What is this?
ARTEX is an AI-driven autonomous penetration testing system with a Go backend (embedding a Next.js frontend) where LLM-powered agents plan and execute security testing against assets. It won first place in Baidu's 'Agent+' attack-defense challenge.
ARTEX is an AI-driven autonomous penetration testing system with a Go backend (embedding a Next.js frontend) where LLM-powered agents plan and execute security testing against assets. It won first place in Baidu's 'Agent+' attack-defense challenge.Is this a CLI tool or a full application?It is a self-hosted web application: a single Go binary that embeds the Next.js frontend, backed by PostgreSQL, with a dashboard for tasks, assets, and agent approvals rather than a plain command-line tool.
It is a self-hosted web application: a single Go binary that embeds the Next.js frontend, backed by PostgreSQL, with a dashboard for tasks, assets, and agent approvals rather than a plain command-line tool.How do I install and run ARTEX?The recommended path is a one-click install script that detects/installs Docker and lets you pick full Docker deployment or local compile; you can also use Docker Compose manually, download a precompiled binary from Releases, or build from source, then open /setup to create the admin password.
The recommended path is a one-click install script that detects/installs Docker and lets you pick full Docker deployment or local compile; you can also use Docker Compose manually, download a precompiled binary from Releases, or build from source, then open /setup to create the admin password.Do I need a database and an LLM API key before starting?Yes — PostgreSQL is required, and you need an ANTHROPIC_API_KEY or OPENAI_API_KEY (set via environment variables or configured in the UI) for the agents to explore and attack targets.
Yes — PostgreSQL is required, and you need an ANTHROPIC_API_KEY or OPENAI_API_KEY (set via environment variables or configured in the UI) for the agents to explore and attack targets.Can I point ARTEX at a real website or live system?No — the project explicitly restricts use to personal learning, code study, and local technical verification; scanning, probing, exploiting, or attacking any online or networked system is strictly forbidden regardless of authorization.
No — the project explicitly restricts use to personal learning, code study, and local technical verification; scanning, probing, exploiting, or attacking any online or networked system is strictly forbidden regardless of authorization.How does the dual-graph architecture work?ARTEX splits 'what the target looks like' from 'what has been tested' into two linked graphs: a global Asset Graph of domains/IPs/services/endpoints, and a per-task Exploration Graph of goals/intents/facts/findings, connected by anchors so progress can be traced back to specific assets.
ARTEX splits 'what the target looks like' from 'what has been tested' into two linked graphs: a global Asset Graph of domains/IPs/services/endpoints, and a per-task Exploration Graph of goals/intents/facts/findings, connected by anchors so progress can be traced back to specific assets.How do the planner and worker agents coordinate?A planner goroutine keeps a shared to-do list across wake-ups and dispatches 'intents' to multiple worker agents per task; workers can search each other's execution traces to avoid redoing work, and a dedicated retester agent later re-verifies whether findings were actually fixed.
A planner goroutine keeps a shared to-do list across wake-ups and dispatches 'intents' to multiple worker agents per task; workers can search each other's execution traces to avoid redoing work, and a dedicated retester agent later re-verifies whether findings were actually fixed.Can I pull in assets I've already collected elsewhere?Yes, ARTEX can sync asset data directly from ScopeSentry by entering its address and API key, then import domains, subdomains, IPs, ports, and sites into its asset graph for agents to explore.
Yes, ARTEX can sync asset data directly from ScopeSentry by entering its address and API key, then import domains, subdomains, IPs, ports, and sites into its asset graph for agents to explore.Does it update itself safely?The built-in updater downloads the new release, verifies its SHA256 checksum, smoke-tests the binary before swapping it in, and automatically rolls back to the previous version if the new one fails to start three times in a row.
The built-in updater downloads the new release, verifies its SHA256 checksum, smoke-tests the binary before swapping it in, and automatically rolls back to the previous version if the new one fails to start three times in a row.What are similar projects?ARTEX, ARTEX, artex-global, Decepticon, StrikeAgent_AtkBrain-Flash, turnstone, T3MP3ST, Pentest-Swarm-AI
ARTEX, ARTEX, artex-global, Decepticon, StrikeAgent_AtkBrain-Flash, turnstone, T3MP3ST, Pentest-Swarm-AIWhich topics is it in?mitm, sse, vulnerability, jwt, red-team, pentesting, penetration-testing, autonomous-agents, cybersecurity, nextjs, agpl, security-tools
mitm, sse, vulnerability, jwt, red-team, pentesting, penetration-testing, autonomous-agents, cybersecurity, nextjs, agpl, security-tools