ARTEX, PentAGI, Agent Zero and other AI hacking frameworks run on the public internet, some consoles lack authentication

Article title: AI Hacking Frameworks Like ARTEX, PentAGI, and Agent Zero Found Running on Internet-Accessible Servers

Body:

Multiple AI-driven hacking and penetration testing frameworks are currently running on publicly accessible internet servers, and some of these frameworks' management consoles have no authentication configured and are fully open to the public.

Shodan snapshot data from November 7, 2026, shows that a total of 1,428 services on the public internet belong to the ARTEX family, 419 services match PentAGI characteristics, and 173 services match Agent Zero characteristics, indicating that the spread of these tools is already quite broad.

These platforms connect language models with security tools, enabling agents to run commands, verify results, and autonomously decide the next step.

Such tools can be used for legitimately authorized penetration testing, but attackers can likewise exploit these capabilities to automate reconnaissance, exploitation, credential theft, and other activities. However, the mere fact that a service is publicly accessible is not proof that the corresponding server is being used for criminal activity.

In a technical investigation report published on November 9, GitGuardian researchers disclosed these internet-exposed framework deployment instances. This investigation focuses on insecure deployments of dual-use frameworks, not on a newly discovered malware family.

The research team reviewed approximately 45 open-source projects in total and extracted fingerprint signatures for 41 of them, which defenders can use to locate related deployment instances on the public internet.

32 AI Hacking Frameworks Fall into Five Categories, Default Configurations Carry Authentication Risks

GitGuardian grouped 32 frameworks into five major categories: cyberattack automation, web application and API testing, C2 integration, coding agent wrappers, and research prototypes. The remaining projects are forks or variants of these frameworks. Of the 41 frameworks evaluated, 11 have a web management interface enabled by default, 18 expose services only under specific configurations or have no obvious identifying features on the root page, and the remaining 12 do not set up a network listening port.

PentAGI can dispatch agents to call tools such as Nmap, Metasploit, and sqlmap. This design supports agents in automatically moving between asset discovery, vulnerability testing, and report generation, consistent with descriptions in previous reporting on PentAGI penetration testing automation. GitGuardian counted a total of 419 services matching PentAGI characteristics, of which 233 use default certificates; results obtained through separate searches by page title or certificate characteristics differ in number, and results from different dimensions cannot be directly added together to count the total number of independent servers.

Agent Zero's lack of authentication is even more pronounced. Of the 173 services matching the characteristics, 134 display a login page, while the remaining 39 are completely open with no authentication required. GitGuardian noted that Agent Zero is a general-purpose agent that ships without authentication configured by default, not a dedicated hacking tool. It was included in this count because cases of attackers attempting to exploit the tool have already emerged, and because a powerful agent being directly accessible from the public internet is itself a risk.

ARTEX is the largest framework family visible on the public internet. GitGuardian noted that the original project author deleted the original project on October 8 after receiving abuse reports, but 102 code forks and repositories with the same name appeared during the week of deletion. Previous reporting on ARTEX stealing GitHub credentials showed that attackers could use exposed application keys to access cloud resources such as Azure Key Vault.

In the code audit, the research team also distinguished between built-in framework features and task modules that agents can assemble on their own. Only four frameworks—Pojun, Cybermes, Xalgorix, and AIRecon—have built-in secret scanners connected to agents. None of the evaluated frameworks has a built-in GitHub data scraping module. Some of the remaining projects only provide instructions for using scanning features without actually integrating a usable scanner; none of the evaluated tools, including PentAGI, showed secret-hunting capabilities.

But the absence of such features does not mean there is no risk. Almost all frameworks provide shell access and web access, and language models can obtain missing tools or build corresponding workflows on their own during operation. Previous reporting on credential exposure risks for AI agents also noted that even without malicious code, an agent's routine activity can bring secrets into logs, interaction records, or model context.

For defenders, the distinction is critical: an exposed management console is a clear access control risk, while fingerprint matching can only serve as a discovery lead. GitGuardian only published detection signature descriptions this time and did not disclose a target list of exposed instances, making it easier for organizations to check their own related deployments. Statistics obtained from different search rules vary, so enterprises must complete verification before treating search results as evidence of exposed deployments or compromise.

Detection Indicators for Compromise Published to Guide Enterprises in Self-Checking Deployments

Note: Relevant IP addresses and domains are defanged (for example, replacing . with [.]) to prevent accidental resolution or redirection. Original addresses can only be restored in controlled threat intelligence platforms such as MISP, VirusTotal, or an enterprise's internal SIEM.

AI Hacking Frameworks Like ARTEX, PentAGI, and Agent Zero Found Running on Internet-Accessible Servers