# Backdoored ARTEX Docker image (tomicdd/artex) gives anyone an unauthenticated root shell · pwn.watch > After the author of ARTEX, an open-source AI penetration-testing console abused in attacks on banks, took the GitHub repository down on Oct 8 2026, a copycat repository (trhhubsd/ARTEX, the most-starred copy) changed one line in docker-compose.yml to pull a Docker Hub image, tomicdd/artex, pushed the same day. BadByte found that the image's binary, unlike the clean GitHub source, adds a hidden verifyCaptcha() function to the login handler: if the CAPTCHA field starts with a secret marker, the rest runs through sh -c as root and the output is returned, before any credential check. The image had 7,946 pulls by Nov 3 (about 9,000 by Nov 5), 637 GitHub repositories still pointed their compose file at it, and 62 internet-facing consoles served the backdoored build between Nov 2 and 4. congdonglinux/artex is a byte-identical re-push. If you ran either image, treat the host and every key in the container (database password, LLM and search API keys, harvested target credentials, JWT signing key) as compromised, rebuild from reviewed source and keep the console off the open internet. Page: https://pwn.watch/i/artex-ai-pentest-backdoored-docker-image-tomicdd · generated 2026-11-05T14:39:04.572Z ## Status - Severity: high · status: live · patch: partial - Product: ARTEX AI penetration-testing console, Docker images tomicdd/artex and congdonglinux/artex - Started: 2026-10-08 - Affected: tomicdd/artex:latest (index digest sha256:ce85d8369ccc1a85423f1f75d2f3afaa2fab759e580da37a6891af2f7392745e); congdonglinux/artex:latest (same digests); Any compose file pointing at tomicdd/artex, including trhhubsd/ARTEX and its forks such as imxv/ARTEXX - Fixed in: No fix for the trojanized image: stop it, treat the host as compromised and rebuild from reviewed source; BadByte found other third-party ARTEX images it checked clean ## Follow this incident - RSS (one item per update): https://pwn.watch/i/artex-ai-pentest-backdoored-docker-image-tomicdd/feed.xml - JSON Feed: https://pwn.watch/i/artex-ai-pentest-backdoored-docker-image-tomicdd/feed.json - Full data (timeline, sources, posts, agentBrief): https://pwn.watch/i/artex-ai-pentest-backdoored-docker-image-tomicdd.json - This file: https://pwn.watch/i/artex-ai-pentest-backdoored-docker-image-tomicdd/llms.txt ## Updates (newest first) - 2026-11-05: The Hacker News reports the backdoor alongside a CERT-In warning about AI-assisted attacks on Indian financial firms using tools including ARTEX; tomicdd/artex is at about 9,000 pulls. (https://thehackernews.com/2026/11/backdoored-docker-image-for-artex-ai.html) - 2026-11-04: BadByte publishes its analysis: 7,946 pulls, 637 repos still pulling the image, 62 backdoored consoles seen (46 still live) and 1,645 ARTEX consoles online. (https://badbyte.io/artex-backdoor-docker-image/) - 2026-11-02: Dan Tentler (Viss) reports on Mastodon that the Docker image, not the GitHub code, is backdoored, via the captcha system. (https://badbyte.io/artex-backdoor-docker-image/) - 2026-10-20: First backdoored ARTEX console visible on the internet; congdonglinux/artex registered with the identical image. (https://badbyte.io/artex-backdoor-docker-image/) - 2026-10-08: ARTEX's author says the tool was abused, takes the GitHub repo down; that evening Docker Hub account tomicdd is created, pushes tomicdd/artex, and trhhubsd swaps the compose image to it. (https://badbyte.io/artex-backdoor-docker-image/) ## Fix brief # Security brief: Backdoored ARTEX Docker image (tomicdd/artex) gives anyone an unauthenticated root shell Source: https://pwn.watch/i/artex-ai-pentest-backdoored-docker-image-tomicdd · status: live · severity: high · updated Nov 5, 2026, 10:00 UTC ## Patch status **PARTIALLY PATCHED: some fixes exist, but not every affected branch/product is covered. Check carefully and apply mitigations where no fix exists.** ## What it is After the author of ARTEX, an open-source AI penetration-testing console abused in attacks on banks, took the GitHub repository down on Oct 8 2026, a copycat repository (trhhubsd/ARTEX, the most-starred copy) changed one line in docker-compose.yml to pull a Docker Hub image, tomicdd/artex, pushed the same day. BadByte found that the image's binary, unlike the clean GitHub source, adds a hidden verifyCaptcha() function to the login handler: if the CAPTCHA field starts with a secret marker, the rest runs through sh -c as root and the output is returned, before any credential check. The image had 7,946 pulls by Nov 3 (about 9,000 by Nov 5), 637 GitHub repositories still pointed their compose file at it, and 62 internet-facing consoles served the backdoored build between Nov 2 and 4. congdonglinux/artex is a byte-identical re-push. If you ran either image, treat the host and every key in the container (database password, LLM and search API keys, harvested target credentials, JWT signing key) as compromised, rebuild from reviewed source and keep the console off the open internet. Severity detail: Unauthenticated root command execution on every install of the trojanized image; about 9,000 pulls and 62 exposed backdoored consoles seen - Product: ARTEX AI penetration-testing console, Docker images tomicdd/artex and congdonglinux/artex ## Affected versions - tomicdd/artex:latest (index digest sha256:ce85d8369ccc1a85423f1f75d2f3afaa2fab759e580da37a6891af2f7392745e) - congdonglinux/artex:latest (same digests) - Any compose file pointing at tomicdd/artex, including trhhubsd/ARTEX and its forks such as imxv/ARTEXX ## Check whether you're affected No generic command applies (the product is a hosted service, appliance or desktop app). Check the installed version in its admin UI / About screen and compare with the versions above. ## Fix Upgrade to one of these fixed versions (or later on the same branch): - No fix for the trojanized image: stop it, treat the host as compromised and rebuild from reviewed source; BadByte found other third-party ARTEX images it checked clean After upgrading, re-run the checks above and redeploy/restart the affected services. ## Mitigations The data marks this as partial. Until every affected component is fixed, apply the vendor mitigations from the advisories below (restrict network exposure of the affected service, disable the vulnerable feature if the advisory allows). ## Secrets to rotate This incident involves possible credential exposure. Rotate any credentials (API keys, tokens, env vars, SSH keys) that were present on affected systems or in affected builds while vulnerable/compromised versions were installed, and review access logs. ## Latest updates - Nov 5, 2026: The Hacker News reports the backdoor alongside a CERT-In warning about AI-assisted attacks on Indian financial firms using tools including ARTEX; tomicdd/artex is at about 9,000 pulls. - Nov 4, 2026: BadByte publishes its analysis: 7,946 pulls, 637 repos still pulling the image, 62 backdoored consoles seen (46 still live) and 1,645 ARTEX consoles online. - Nov 2, 2026: Dan Tentler (Viss) reports on Mastodon that the Docker image, not the GitHub code, is backdoored, via the captcha system. - Oct 20, 2026: First backdoored ARTEX console visible on the internet; congdonglinux/artex registered with the identical image. - Oct 8, 2026: ARTEX's author says the tool was abused, takes the GitHub repo down; that evening Docker Hub account tomicdd is created, pushes tomicdd/artex, and trhhubsd swaps the compose image to it. ## Write-ups & news - [ARTEX Backdoor: 7,946 Pulls of a Trojanized Docker Image Handing Out Root Shells](https://badbyte.io/artex-backdoor-docker-image/) - [CERT-In Flags AI-Driven Attacks as Backdoored ARTEX Exposes 62 Consoles to Root Access](https://thehackernews.com/2026/11/backdoored-docker-image-for-artex-ai.html) ## Caveats BadByte says the backdoor is only in the prebuilt tomicdd/artex binary (sha256 d5070f52262effe216b840711343bff8f2787f39208d887d8dfd9c673f8d1573, UI build ID 3aC1db3gGU08O4UHbAt4J), not in any public source, and that 62 is a floor because 590 more consoles run unversioned builds it could not tell apart from outside. Its Detection section has commands to check your own install. Related: the WorkOS breach, where the attacker used ARTEX. --- Machine-readable: https://pwn.watch/i/artex-ai-pentest-backdoored-docker-image-tomicdd.json · all incidents: https://pwn.watch/incidents.json. Verify against the vendor advisory before changing production systems.