CERT-In has confirmed that a manipulated Docker image attributed to ARTEX—a once openly observed agentic penetration-testing framework—contains a backdoor giving unauthenticated attackers full root access to affected servers. Between November 2-4, 2026, 62 public ARTEX consoles were observed running this backdoored build, with the first compromised instance appearing by October 20, just 12 days after the Docker image was published. 26 of the vulnerable consoles are in the U.S., 17 in Hong Kong, and seven in mainland China.
What Went Wrong: The Backdoor Explained
The issue stems from a manipulated Docker Compose setup that swapped the legitimate ARTEX image for a malicious image hosted as tomicdd/artexon Docker Hub. This altered version includes a concealed verifyCaptcharoutine in the login endpoint: when the CAPTCHA field is submitted with a secret marker prefix, the backend executes an arbitrary shell command as root, bypassing any credential check. Legitimate tools like ARTEX are often trusted, but this insertion was never subjected to careful code review.
Scale, Proliferation & Risk
More than 1,600 instances were serving ARTEX consoles as of November 4, though only a fraction ran the compromised image. Multiple Docker Hub namespaces bearing images named “artex” were identified—many hosting identical malicious builds. Namespaces such as congdonglinux/artex, mianhuatang11/artex, autumn26/artex, among others, were implicated.
The impacted tool, ARTEX, is part of a new wave of AI-powered, agentic exploit frameworks. Designed to automate reconnaissance, privilege escalation, and lateral movement, it was originally released under public GitHub repositories. Its creator removed the official versions in October 2026 amid growing evidence of abuse. However, forks and mirrored versions persist, sometimes under alternate names.
Broader Threat Context & CERT-In Guidance
The manipulated ARTEX image and similar tools—PentAGI, CAIRN, CyberStrikeAI—are being leveraged by threat actors in the Banking, Financial Services, and Insurance sectors in India, with private key theft, API-credential compromise, and abuse of automation. CERT-In warns that many of these attacks involve exposed credentials, lack of multi-factor authentication, exposed APIs, misconfigured non-production environments, and hidden endpoints. Attackers are using stolen long-lived tokens, plaintext credentials, and supply-chain compromises to breach systems.
The Indian agency has published AI Security Auditing Guidelines urging stronger governance: agent identities, permission boundaries, human oversight, emergency interruption, credential revocation, and least privilege principles must become standard for any AI or agentic attack surface.
Even non-malicious users running ARTEX—or people trying it out in curiosity—may unknowingly enable root-level shell access simply by deploying the compromised image. No special action beyond using the unauthenticated login endpoint with the secret marker in the CAPTCHA field was required.
What this means: even open-source security tools are becoming attack vectors if compromised images circulate unchecked. Users who assumed ARTEX worked only with user-level permissions now may have exposed entire servers. Monitoring, careful vetting of Docker images and dependencies, and strict authentication are no longer optional; they’re essential.
