only. It is based on sources assessed to be reliable at the time of writing, and analytic judgments carry the confidence levels indicated. Indicators of compromise are defanged; re-arm them only in controlled environments. IntelFusions is not affiliated with the organizations named and makes no warranty as to completeness or accuracy.