Trojanized ARTEX Docker image gave unauthenticated root shells on 62 consoles
What happened
A researcher using the alias BadByte reported that a prebuilt copy of the ARTEX AI penetration-testing console on Docker Hub contained a hidden routine that runs commands as root through the login form's captcha field. The image was pulled roughly 9,000 times, and 62 internet-facing consoles served the backdoored build between 2 and 4 November.
The malicious logic was in the prebuilt tomicdd/artex image, not the visible source. A hidden routine runs the remainder of a captcha value that starts with a secret marker, which has not been published, through a shell as root. The earliest backdoored console seen was on 20 October, and the 62 consoles identified between 2 and 4 November were 26 in the US, 17 in Hong Kong, seven in China and 12 unspecified. The original developer removed ARTEX from GitHub, and a fork has 2,449 stars and more than 600 forks. On 4 November 1,645 hosts served an ARTEX console of any build. It is not established whether the backdoor was used against the consoles' owners or their targets.
How it happened
Supply chain and access: Poisoned package. A malicious or tampered AI package, extension, plugin or MCP server was published and installed by users.
The software involved works with many AI models, so no single model maker was involved. The product was ARTEX, a type of AI building block.
Impact
Data was exposed. Data involved: credentials. There is no evidence that anyone actually accessed the data.
Severity is rated Low, calculated from how far the incident reached and how sensitive the data was.
Was the AI at fault?
No. The failure was in the systems, settings or people around the AI, not in the model's behaviour.
Status and timeline
Reported in the press or by researchers, but not confirmed by the affected organization, the AI vendor or a regulator.
It became public on 5 Nov 2026.