Huntback found an ARTEX fork that scores possible honeypots and changes the agent's behavior. An offensive agent's console holds its targets and its power to act, so lock it down like a critical internal system.
From the Field Notes:
Autonomous pentest agents are being left exposed and turned into attacker infrastructure
In one minute
RST Cloud counted 1,341 internet-exposed consoles for the Cairn, ARTEX and PentAGI pentest harnesses, and Censys separately observed 1,465 exposed ARTEX consoles. RST Cloud says attackers used hijacked panels to steal credentials and deploy malware.