Artex, The Hacking Tool of the Hour

Artex is the latest hacking tool in the news. Not because it's the best pentesting tool since Metasploit (it isn't), but because it's the right tool at the right time to make some digital waves.

We decided to run it through Tenzai’s internal benchmarks to see how good it is compared to how bad the internet is.

What Artex Is

Artex is an AI hacking agent with a usable UI and good-enough offensive capabilities. That combination is why it’s the tool of the moment for cybercriminals. 

Artex requires users to bring their own LLM keys. When paired with the latest Chinese open-weight models, available at substantially lower inference prices than leading SOTA models, Artex can deliver real results at an affordable cost. There’s no surprising feature, no special sauce. It’s simply good enough to get the job done. A year ago open-weight models couldn’t pull this off; today they can.

A perfect storm made this tool reach headlines, starting from South Korea and rapidly spreading from there around the world.

What Tenzai Found

We ran our attacks on our internal web application evaluations, measuring how well Artex finds vulnerabilities and reports them.

There are many forks of the original Artex, we tested using this fork (https://github.com/BaaRai/ARTEX). 

On recall, Artex (using Deepseek 4.1 Flash 1017) sits in the top half of publicly available offensive agents we benchmark from time to time. It ranks above generic coding agents, and below commercial security agents. On precision, it is noisy, and for an AppSec team trying to triage findings, that noise is a problem. For someone who is running an operation to breach a network and move laterally in it, this tool will do the trick.
‍

Framing matters. Artex is a hacking tool, and not a security tool (for defensive purposes). For victims, this distinction is small; but for defenders this means a lot. It won't scale across a large team and it's not as reliable.

Dangerous and fragile

Artex is impressively customizable: you can define new tools and skills for the agent mid-run, directly in the UI. It's useful and fun when it's your personal setup and a massive complication to standardize. If every scan has a different configuration and different behavior, it’s hard to reliably test applications.

We can imagine how the flexibility is addictive. The operator runs into a problem, SSHes, installs a new tool into the container, provides a skill they found online and adds it, steps in at the right moment to do the job themselves. 

This is a hacking tool and the usage model reflects that, with no standardized configurations or output formats, no user management and no connection to any Application Security tooling.

The hacking agent itself operates outside any sandbox with direct access to the LLM key, admin database, and admin control panel. Any successful prompt injection gives the attacker system access and a path to data exfiltration. That's dangerous as we expect to see more and more anti-agent traps out there. 

To be very blunt: Don't run Artex anywhere sensitive.

There’s another complication: which Artex are you actually running? Since the original repository went offline, forks, rebrands, and repackaged Docker images have continued to circulate. Some come with an unwelcome extra, like third-party images containing a backdoor that allows unauthenticated command execution as root inside the container. Before pointing a tool like this at your environment and handing it API keys, make sure you know where your copy came from.

Yet another warning sign

Artex represents how the floor of attack capabilities keeps going up. The assumption that "we're doing the basics, so we're probably fine compared to easier targets" is no longer a safe bet.  The assumption that you can be too small to attract notice or just be tougher than your neighbor to break in is no longer valid. AI based attackers that are flexible and adapt themselves at scale take these assumptions down one by one.

We're moving from the vulnapocalypse - the rapid discovery of vulnerabilities - to the breachapocalypse: the systematic exploitation of existing vulnerabilities in systems we rely on.

And while the PHP vulnerabilities didn't turn into internet-scale worms, Artex also won't hack every exposed application. But the direction is clear, and the pace is not slowing down.

What to do

If this is your wake-up call, good. The job is to test your own environment before someone else's agent does it for you: across your web apps, APIs, and AI surfaces, against the same techniques these tools use.

‍