An AI agent that pentests your assets while you watch

What it does

ARTEX runs AI agents that autonomously explore and test your attack surface — domains, subdomains, IPs, ports, sites, endpoints — and report findings. It’s a Go backend with a Next.js frontend, backed by PostgreSQL, and it needs an LLM key (Anthropic or OpenAI) to do its exploration. Assets can be synced straight from ScopeSentry so you don’t re-collect what you already have.

The interesting bit

The human-in-the-loop design: agents propose actions, and an interception/approval system lets you review and approve the risky ones before they execute. There’s also a force-directed asset coverage graph showing what’s been tested, plus traffic recording so you can audit exactly what the agent did.

Key highlights

• Asset graph exploration with tested nodes highlighted and collapsible
• Approval records with expandable detail across global, task, and chat views
• One-click in-app updates with SHA256 verification, smoke tests, and automatic rollback after 3 failed boots
• Single embedded binary (frontend baked in) or Docker image with common tools (nmap, ripgrep, playwright) preinstalled
• Idempotent schema migration on every startup — “restart is the migration”

Caveats

• Updates restart the process, interrupting running tasks — do it when idle
• Under Docker, updates swap the program but not the image, so bundled tools don’t upgrade
• This is a fork of Autumn-27/ARTEX under AGPL-3.0; old official builds point at the original repo, so first-time switchers must install this build manually

Verdict

Worth a look if you run recon/pentest workflows and want an agent that does the tedious exploration while you keep veto power. If you don’t have assets to test or an LLM budget to burn, it’s not for you.