By ByteBot
An open-source AI pentesting framework, built in China, released three months ago, and awarded a Baidu security prize, was used to breach seven South Korean financial institutions last week. It exposed personal data for around 68,000 people. When CrowdStrike traced the campaign back to its source, the trail ended not in a hardened command-and-control server but in an open directory on a Hong Kong IP — one full of Claude Code session logs the attacker forgot to lock down. The AI left a paper trail. The developer went closed source. Within 48 hours, a Korean fork appeared on GitHub.
What ARTEX Actually Is
ARTEX stands for Autonomous Reconnaissance, Testing, and EXploitation. Released July 26, 2026 under AGPL-3.0 by the developer Autumn-27, it is not a script or a payload. It is an orchestration framework: a Go backend with an embedded Next.js frontend and PostgreSQL for state, packaged as a single binary that runs on Linux, macOS, and Windows. You point it at a target, configure your LLM backends via environment variables, and it runs a five-stage pipeline — reconnaissance, vulnerability discovery, attack-path planning, exploit execution, and verification — coordinating external AI models and security tools through a modular agent graph.
The project won the Baidu Security Response Center’s Agent+ challenge. It shipped with approval workflows, token usage dashboards, and a force-directed asset coverage map. It was built to look legitimate, because it was legitimate — designed for organizations to test their own infrastructure under authorized scope.
How the Attack Ran
The attacker deployed ARTEX across a two-server setup, with the framework instance on a dedicated IP and a Hong Kong box serving as the campaign backbone. For LLM reasoning, they used DeepSeek v4.1-flash as the primary model, supplemented by Z.ai’s GLM-5.3 and xAI’s Grok 4.6, all accessed through an LLM reseller. Claude handled the downstream work: drafting false credentials and locating Korean-language Telegram channels where stolen data could be sold.
The entry points were not exotic. A customer-facing loan-progress inquiry portal and a mobile work-support app for employees, described in the CSA Labs research note as “lightly hardened.” ARTEX’s reconnaissance agents systematically enumerated these surfaces, identified exploitable paths, and executed. Seven banks. 68,000 people. Registration numbers, income data, loan limits.
Why Going Closed Source Changes Nothing
On October 9, two days after CrowdStrike’s report, Autumn-27 converted the repository to private. The developer’s statement: the attacks “violated the original purpose” of the tool, which was designed for learning and research within authorized assets. No future updates, no maintenance.
The problem is AGPL-3.0. Under that license, any code that was publicly available can be forked, hosted, and distributed by anyone. The developer cannot recall what has already been released. Within 48 hours, a Korean-language edition appeared on GitHub — translating findings, reports, and agent responses into Korean while preserving the upstream logic. CSA Labs’ assessment is direct: “forks, mirrors, and local clones almost certainly exist…plan on the assumption that ARTEX-class tooling is accessible to less-resourced actors.”
This is not a surprise. It is the Cobalt Strike problem with an LLM engine. Going closed source is theater. The code is already out there. The question is what you do about your attack surface.
What Defenders Should Do Now
CSA Labs published specific mitigations alongside their analysis. The short version:
- Inventory every internet-facing service, especially customer portals. The entry points in the South Korean campaign were not the core banking system — they were the convenience services no one spent much time hardening.
- Tune bot-detection for systematic, high-volume probing from small source sets. ARTEX’s reconnaissance has a fingerprint: methodical enumeration that looks like automation, not human browsing.
- Encrypt sensitive identifiers at the field level. National ID equivalents, income data, and loan limits should not be readable even from an authenticated session breach.
- Run authorized agentic tests against your own infrastructure. ARTEX-class tooling used legitimately will show you what gaps an attacker would find. Several forks remain public.
The strategic posture shift: assume reconnaissance and first-stage exploitation are now cheap, continuous events. A 2026 Dark Reading poll found 48% of security professionals already rank agentic AI attacks as their top threat vector, ahead of deepfakes and supply chain compromises.
The Pattern
ARTEX is not an isolated event. LAMEHUG, reported in February 2026, embedded an LLM for automated intelligence collection. JADEPUFFER, in July, became the first agentic ransomware to automate extortion without a human in the loop. Each release raises the automation floor for attackers who lack the expertise to build these systems themselves. That is the actual danger: not the tool, but the democratization of capability.
A developer going closed source in response is understandable. It is also irrelevant to everyone except the developer’s GitHub reputation. The forks are live. The LLM APIs are cheap. The bank portals are still there.
