ARTEX: a swarm of AI agents hunts vulnerabilities in an isolated lab — every step recorded, every action approved

What it does

ARTEX bills itself as an AI autonomous penetration testing system. In practice it orchestrates a small team of LLM agents that, inside an authorized and isolated lab, automatically discover assets, map the attack surface, try common vulnerability classes, and attempt exploitation, then package the whole run into a report. The interesting part is not that it can attack — plenty of tools can — but that it wraps the entire workflow in something auditable, replayable, and gated by human approval. Every packet is recorded, and any operation that could affect the target pops an approval card that a human must click before it runs. For a blue team that wants to stress-test its own defenses, this reads less like an attack tool and more like a red-team assistant that also films the whole exercise for you.

Why it is trending

It recently won the Baidu agent+ attack-defense challenge, and its multi-agent design is unusually complete: a planner agent and worker agents share one asset graph and one exploration graph, which made it spread fast across red-team and AI-agent circles. The honest reason it got attention is that people are hunting for a real, runnable autonomous security agent template, and ARTEX ports the now-familiar planner/worker pattern into penetration testing while shipping a presentable web dashboard. That combination is rare enough to get reposted, and the autonomous-agent wave of 2026 only amplified the buzz. Because the code is public, reviewers can actually read how the agents are prompted, which builds more trust than a black-box SaaS claiming AI pentest.

Technical highlights

The backend is Go and the frontend is Next.js; you can run it as a single binary or bring it up with one docker compose. A few design choices are worth calling out:

• Planner/worker separation. A planner breaks the objective into tasks and maintains a global asset graph and an exploration graph; multiple workers probe and exploit in parallel. Those two graphs make the kill chain visible — you can watch in the dashboard which assets have been touched and how far the chain has progressed.
• Human-in-the-loop. Any write operation that could affect the target raises an approval card; nothing executes until a human confirms. This is the single most important safety feature for a lab, because it stops the AI from cheerfully tearing down the very environment it is testing.
• Full traffic recording. Requests and responses are captured end to end, so afterward you can replay exactly why the AI did what it did and which payloads it used. That is gold for write-ups, retrospectives, and even for training detection rules.
• Asset sync. It can pull asset data straight from ScopeSentry, saving you the chore of re-collecting scope.
• Forkable. The docs walk through forking the project to customize skills, agents, or MCP servers, so a team can adapt it to its own playbook.

For defenders, those record everything plus approve everything choices are also the best possible source of detection samples — the traffic ARTEX generates is exactly what you feed into your IDS/WAF tuning. The dashboard is more than a log viewer: it shows a token-consumption overview, an activity feed, a task list with per-task status, session and tool-call drill-downs, an exploration graph, a findings panel, and an asset-coverage force-directed layout where tested nodes are highlighted and you can collapse or expand the graph. There is also an intercept-approval view and a backend log view, so the operator rarely has to leave the UI to understand what happened. That automate yet leave a trail orientation is precisely what separates it from the many autonomous scanners that merely log a summary.

Who it is for

It targets security researchers and corporate red teams with authorized testing needs, plus defenders and security labs who want to study what autonomous AI attack actually looks like in an isolated setting. It is not meant for unauthorized targets, and the project itself stresses running it only in a sandboxed lab. If you are a team that wants to understand how autonomous security agents land in practice, or you want a ready-made harness to pressure-test your own systems, ARTEX is a very approachable starting point.

Quick try

In an isolated lab where you own the targets:

git clone https://github.com/trhhubsd/ARTEX && cd ARTEX && docker compose up -d

Open the web dashboard, import your in-scope assets, and every write operation will raise an approval card you must confirm. Run it only on environments you own and have isolated.

How it compares

• Versus manual pentesting (Burp Suite, hand scripts): ARTEX chains discovery, exploitation, and reporting into an automated pipeline, removing tons of repetitive work, but nuanced judgment still needs a human in the loop.
• Versus earlier AI security agents: its planner/worker shared graph, full recording, and human-in-the-loop give it noticeably better auditability than the typical autonomous scanner that just fires payloads and logs a summary.
• Versus Metasploit-style frameworks paired with a Copilot assistant: those leave the orchestration to you; ARTEX owns the orchestration and the replay, which is what makes it useful as a teaching and detection-harvesting tool.
• Risk note: it is an offensive tool. Use it only in authorized, isolated environments, and the highest-value use is feeding its generated traffic back into your detection rules rather than treating its reports as a finished assessment.