What happened
RST Cloud’s November 2, 2026 article reports 1,341 unique internet-exposed IPs hosting Cairn, ARTEX or PentAGI consoles, based on its combined Shodan and Netlas findings. Its breakdown is 56 Cairn, 834 ARTEX and 459 PentAGI hosts. These figures are lower bounds: the company says no scanner sees everything, and some consoles run on non-default ports or use renamed and forked builds. The article compares its count with Censys findings but says those results could not be deduplicated against its own data and are excluded from the total.
The three projects are open-source AI penetration-testing harnesses that can plan and run tools, inspect results, and choose subsequent steps without a human in the loop. RST Cloud describes Cairn as having no authentication by default. ARTEX hosts sometimes present HTTP Basic authentication, while PentAGI presents a login page and default credentials that should be changed on first use. The article stresses that an authentication challenge or login screen does not make public exposure safe.
The reported incident most directly relevant to exposed panels comes from NorForge, which RST Cloud says documented two clusters, AIA0009 and AIA0010, hijacking exposed Cairn consoles. The operators allegedly stole LLM API keys and SSH keys, then deployed Poseidon. RST Cloud also summarizes separate campaigns involving ARTEX: it cites activity attributed in other reporting to Storm-0940 and VAPOR PANDA, and describes rapid, automated activity. Those examples concern the broader use of the harnesses, not proof that every exposed host is malicious.
To find consoles, RST Cloud combined passive data from Shodan, Netlas and Censys, looking beyond titles to ports, certificates, favicons and page or template markers. It says title-only searches were noisy and missed renamed forks. Its methodology counted unique IPs, with services reported separately, and included selected targeted Netlas scans of non-standard ports. The company says it did not access any console. It recommends that legitimate red-team operators put these tools behind a VPN or authenticating proxy and never expose the console port.
What the archive adds
New Runtime reported on November 7, 2026 that Censys found 1,465 publicly exposed ARTEX consoles (earlier coverage). On October 24, 2026, New Runtime also covered a ConnectWise breach attributed to a China-aligned group using ARTEX (earlier coverage). RST Cloud adds a multi-tool exposure count and the reported hijacking of Cairn panels; this is a new fact in a known story about exposed offensive harnesses.
Trend signal
This supports the pattern that agent security depends on runtime boundaries: an exposed harness can expose credentials and enable actions, regardless of what instructions its model receives. The relevant pattern is agent security moves to runtime boundaries. The report concerns security implications of exposed tools, not a new runtime control product.
Why now
RST Cloud dates its measurements to November 2, 2026 and frames them against a fall in which AI-enabled penetration-testing harnesses have appeared in reported intrusions. The timing matters because renamed builds and non-standard ports make an inventory based only on default titles or ports increasingly incomplete, according to the company.
Connections to other events
New Runtime’s October 24, 2026 coverage described ARTEX being used in a ConnectWise-related intrusion. RST Cloud’s account adds that exposure of the harnesses themselves can create another attack path: operators may lose credentials through a hijacked console even when the panel was intended for legitimate testing.
Why it matters
A penetration-testing harness is both a tool for authorized security work and a control surface that can hold valuable access. If a console is reachable without effective authentication, another operator may be able to use the harness or harvest credentials associated with it. That changes the defensive question from “Are we running this software?” to “Where is its interface reachable, and what credentials or actions can it control?”
For teams, the report argues for treating these consoles like sensitive administrative interfaces: keep them off the public internet, put them behind a VPN or an authenticating proxy, and rotate API and SSH credentials if exposure or compromise is suspected. Asset discovery also needs to account for forks, renamed applications and non-standard ports. RST Cloud’s counts are not a census, but the gap between default-title searches and broader fingerprinting illustrates why a simple banner search is not enough.
Limits and uncertainty
RST Cloud’s counts are explicitly lower bounds, and its methodology combines multiple scanners with targeted scans rather than a complete census of the internet. The company says it did not access consoles; exposure therefore does not establish compromise or malicious use. Its account of Cairn hijacking relies on NorForge’s reporting, and the article does not quantify how many exposed panels were actually taken over. Scanner results also vary substantially, while hosting country does not identify the operator’s location. The reported VirusTotal scores are not reliable evidence that an exposed host is safe or malicious.
Skill to build now
This week, inventory any Cairn, ARTEX or PentAGI instances your team operates. Check external reachability across non-default ports, not just the product’s usual port or title; then place each console behind a VPN or authenticated proxy. If a panel was exposed, review and rotate the API and SSH credentials it could access.
Reader takeaway
Exposed AI pentesting consoles can put the operator’s own credentials and infrastructure at risk. Treat these harnesses as privileged control panels: keep them off the public internet, and do not mistake an exposed service—or a clean reputation score—for evidence that it is safe.