ARTEX v2: AI Penetration Testing and Infrastructure Analysis
As AI is rapidly adopted across cybersecurity, penetration testing tools are also changing. AI-based penetration testing tools such as ARTEX are moving beyond code generation and information retrieval. They can use multiple AI agents to divide tasks and execute external tools as part of a coordinated security testing process.
On October 1, the AhnLab Security Intelligence Center (ASEC) reported findings from its tracking of the infrastructure hosting ARTEX, an LLM-based autonomous penetration testing tool.
AI Lowers the Barrier to Cyberattacks: Our Tracking of ARTEX Infrastructure | AhnLab
ASEC continued tracking the related infrastructure and subsequently identified additional environments running ARTEX alongside other services and tools, including an AI API Gateway, attack surface management, or ASM, penetration testing frameworks, and C2 systems.
ASEC also discovered a new internet-exposed instance of ARTEX v2. ARTEX v2 uses a central Planner to coordinate multiple Worker Agents.
This article examines how AI-based penetration testing tools have evolved by reviewing the additional ARTEX-related infrastructure identified by ASEC and the features of ARTEX v2.
Tools and Services Identified on ARTEX-Related Infrastructure
ARTEX is an LLM-based autonomous penetration testing tool publicly available on GitHub. It was developed to automate asset discovery, vulnerability assessment, and attack workflows using multiple AI agents.
Following its earlier analysis, ASEC used ARTEX-related characteristics to identify infrastructure. This time, ASEC also analyzed externally exposed web services within the identified infrastructure to determine which tools and services were operating.
The analysis identified a range of services beyond ARTEX, including an AI API Gateway, ASM tools, penetration testing frameworks, C2 systems, and infrastructure management tools.
Among the web services identified, ARTEX and Sub2API were the most frequently identified services, appearing on 394 systems (46.46%) and 252 systems (29.72%). Scope Sentry was found on 22 systems (2.59%), while CyberStrikeAI appeared on 15 systems (1.77%).
| Web service | Primary function or category | Systems identified | Percentage |
|---|---|---|---|
| ARTEX | AI-based autonomous penetration testing | 394 | 46.46% |
| Sub2API | AI API Gateway | 252 | 29.72% |
| Scope Sentry | Attack surface management, or ASM | 22 | 2.59% |
| CyberStrikeAI | AI-based penetration testing | 15 | 1.77% |
| ARL-Next | Asset discovery and ASM | 4 | 0.47% |
| LunaFox | Attack surface management, or ASM | 1 | 0.12% |
| Acunetix | Vulnerability scanner | 1 | 0.12% |
| MultiC2 | C2 | 1 | 0.12% |
| Mythic | C2 and red teaming | 1 | 0.12% |
[Table] Major web services identified during the analysis of ARTEX-related infrastructure
※ Note: These figures represent the number of systems on which each web service was identified within ARTEX-related infrastructure. They do not indicate that all of these systems were used for offensive or malicious purposes
In addition to ARTEX, ASEC found a large number of Sub2API deployments. ASM, penetration testing, and C2-related tools, including Scope Sentry and CyberStrikeAI, were also identified on some systems.
These findings show that ARTEX is sometimes operated alongside various AI-based and conventional offensive and security tools in real-world internet environments.
However, the presence of multiple services on the same system is not sufficient to identify a common operator or conclude that the services are being used for malicious purposes. The analysis also identified general web services with no confirmed direct connection to ARTEX, including infrastructure management platforms, educational services, and commercial applications.
Some systems may also be operated by security researchers or penetration testers, or used as multipurpose servers or shared infrastructure.
CyberStrikeAI Detected on ARTEX-Related Systems
ASEC again identified CyberStrikeAI, an open-source platform that uses AI to support asset discovery, security tool and workflow automation, attack chain analysis, and the management of WebShells and C2 systems, within ARTEX-related infrastructure, this time on 15 systems. Some of these systems also hosted other security and offensive tools, including Mythic, MultiC2, and Acunetix.
However, this overlap alone does not establish a relationship between the developers of the individual projects or identify a common operator.
ASEC has not attributed these systems to a particular threat group. Its analysis documents tools that can support reconnaissance, vulnerability discovery, penetration testing, and post-exploitation activity within ARTEX-related infrastructure.
ARTEX v2: An Agent Security Workbench
ASEC also identified an internet-exposed instance of ARTEX v2.
ARTEX v2 provides a more structured multi-agent execution environment than the previous console. Its interface describes ARTEX as an “Agent Security Workbench.”
In the identified environment, a central Planner coordinates multiple Worker Agents. Users can view the execution status and runtime of each Agent. The interface has separate areas for exploration paths, identified assets, evidence and traffic collection, and tool execution.
The platform also provides shared Workspace data and reports, Model Context Protocol (MCP) integration, reusable Skills, and Agent configuration.
Completed test jobs also showed the central Planner managing multiple Worker Agents simultaneously.
These observations show that ARTEX v2 is evolving beyond a tool that automates individual penetration testing tasks. It is becoming a platform that orchestrates and manages the work of multiple Agents, tools, and data within a single environment.
[Figure] Multi-agent execution and management screen in ARTEX v2
AI Agent-Based Penetration Testing: How Multi-Agent Workflows Operate
The changes in ARTEX v2 illustrate how the role of AI in security testing is expanding.
Previously, LLMs were primarily used to support individual tasks such as generating code or retrieving vulnerability information. In an agent-based environment, the system can plan tasks based on a defined objective, assign roles to multiple Agents, run external tools, and use the results in subsequent tasks. he architecture identified in ARTEX v2, in which a central Planner coordinates multiple Worker Agents, is one example of this shift.
This change does not necessarily mean that fully autonomous cyberattacks have arrived. Many parts of the attack process still require human judgment and expertise. However, as the technical barriers to automating repetitive procedures decline and environments that connect multiple tools and Agents become more advanced, attackers may be able to perform more tasks faster than before.
The key development in ARTEX is its progression beyond basic AI use toward the integrated orchestration of multiple Agents and security tools.
ARTEX Infrastructure Monitoring: Tool Overlap and Threat Attribution
The analysis identified a wide range of services with different functions within ARTEX-related infrastructure, including AI-based offensive and security tools.
The presence of ARTEX or any other specific tool is therefore not sufficient to classify a system as malicious or attribute all identified infrastructure to a single threat actor or organization.
At the same time, ARTEX is no longer confined to the proof-of-concept (PoC) and experimental stages. It has been deployed on real infrastructure accessible from the internet, and ASEC has found cases in which it operates alongside various AI-based and conventional offensive and security tools.
As demonstrated by ARTEX v2, AI-based penetration testing frameworks are also expanding their capabilities to support autonomous task planning, multi-agent execution, and integration with external tools.
ASEC considers continued monitoring important for understanding relationships among the tools, the systems hosting them, and any associated threat activity.
Threat Intelligence on ARTEX and Related Infrastructure
The ARTEX case is not solely about understanding the individual capabilities of a particular AI tool.
It is important to continuously track the infrastructure where the tool operates, the tools and services found around it, and how they connect to actual threat activity.
ASEC continues to analyze AI-based offensive and security tools such as ARTEX and the associated infrastructure. Detailed threat intelligence, including analysis findings and IOCs, is available through AhnLab TIP.
AhnLab TIP provides access to a wide range of threat information, including threat actors, attack campaigns, malware, vulnerabilities, and related infrastructure.
As AI advances beyond supporting individual tasks toward coordinating multiple Agents and tools, threat intelligence will become even more important for continuously tracking changing infrastructure and understanding its relationships and context.
- AhnLab
