AntiFox: ARTEX Fork With 362 Exposed Hosts Claimed

AntiFox is an open-source AI penetration-testing platform that describes itself as a secondary development of ARTEX. In early November 2026 a social-media post from the researcher behind The Raven File claimed 362 hosts were running it, mostly on port 80. We confirmed what AntiFox is and how it relates to ARTEX from its own pages. We could not confirm the host counts. A count of exposed consoles is not a count of attacks or victims.

Who this is for: CISOs, SOC and exposure-management leads, and anyone who runs a red team.

We opened the AntiFox README and wiki, the ARTEX wiki and the researcher's GitHub profile and repository on 5 November 2026, and we did not run any of these tools. We could not open the original post. PlayCISO is not affiliated with any project or researcher named. This post gives no commands and no way to find other people's consoles, and it does not copy any host, IP address or hash from the indicator repository: we link to it.

What happened

Google GTIG and Mandiant reported on 30 October 2026 that threat actors were abusing ARTEX, an open-source multi-agent pentesting platform, in real intrusions; see our post on what GTIG found. GTIG also says the original ARTEX repository was taken down in October and that forks keep circulating. Researchers have since counted internet-exposed consoles of this family; our post on exposed consoles covers the RST Labs count.

Shortly before 5 November a post from the account behind The Raven File added AntiFox to that list, listing it alongside ARTEX and a tool it called CyberStrike, and saying 362 hosts were running it. The same researcher's GitHub repository has a matching file name. The AntiFox project itself says it is a fork of ARTEX that adds report-delivery work. So "AntiFox is related to ARTEX" is confirmed by the project; "AntiFox is just ARTEX renamed" is a stronger reading that its own pages do not support, since it describes added features.

Timeline

What AntiFox is

Per its README and wiki, AntiFox is a Go backend with an embedded Next.js front end backed by PostgreSQL. It inherits ARTEX's exploration-graph engine, traffic recording, human-in-the-loop interception and multi-agent orchestration, and adds structured reproduction steps and formatted reports. It calls a model through an Anthropic or OpenAI API key. Admin access starts with a password set at first visit, and the wiki lists role-based permissions and login auditing. Its disclaimer says it is for personal learning and local validation, prohibits testing online systems and carries no warranty. The README is mainly in Chinese with an English version.

What an exposure count does and does not mean

• It measures reachability. A host that answers like a console is exposed. That says nothing about intent, and many will be a researcher, student or red team that forgot a firewall rule.
• It is not victims or attacks. No source we read ties these hosts to an intrusion.
• Counts drift. Cloud addresses are reassigned, so a list goes stale and may name an innocent party. Do not block or report a host on a third-party list without checking it yourself.
• The risk is still real. A console that holds model API keys and can run tools, left open, is a gift to anyone who finds it, whoever owns it.

What security leaders should do this week

• Ask who is running offensive tooling. Ask engineering and red-team leads whether anyone has installed an AI pentest platform, and where. A short list of owners beats a hunt.
• Look for unauthenticated consoles on your own ranges. Check your own address space for web consoles of this family, using your attack-surface tool or the Open Agent Exposure Scanner on hosts you own. Do not scan other people's.
• Alert on the documented ports and on new web apps. The AntiFox and ARTEX documents give 8787 as the default; the claim says port 80 is common, so a new, unrecognised web app on a server is the better signal than any one port.
• Watch egress from hosts that should not call model APIs. A pentest platform needs to reach an LLM provider. Unexpected calls to model APIs from servers are worth a look; practise cutting them off in the agent egress containment lab.
• If you run one yourself: keep it on localhost or behind a VPN, allow-list the source networks, set the admin password immediately, never expose it directly to the internet, and rotate the model provider API key if it was ever reachable.
• Handle a found console as an incident until owned. If no one claims it, isolate the host and follow your usual process; the hunt plan review helps scope the search.
• Score the wider picture with the Agentic Attack Readiness Scorecard.

Where this fits

If you are weighing these tools for legitimate testing, our agentic pentesting master guide compares them, and Executioner is an example of a local-first environment. The difference defenders care about is not the code but the deployment: authenticated, private and logged, or open to the internet.

Frequently asked questions

What is AntiFox?

AntiFox is an open-source, AI-driven autonomous penetration testing platform. Its README and wiki describe a multi-agent system (a planner, workers and a main agent) that handles work from reconnaissance to a delivered report, with a web UI. It is licensed AGPL-3.0 and its README says it is for personal learning, code research and local technical validation only.

Is AntiFox a new framework or a rebranded ARTEX?

By its own account it is a secondary development ("二次开发") of ARTEX, started from ARTEX v0.1.1, crediting ARTEX's author and adding a stronger focus on report delivery. So it is a fork with extra features, not an unrelated project. Whether any given running instance is a lightly renamed copy is a researcher's reading, not something the project says.

Does the 362 figure mean 362 attacks or 362 victims?

No. The figure is a claim from a social-media post about hosts found with AntiFox running, which is an exposure count. It says nothing about who runs those hosts, whether they are authorised testers, or whether anyone has been attacked. We could not open the post, and the number is unverified.

Is AntiFox malicious?

Nothing we read says so. It is published as a pentest framework with usage restrictions. Google GTIG says threat actors abused ARTEX in real intrusions; GTIG's report is about ARTEX and the other frameworks it names, and we found no source establishing that AntiFox itself has been abused.

What port does AntiFox use?

The AntiFox README and wiki say the web UI and API are served on port 8787 and give http://localhost:8787 as the example; the ARTEX wiki gives the same default and says the UI binds to 127.0.0.1 unless the operator changes it. The social-media claim that most of the 362 hosts use port 80 is unverified.

Why does an exposed pentest console matter?

These consoles hold LLM provider API keys, target data and the ability to run tools, and their admin setup relies on a password set at first visit. A console reachable from the internet is a risk to its owner, and on a corporate network it is also an indicator that someone is running offensive tooling you may not know about.

What should I do if I find one on my network?

Find the owner first. If it is an authorised test, move it off the internet, put it behind a VPN or allow-list, confirm an admin password is set and rotate the LLM API keys it holds. If nobody owns it, treat it as an incident: isolate the host and start your normal investigation.

Where is the IOC list?

The researcher behind the claim publishes indicators in the TheRavenFile Daily-Hunt repository on GitHub, which has an entry named "AntiFox AI". We link to it and do not copy it. Treat any third-party list as unverified: addresses get reassigned, and a host on the list may belong to an innocent party.

Sources

• AntiFox-AI/antifox README (open-source AI pentest platform, secondary development of ARTEX)
• AntiFox wiki (architecture, licence, port, disclaimer)
• ARTEX wiki (BaaRai/ARTEX: default port, binding, setup)
• Google GTIG and Mandiant: ARTEX and Friends: Enter Agentic Offensive Frameworks (30 October 2026)
• TheRavenFile / Daily-Hunt on GitHub (researcher's indicator repository; unverified third-party list)
• Original social-media post and reply: not opened by us; figures attributed, not confirmed.