Unit 42: 1,323 hosts run CyberStrikeAI and 609 run ARTEX

01What happened

Unit 42 published a defender guide to ARTEX and AI-powered red teaming tools on November 11, 2026, written by Cuong Dinh, Richard Emerson and Samantha Stallings. The team counted internet-facing hosts running the two most common frameworks and analyzed 14 tools across the ecosystem. The guide draws on Unit 42 incident response and managed threat hunting cases, including intrusions where the attacker's server hosted an ARTEX console.

02How it works

Agent-driven intrusions leave a timing signature, because the operator's tooling waits while the model thinks. Unit 42 observed bursts of one to 14 requests about a second apart, followed by pauses of 25 to 31 seconds. In one case more than 200 client secrets were validated in about three minutes, and one host polled every 48 seconds for three days. Operators also used bogus canary usernames and placeholder values before real attempts.

03Who is affected

Organizations with public attack surface are the targets, in particular those exposing OpenAPI specifications, source maps, and configuration files holding tokens or client IDs, plus self-service registration and password reset flows. Unit 42 reports that some intrusions reached cloud access through public password reset pages and exposed APIs without exploiting any software vulnerability, sometimes in under a day.

04What to do

Remove public OpenAPI specs, source maps and config files carrying tokens or client IDs, and require authentication on every write endpoint, including dev and staging. Rate-limit and bot-protect registration, password reset and verification flows, and drop unauthenticated account-existence checks. Hunt for behavior rather than indicators: canary usernames, a cloud key's first use from a new IP, and write-then-delete storage tests.

Sources 2 links, all fetched

1. 1unit42.paloaltonetworks.comUnit 42 Research
2. 2unit42.paloaltonetworks.comUnit 42 Cairn Report