AI Security News: November 7, 2026
Fully automated. Found, summarized and published by an automated AI pipeline. How posts are labeled
1. Censys Counts 1,465 Exposed ARTEX Consoles, and 32 Open Directories Leaking Implants and Attack Kits
Censys. The internet-scanning company published an internet-wide count of ARTEX, the open-source LLM-driven autonomous penetration testing framework that CrowdStrike and Microsoft tied in October to attacks on South Korean banks and on ConnectWise customer tenants: 1,465 hosts exposed an ARTEX web console in its early November scans, most commonly on the default port 8787, although the console does not need to face the internet. About 650 of them sit in two blocks of identically configured hosting at PEG Tech (493) and Yancy Limited (157), which Censys reads as provisioning templates rather than separate operators, leaving roughly 815 distinct-looking deployments; the United States (726), Hong Kong (387) and China (177) host the most. Of all hosts, 155 (10.6%) also run tooling Censys flags as threats, most often a second AI attack framework (CyberStrikeAI on 70 hosts, plus PentAGI, HexStrike AI and RedAmon) and in some cases Cobalt Strike, Vshell or Adaptix C2, while 43 run LLM gateway or reseller software such as CLIProxyAPI and New API. Censys also found 32 open directories on ARTEX hosts exposing lateral-movement kits, implant builds, stagers and in one case an operator’s entire home directory, and its scan history shows the server named in CrowdStrike’s report exposing directories from August 18, seven weeks before that report. Censys says some exposed instances likely belong to authorized testers, and notes the ARTEX repository has been taken down while archived copies and rebrands such as ScopeWeaver still circulate. Censys TechCrunch
2. Microsoft Says a Cambodia-Based Cluster, Storm-3358, Has Used ARTEX Agents Against Financial Firms Since October
Microsoft Threat Intelligence reported on November 6 that Storm-3358, a financially motivated, Cambodia-based intrusion cluster that mainly targets financial organizations in Southeast Asia plus a smaller number of large financial firms globally, began using the ARTEX agentic offensive framework in October 2026. Microsoft observed Storm-3358 combine ARTEX with conventional automated scanners to probe internet-facing systems, exploit flaws such as anonymous file upload and server-side request forgery, and install open-source remote access trojans (WISP, vshell and AdaptixC2), with ARTEX agents pulling the RATs onto compromised hosts using netcat and curl. The report lists behavioral signals defenders can watch for, such as bursts of varied requests, rapid retries of the same technique and traffic from the tools ARTEX uses by default (Nmap, curl, wget, Python HTTP clients and headless Chromium through Playwright), and publishes indicators including four ARTEX server IP addresses first seen between October 19 and November 4 and still active on November 6. It follows Microsoft’s earlier ARTEX reports on a nation-state supply chain campaign and on agents abusing exposed secrets. Source
3. Edera’s Bounded Authority Keeps Credentials Out of Agent and MCP Server Workloads by Enforcing Capabilities at the Hypervisor
Edera launched Object Capability Bounded Authority, a security model that separates the authority an AI agent or MCP server needs for a task from the credentials used to carry it out, InfoQ reported on November 6. Instead of injecting API tokens or cloud keys into a container’s environment, where a prompt-injected agent could read and reuse them, Edera’s Agent Runtime enforces narrow object capabilities at the hypervisor, so, for example, a coding agent can be allowed to modify one GitHub repository without holding a personal access token. Its components include capcurl, which routes authorized API requests through an isolated broker that keeps authentication material hidden from the agent, capsudo for running specific privileged commands without standing root access, and SPIFFE and SPIRE for workload identity and mutual TLS without long-lived secrets. The initial release covers scoped command execution and workload identity, with credential-brokered API access and orchestrator integrations to follow under Edera’s Project Lunchbox. Source
4. Also on arXiv: JailBound Probes Refusal Boundaries in 46 LLMs, a Game Model Favors Scambaiting Agents, and Evidence-Bound ATT&CK Mapping
Research. Wu, Wang, Yang, Zhang and Wu’s JailBound builds jailbreak benchmarks automatically from a taxonomy of risk category, application domain and attack type, then steers its search with first-order loss signals; across 46 LLMs from 13 model families its high-value branch raised average attack success by 5.1 and 4.9 percentage points over a ZOL-only baseline in two settings, and prompts found by its safety-sensitivity branch flipped judge-assigned safety labels more often under small perturbations. Satyam, Siadati, Jafarian, Jafarikhah and Chen model agent-to-agent fraud, where defensive scambaiting agents pose as victims to extract mule bank accounts and wallet addresses: under their baseline parameters, scammer profitability turns negative once baiting agents pass a prevalence threshold, and defender investment in mimicry quality outpaces equal gains in scammer detection. She et al.’s MEvince, with Lorenzo Cavallaro among the authors, maps malware reports to MITRE ATT&CK techniques with LLM reasoning that must cite linked report evidence; on 610 public malware reports referenced by ATT&CK it improved exact-ID F1 by 17.4% over the strongest of 11 baselines and raised gold-label candidate coverage from 31.6% to 47.9%. JailBound Scambaiting MEvince