We found 1,698 Internet-visible AI offensive-security endpoints. Here's what the data reveals.

ARTEX's Internet-visible footprint grew from three matching services in June 2026 to 1,255 on November 3. ARTEX is an AI-powered security testing framework whose agents can coordinate a series of technical tasks with less human intervention. Researchers have also documented its use in real intrusions, making the growth in visible infrastructure worth investigating.

Most vulnerability scanners follow predefined checks. Frameworks such as ARTEX, PentAGI, and Cairn use AI agents to run security tools, interpret their output, and decide what to try next. Security professionals can use them for authorized penetration tests, while attackers can apply the same capabilities to intrusion attempts.

On November 3, Gcore Parallax, our threat intelligence research initiative, identified 1,698 matching endpoints across 1,590 IP addresses. Among them, 101 PentAGI endpoints shared a TLS certificate and frontend, suggesting a common deployment setup. Comparing the full IP inventory with Gcore's web application security telemetry also revealed suspicious requests reaching applications across several industries.

AI agents are changing how security tools operate

The key difference is the feedback loop. An agent can run a security tool, read the result, and use that information to decide what to test next. This allows a series of checks to develop into a longer investigation without someone choosing every step.

An operator sets a target and an objective. The framework can then coordinate several tools and follow up on their output, depending on its capabilities and permissions. This may include credential testing, exploration of internal systems, or activity after an initial compromise.

ARTEX coordinates multiple agents across the stages of an intrusion or penetration test. PentAGI orchestrates AI agents alongside established tools such as Nmap, Metasploit, and SQLmap. Cairn uses AI workers to explore possible paths between an initial target and a defined objective.

On October 21, Microsoft reported that the China-state-aligned actor Storm-0940 had used ARTEX to automate attacks against hundreds of organizations. Microsoft observed instances in which the actor obtained privileged cloud access less than three hours after initial targeting.

On October 29, CrowdStrike described a separate campaign involving ARTEX and an actor it tracks as VAPOR PANDA. A day later, Google Threat Intelligence Group and Mandiant detailed the use of ARTEX, PentAGI, Cairn, and related frameworks in real-world intrusions.

From three ARTEX endpoints to 1,255

The 1,698 matching endpoints break down as follows:

An endpoint represents a service identified by its IP address, port, and transport protocol. An IP address can expose multiple services, and seven addresses appeared in more than one framework inventory. That's why the combined IP total is lower than the sum of the individual totals. ARTEX dominates the results, accounting for nearly 74% of the identified endpoints.

Our matching-results series found three ARTEX services in June 2026, 18 in July, 72 in August, and 754 in September. The November 3 collection returned 1,255, an increase of 501 endpoints, or 66.4%, between September and November 3.

These counts measure Internet-visible services matching a fingerprint, not new installations or independently operated attack platforms. A visible console isn't necessarily accessible to unauthorized users, vulnerable, or used maliciously.

A shared TLS certificate across 101 PentAGI endpoints

The clearest sign of a shared deployment configuration appeared in AS398823. Here, 101 PentAGI endpoints on 101 distinct IP addresses presented the same self-signed TLS certificate. A TLS certificate helps establish an encrypted connection and identify the service presenting it. All 101 endpoints also served identical HTML on port 8666 and reported the same Last-Modified value. Among the 376 PentAGI endpoints with available certificate fingerprints, the next most frequently reused certificate appeared on just seven endpoints. Together, these fingerprints strongly suggest a common deployment configuration or gateway.

ARTEX showed a similar pattern in AS54600. Of 375 ARTEX endpoints there, 305 across 251 IP addresses shared the same HTML fingerprint and nginx web server version. Much of that concentration sat in two /24 networks, each a block of 256 IP addresses.

Both autonomous systems, AS398823 and AS54600, are registered to PEG Tech; RAKsmart identifies itself as a PEG Tech brand. Together, they accounted for 479 of 1,698 endpoints (28.2%) and 424 of 1,590 unique IP addresses (26.7%). The concentration spans ARTEX and PentAGI, with no Cairn endpoints matched in these two ASNs.

A common software image, a deployment template, or shared gateway infrastructure could explain the matches. The fingerprints cannot identify who operates the consoles, and the hosting provider's role does not imply involvement in malicious activity.

From Internet-visible services to web traffic

An Internet-wide scan shows where a matching service can be found. To look for related activity, we compared the IP addresses from our inventory with Gcore's web application and API protection (WAAP) request logs for October 2 through November 3, 2026. A small subset appeared in the logs. We examined the requests from those addresses, including high-volume login activity and probes of potentially sensitive paths, to learn what the service inventory alone could not tell us.

We followed the matching addresses into the request patterns. Some ARTEX-associated sources repeatedly contacted WordPress login and administration pages; others requested configuration files, backup archives, and administrative interfaces. These requests reached applications serving government agencies and international organizations, as well as businesses in gaming, retail, e-commerce, telecommunications, and technology. Seeing similar probing across unrelated sectors helps reveal a wider pattern that any one website might miss.

The IP addresses showing suspicious activity did not overlap with the concentrated PEG Tech hosting groups described earlier. The hosting clusters and the WAAP observations are separate findings. An associated IP address also cannot establish which software generated a particular request.

How we conducted the research

Gcore Parallax collected the ARTEX, PentAGI, and Cairn inventories on November 3, 2026. We identified matching services using framework-specific fingerprints. The Cairn results were additionally checked against recognizable elements of the project's frontend. Each service endpoint was counted separately, while IP addresses were deduplicated across the combined inventory

We enriched the findings with network metadata, including autonomous system information. The ARTEX growth series uses historical monthly matching results through September 2026 and a separate live observation from November 3.

To examine associated traffic, we correlated the IP inventory with aggregated Gcore WAAP request records covering October 2 through November 3. The traffic patterns were classified using reported request rates, URL paths, and cross-domain activity.

The research measures visible infrastructure and associated traffic. It does not identify every deployed framework, establish the operator behind each console, or prove that a particular AI agent executed an observed request.

What defenders can learn from these findings

Gcore's findings suggest two priorities for defenders: track the growth of Internet-visible AI security-tool infrastructure and recognize suspicious activity associated with some of its IP addresses. The investigation found similar service fingerprints, high-volume login requests, and probing across applications. Those patterns give security teams specific leads to investigate.

Monitor authentication activity. We observed high-volume requests to WordPress login and administration paths from an ARTEX-associated address. Watch for unusual request rates, and test rate limits or challenges against legitimate traffic before enabling enforcement.

Detect reconnaissance. The associated traffic included requests for configuration files, backup archives, and administrative interfaces. Look for repeated probing across different paths and applications.

Correlate behavior across applications. Compare request timing, URL patterns, headers, and client fingerprints across sites. Activity affecting login pages on several websites can be easier to recognize when those logs are examined together. IP reputation alone rarely tells the full story.

Protect your own security consoles. These tools have legitimate uses, but administrative access needs strong authentication and sensible restrictions. Review public endpoints and keep the software updated.

An emerging infrastructure ecosystem

ARTEX's Internet-visible inventory grew sharply, and 101 PentAGI endpoints shared a TLS certificate and frontend, pointing to a repeatable deployment setup. In a separate analysis, Gcore's WAAP telemetry revealed suspicious requests from toolkit-associated addresses reaching applications across unrelated industries. These findings give Parallax concrete patterns to track as the infrastructure evolves.

Parallax will examine how these deployment clusters change and whether new traffic patterns appear from associated IP addresses. Internet-wide measurements reveal the services and their shared technical characteristics; application telemetry provides another view through requests reaching protected websites. Bringing those observations together is how we aim to 'See the threat from every angle.'