Beyond ARTEX: GitGuardian maps 45 agentic pentest frameworks

01What happened

GitGuardian's research team published a catalog of roughly 45 open-source agentic pentest frameworks on November 9, 2026, each one wiring a language model into a loop that runs offensive tools. The team sorted 32 of them into five families and treated the rest as forks or variants. ARTEX's author took that project down on October 8, 2026, 74 days after its first commit, and 102 ARTEX-named repositories and forks appeared in the takedown week alone.

02How it works

Family membership follows what the loop does: network kill chain tools such as PentAGI run recon through post-exploitation from a Kali container, web-app and API tools such as Strix test applications, C2-integrated builds run inside frameworks like Mythic, harnesses wrap a general coding agent with offensive skills, and research prototypes come out of academic work. Only four builds ship a secret scanner wired to the agent, but GitGuardian notes that the shell and web access these tools hand the model puts a scanner download or a GitHub search one improvised tool call away. A lab run published the next day backs that up: an ARTEX build with no scanner used git and grep to recover 8 of 9 planted credentials, including one deleted a commit after it was added, and started hunting 6 to 13 seconds in even under a prompt that never mentioned secrets.

03Who is affected

Operator consoles, not victims, are what the fingerprints find: 11 of the 41 frameworks GitGuardian assessed serve a web UI on a network port by default, 18 do so only in some setups and 12 have no listener at all. On November 7, 2026, Shodan matched 1,428 services in the ARTEX family, 419 PentAGI and 173 Agent Zero, of which 134 sat behind a login and 39 were open. Risk clusters in a few heavily forked bases rather than the most-starred projects: the most-starred tool in the catalog, Strix, ships no secret-hunting code, while Pojun, with fewer than a hundred stars, wires gitleaks into its worker prompt.

04What to do

Hunt for your own exposed consoles first, using the fingerprint descriptions GitGuardian published instead of a target list. Treat every credential reachable from a repository these agents could read as exposed and revoke it rather than deleting it, because the lab run recovered a key from git history one commit after deletion. Scan whole repositories and their history, not only the files at the current commit.

Sources 3 links, all fetched

1. 1blog.gitguardian.comGitGuardian Research
2. 2blog.gitguardian.comLab Run On ARTEX
3. 3censys.comCensys Exposure Scan