Most organizations learn about their security through photographs: an audit once a year, a pentest before a big launch, a report that ages the moment the next service ships. Between photographs, the attack surface changes every week — a new subdomain, an endpoint someone exposed “just for a demo”, a dependency that was safe yesterday — and nobody is watching.
ARTEX is our attempt to turn that photograph into something continuous. It is not a scanner with a checklist, and it is not a chat box that suggests commands. It is an autonomous system that runs a penetration test the way a small team would, with a human watching and steering, inside your own infrastructure. This note is about how it is built, how it stays under control, and why its front door is deliberately narrow.
A small team, packaged
The idea that makes it autonomous rather than a fixed script is simple to tell. A planner reads the situation and decides what is worth looking at next. Several workers each claim one direction, run real tools — through a Kali-style shell and HTTP — and write back what they find. Everything they write wakes the planner again. It is a closed loop that runs until the goals are proven.
The division of labour matters, because it is what keeps the system from wandering. The planner thinks but does not execute: it only emits new directions when something is genuinely uncovered. A worker executes but does not invent new work: it claims one direction, carries it to the end, and stops. Most of the planner's wake-ups produce nothing — no new direction, so nothing happens — and that is exactly what you want: a system that knows when to stop.
Two graphs, not one
The second idea is what gives it memory. ARTEX keeps apart what the target is and how far it has tested it.
- The asset graph is the shared truth about what exists: root domains, subdomains, IPs, services, apps, endpoints. Containment and deduplication are computed by the program, not the agent: agents submit raw observations and the database collapses the duplicates.
- The exploration graph is the per-task record of reasoning and progress: goals, intents, facts, findings, connected into a lineage chain that answers “which direction came from which facts, and what did it produce.”
The two graphs cross-reference through anchors: an intent, a fact or a finding is pinned to concrete assets. Real coverage falls out of that — an asset counts as tested when a fact or a finding is anchored to it — and that is what lets you answer the one question that actually matters after a pentest: what have we not looked at yet?
The engine, in one sentence
A graph change wakes the planner; the planner emits intents; a worker claims one and writes back; the write-back triggers the next round. Underneath there are details worth knowing:
- Changes are coalesced over a short window, so a burst of writes becomes a single planning round instead of a hundred. The planner also has a periodic heartbeat that is skipped when nothing has changed, to avoid wasting LLM calls.
- Claiming an intent is a single atomic database update, with an authorization re-check on that intent's assets. Two workers never claim the same thing, and nothing out of scope is ever claimed.
- A task ends when the intent frontier is empty and all goals are met — not because an agent declares victory. Completion is decided by the state of the graph, not by a model's optimism.
- Pausing cancels the in-flight work, not just the next one. A timeout is a wall-clock deadline: at the deadline the engine stops claiming, drains what is running within a grace period, runs one final planning round, and closes.
Safety is not a tab; it is the product
An autonomous system that runs real offensive tools is exactly as useful as it is safe to leave switched on. If containment is weak, it does not matter how clever the planner is: nobody responsible will connect it to anything that matters. So containment is not an optional layer, it is the centre of the design.
Three controls carry almost all of the weight:
- Scope that fails closed. Each task registers an authorized asset scope, with allow and block rules. Authorization is re-checked at claim time, not only at task creation, and on doubt it closes. The boundary between “in” and “out” is a check in the code, not a sentence in a contract.
- Everything is recorded. A recording MITM proxy captures every request and response and authorizes egress. No agent action without a trace, and a finding's evidence is the replayable traffic that produced it — not a screenshot someone has to take on faith.
- An approval gate. Sensitive actions pass through a gate the operator can switch to manual: nothing runs until someone approves it. Autonomous by default, haltable in an instant.
On top of that sits per-tenant isolation — one customer's knowledge and credentials never leak into another's — and the fact that everything runs inside your infrastructure, so neither the target's traffic nor the evidence leaves for a third-party SaaS. For anyone who has had to explain to a regulator where their data lives, that is not a detail.
Why we only license it to publicly accountable organizations
This is where this note parts ways with a normal product brochure. A tool that really attacks is dual-use by definition. The same controls that make it safe inside a responsible organization count for nothing if the tool ends up with someone accountable to no one. So the question of who we give it to is part of the design, not a clause at the end.
Our rule is deliberately narrow: we license ARTEX exclusively to publicly accountable organizations. In practice that means two kinds of entity:
- Companies listed on a regulated market, with the governance, disclosure duties and oversight bodies that come with it.
- Public-sector bodies, which answer to the public and operate under formal authorization frameworks.
What both share, and what we actually care about, is that they are entities able to issue a formal, documented authorization for every system under test, and with a real person who answers if that authorization is misused. It is not an anonymous email address behind a credit card. That is the difference between a penetration test and a crime, and we do not want to be on the wrong side of that line by carelessness.
The rule is also why the asset scope and the approval gate live in the code. A policy that only lives in a contract is broken with one parameter. A policy that lives on the request path — re-checked at every claim, with egress authorized by a proxy — turns “only point it at what you are permitted to” from a hope into a control.
If you are not sure your organization fits, it most likely does not yet, and we will tell you plainly. We would rather have one customer fewer than a tool in the wrong place.
The cost of thinking
An autonomous, LLM-driven system has a cost unlike a scanner's: it scales with how much it reasons, not with how many replicas it has. A badly bounded planning loop could spend a fortune in tokens without finding anything. That is why each task carries a cumulative token budget: spend is measured and capped per task, and when it is exhausted, the task closes down in an orderly way instead of thinking on blindly.
Combined with the heartbeat that skips unchanged rounds and the coalescing of events, the effect is that ARTEX spends when there is something to discover and stays quiet when there is not. That is the same cost discipline we apply to an AI gateway; here it is simply built into the engine.
If the why of keeping inference inside interests you, it is in another note: models that stay inside. ARTEX is the same principle applied to offense instead of product.
The same team operates it
As with everything we ship, we do not drop a binary and vanish. ARTEX lands with deployment on your infrastructure, integration with your identity and telemetry, a runbook, and the same operating contract as the rest of the platform. Its configuration lives in Git and is promoted by digest, with a canary and a rehearsed rollback — because a security tool you cannot operate with confidence yourself is another risk, not a control.
The runbook answers concrete questions: how to start an engagement from a signed scope, how to put the gate into manual during a sensitive window, how to read coverage to know what is missing, and who approves a new asset entering scope. The boring parts done well are what let the autonomous parts be trusted.
If you are a listed company or a public-sector body and want to test your own attack surface continuously instead of once a year, send us two lines about your organization and the scope you have in mind. We return the next steps and the authorization requirements within 24h.