Backdoored ARTEX AI Docker image gave root command execution on 62 internet-facing consoles

TLDR

• A backdoored ARTEX Docker image ran root commands sent to its login page; 62 consoles served it.¹²
• Docker removed both backdoored images on 5 November, but copies already pulled or cached remain backdoored, BadByte says.²
• CERT-In separately warned of AI-driven attacks on Indian financial firms by "Crafty Falcon", naming ARTEX among four tools.³⁴

An independent researcher who goes by Badbyte found 62 ARTEX consoles on the internet serving a backdoored build, out of 1,645 hosts serving the ARTEX console on 4 November 2026, The Hacker News reports.¹ BadByte describes ARTEX as a Chinese-language, open-source AI penetration testing console that pairs a web dashboard with large language model agents that scan, exploit and write up targets on their own.² Censys, which counted exposed consoles separately, says ARTEX was published on GitHub on 26 July 2026 and works with Anthropic, OpenAI or any OpenAI-compatible model endpoint.⁶ On 8 October the developer, who uses the GitHub handle Autumn-27, said the project would no longer be updated and would become closed source, with no further public versions, Reuters reported after CrowdStrike linked ARTEX to attacks on South Korean banks.⁵ BadByte says the notice was posted at 10:50 UTC and that the repository came down.²

BadByte says a new Docker Hub account named tomicdd was created at 18:50 UTC the same evening and pushed an ARTEX image at 19:41, and that a GitHub account named trhhubsd then uploaded a copy of the source with one line changed to point at that image.² The Hacker News reports that the changed line is in docker-compose.yml and pulls the tomicdd/artex image.¹ BadByte says the copy's source matches upstream, so a code review finds nothing, and that the binary was built from a commit plus uncommitted changes that no public source contains.² The backdoor is a hidden verifyCaptcha() function in the login handler: if the captcha field starts with a secret marker, the rest runs through sh -c as root and the output is returned before any credential check, the researcher told The Hacker News.¹ BadByte says the container runs as root with the database password and any model API keys in its environment, and that the compose file publishes port 8787 on all interfaces.² It adds that a compromised console holds its targets' unpatched findings, live credentials, captured sessions and network position, and that whoever holds the backdoor can change what the agents do on later runs.¹²

On the counts, The Hacker News says the first backdoored console was up by 20 October, twelve days after the image was pushed, and that of the 62, 26 were in the United States, 17 in Hong Kong and seven in China.¹ BadByte says 46 of the 62 were still serving the backdoored build at 09:55 UTC on 4 November, and that 637 GitHub repositories still point their compose file at the image.² The sources differ on download figures. The Hacker News gives about 9,000 downloads, citing Docker Hub statistics.¹ BadByte's headline figure is 7,946 pulls by 3 November, before disclosure, made up of 7,913 for tomicdd/artex and 33 for congdonglinux/artex, and its page lists final counts of 9,131 and 45 before removal.² Censys counts 1,465 exposed ARTEX console hosts, against BadByte's 1,645, and says about 650 sit in two blocks of identically configured hosting.⁶

BadByte says Docker removed both backdoored images, tomicdd/artex and congdonglinux/artex, on 5 November after its request, that they can no longer be pulled by tag or digest, and that the tomicdd account was deleted.² It warns that any copy already pulled, or cached on a third-party mirror, is still backdoored, and that updating does not remove it because the update script pulls the same image.² The Hacker News lists several other Docker Hub namespaces publishing images named artex, and BadByte says only two images carried the backdoor.¹² The backdoored build serves a fixed UI build ID on every page, which BadByte says separates it from clean installs.² The CERT-In advisory, issued on 4 November as CIAD-2026-0058, is a separate notice: it names the threat actor CRAFTY FALCON and lists ARTEX, PentAGI, Cairn and CyberStrikeAI as tools used against non-bank lenders, fintech firms, payment firms and cryptocurrency exchanges, calls the threat active and ongoing, and advises prohibiting unauthorised offensive tools, monitoring LLM API usage and keys, and rotating credentials after an incident.³ CNA reports that CERT-In did not say the attacks were state-sponsored or which incidents were linked to the group.⁴ BleepingComputer separately reports that WorkOS founder Michael Grinich said the attacker who breached the company's internal sales app used ARTEX.⁷

Why it matters: BadByte says people who installed ARTEX from a copy to test it, or to attack others, ran an unauthenticated root shell on their own server, with their stored model keys and engagement data in reach.²