AI Hacking Frameworks Like ARTEX, PentAGI, and Agent Zero Found Running on Internet-Accessible Servers

AI-powered hacking and penetration-testing frameworks are running on internet-accessible servers, with some management consoles left open without authentication.

A November 7, 2026, Shodan snapshot recorded 1,428 services matching the ARTEX family, 419 matching PentAGI, and 173 matching Agent Zero, showing how widely these tools have spread.

These platforms connect language models to security tools, allowing agents to run commands, examine results, and decide what to do next.

They can support authorized testing, but attackers can use the same features to automate reconnaissance, exploitation, and credential theft. Public visibility alone, however, does not prove that a server supports criminal activity.

Researchers from GitGuardian identified the exposed deployments in a technical investigation published November 9. Their findings concern dual-use frameworks and insecure deployments, not a newly discovered malware family.

The team examined roughly 45 open-source projects and assessed 41 for fingerprints that defenders could use to locate internet-facing installations.

AI Hacking Frameworks

GitGuardian cataloged 32 frameworks across five groups: network attack automation, web application and API testing, command-and-control integration, wrappers around coding agents, and research prototypes.

Other projects were forks or variants. Across the 41 assessed frameworks, 11 served web interfaces by default, 18 exposed services only in certain configurations or lacked distinctive root pages, and 12 had no network listener.

PentAGI coordinates agents using tools such as Nmap, Metasploit, and sqlmap. As explained in earlier coverage of PentAGI penetration testing automation, this design helps agents move between discovery, testing, and reporting.

GitGuardian counted 419 matching services, including 233 with the default certificate, while separate title and certificate searches returned different totals. These measurements should not be combined into a unique-server count.

Agent Zero showed a clearer authentication gap. Of 173 matching services, 134 displayed a login page and 39 were open. GitGuardian described Agent Zero as a general-purpose agent without authentication by default, rather than a dedicated hacking tool.

Its inclusion reflects reported attacker experimentation and the risks created when powerful agents become publicly reachable.

ARTEX remained the largest visible family. GitGuardian reported that its creator removed the original project on October 8 following reports of abuse, but 102 forks and similarly named repositories appeared during that week.

Earlier reporting on ARTEX GitHub credential theft documented how attackers used exposed application secrets to reach cloud resources, including Azure Key Vault.

The code review also separated built-in functions from tasks an agent could assemble itself. Only Pojun, Cybermes, Xalgorix, and AIRecon shipped a secret scanner connected to the agent.

None contained a GitHub fetcher. Several other projects supplied instructions without working scanner integration, while reviewed tools including PentAGI had no identified secret-hunting capability.

That limitation does not eliminate the risk. Almost every framework supplied shell and web access, allowing a model to obtain missing tools or build a workflow at runtime.

Coverage of AI agent credential exposure also explains how ordinary agent activity can move secrets into logs, transcripts, or model context, even without malware.

For defenders, the distinction matters: an exposed console is an access-control concern, while a fingerprint match is only a discovery lead. GitGuardian published detection descriptions rather than a target list so organizations could identify their own deployments.

Different queries produced different counts, making validation essential before treating a result as an exposed installation or evidence of compromise.

Indicators of compromise (IoCs):-

Note: IP addresses and domains are intentionally Qdefanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Give your SOC the alert context on the latest threats to stop incidents quickly -> Integrate Threat Intel from 16K SOCs

The post AI Hacking Frameworks Like ARTEX, PentAGI, and Agent Zero Found Running on Internet-Accessible Servers appeared first on Cyber Security News.