{"id":"nr-autonomous-pentest-agents-are-being-left-exposed-and-turned-into-attac-76cbdd","slug":"autonomous-pentest-agents-are-being-left-exposed-and-turned-into-attac-76cbdd","type":"raw_signal","title":"Autonomous pentest agents are being left exposed and turned into attacker infrastructure","description":"RST Cloud counted 1,341 internet-exposed consoles for the Cairn, ARTEX and PentAGI pentest harnesses, and Censys separately observed 1,465 exposed ARTEX consoles.","observed_at":"2026-11-08","record_date":"2026-11-08","date_kind":"observed_at","novelty":"notable","source_platform":"newruntime.com","topics":[],"entities":["RST Cloud","Cairn","ARTEX","PentAGI","NorForge","Poseidon","Censys","ScopeSentry","CrowdStrike","Microsoft"],"related_patterns":["agent-security-moves-to-runtime-boundaries"],"source_url":"https://rstcloud.com/hunting-ai-harnesses-cairn-artex-pentagi","source_urls":["https://rstcloud.com/hunting-ai-harnesses-cairn-artex-pentagi","https://censys.com/blog/artex-agentic-asbestos","https://huntback.io/blog/artex-fork-learns-to-spot-honeypots"],"why_it_matters":"RST Cloud counted 1,341 internet-exposed consoles for the Cairn, ARTEX and PentAGI pentest harnesses, and Censys separately observed 1,465 exposed ARTEX consoles. RST Cloud says attackers used hijacked panels to steal credentials and deploy malware. Huntback found an ARTEX fork that scores possible honeypots and changes the agent's behavior. An offensive agent's console holds its targets and its power to act, so lock it down like a critical internal system.","verification_level":"source-linked","signal_type":"synthesis","synthesis_of":[{"slug":"the-hijacked-cairn-how-exposed-ai-pentesting-panels-6d112b","title":"The Hijacked Cairn: How Exposed AI Pentesting Panels Become Attacker Infrastructure","url":"https://newruntime.com/posts/the-hijacked-cairn-how-exposed-ai-pentesting-panels-6d112b/"},{"slug":"censys-finds-1-465-publicly-exposed-artex-ai-38ea2e","title":"Censys finds 1,465 publicly exposed ARTEX AI pentest consoles; TechCrunch covers the exposure","url":"https://newruntime.com/posts/censys-finds-1-465-publicly-exposed-artex-ai-38ea2e/"},{"slug":"huntback-dissects-artex-fork-honeypot-detection-and-anti-bf6de8","title":"Huntback dissects ARTEX fork honeypot-detection and anti-AI-trap defenses","url":"https://newruntime.com/posts/huntback-dissects-artex-fork-honeypot-detection-and-anti-bf6de8/"}],"schema_version":"newruntime-agent-readable-v0.2","stable_id":"signal:autonomous-pentest-agents-are-being-left-exposed-and-turned-into-attac-76cbdd","retrieval_nugget":"RST Cloud counted 1,341 internet-exposed consoles for the Cairn, ARTEX and PentAGI pentest harnesses, and Censys separately observed 1,465 exposed ARTEX consoles. RST Cloud says attackers used hijacked panels to steal credentials and deploy malware.","status":"published","visuals":[],"editor":{"role":"editor","name":"Andrey Reshetnikov","profile":"https://newruntime.com/owner-profile.md","profile_json":"https://newruntime.com/owner-profile.json","same_as":["https://www.linkedin.com/in/reshetnikov1/","https://t.me/lapetuse"]},"routes":{"html":"https://newruntime.com/signals/autonomous-pentest-agents-are-being-left-exposed-and-turned-into-attac-76cbdd/","markdown":"https://newruntime.com/signals/autonomous-pentest-agents-are-being-left-exposed-and-turned-into-attac-76cbdd.md","json":"https://newruntime.com/signals/autonomous-pentest-agents-are-being-left-exposed-and-turned-into-attac-76cbdd.json"},"markdown_url":"https://newruntime.com/signals/autonomous-pentest-agents-are-being-left-exposed-and-turned-into-attac-76cbdd.md","next_reads":[{"type":"collection","path":"/signals/","url":"https://newruntime.com/signals/","title":"Signals","reason":"Open the signals and the raw-signal archive.","media_type":"text/html","json_url":"https://newruntime.com/signals.json"},{"type":"collection","path":"/sources/","url":"https://newruntime.com/sources/","title":"Sources","reason":"See the original sources this archive cites.","media_type":"text/html"}]}