ARTEX AI — The Autonomous Pentest Tool That Left Traces in the Serial Bank Hacks

Traces of an autonomous penetration testing tool called ARTEX AI were found on some of the IPs used in the attacks that breached seven financial firms in early October. The suspicion is that open-source software published on GitHub for security testing was abused in the attacks.

The scope of damage and intrusion routes at the seven firms, including Shinhan, KB Kookmin, and Hana Bank, were covered in an earlier post.

Seven Korean Financial Firms Breached in a Row — The Entry Point Was Staff-Facing Systems

Concept image of several AI agents exploring a system — Source: concept image · self-generated with agy

What ARTEX AI is

ARTEX is an open-source program that has a large language model (LLM) carry out the penetration testing process on its own. Penetration testing (mock hacking) is a check in which authorized security staff find and report a system’s weaknesses using the same methods as real attackers.

The repository description says in Chinese that it is an “AI autonomous penetration testing system,” and states that it was the winning project of an agent attack-and-defense competition hosted by Baidu.

Item	Details
Released	July 26, 2026
Where	Open source on GitHub
License	AGPL-3.0
AI it connects to	External LLM APIs
Interest (October 7)	1,722 stars · 399 forks
Developer notice	Do not test real systems

The developer wrote in the README that it should be used only for personal study, code research, and verification in locally isolated environments. There’s also a line saying not to scan, probe, or attack online services, whether authorized or your own assets. However, this restriction is the author’s separate request, not part of the license, so it’s not a mechanism in the program that restricts use.

What it automates

A human penetration tester goes through information gathering, vulnerability discovery, attack path planning, tool execution, and result verification in turn. ARTEX splits these stages among AI agents.

[Planning agent] Takes a goal, breaks it into small tasks, and decides what to do next

[Multiple execution agents] Take the split tasks in parallel, run security tools, and record the results

[Asset records] Consolidates the domains, servers, and services found at the target organization in one place

Electronic Times pointed out about this design that because the overall intent is split into tasks and handed to each agent, the LLM’s safeguards find it hard to detect the attack intent.

Soongsil University’s AI Safety Research Center tested the tool against a mock bank system. Given only a one-line instruction to prove whether others’ records could be looked up without authentication, the agent retrieved 100 mock customer records without authentication in about 6 minutes. It used only a 27-billion-parameter-class public model and a consumer graphics card, and center director Choi Dae-seon said neither expert hacking skills nor massive infrastructure was needed.

This tool only quickly finds and verifies weaknesses already exposed on the internet; it can’t create vulnerabilities that don’t exist. The test target was also a mock system with a deliberately unauthenticated lookup path.

What’s confirmed and what’s estimated in the financial-sector incidents

Timeline of AI attack tools and the serial financial-sector hacks — Source: self-rendered from Check Point, Anthropic, Financial Supervisory Service, and Financial Security Institute announcements

Category	Details
Authorities’ announcement	33 attack IPs, 28 after removing duplicates
Authorities’ announcement	IPs located in 12 countries
Authorities’ announcement	US has the most with 5, 1 in Korea
Financial Security Institute	Hackers used AI tools
Press reports	ARTEX traces on attack servers
Unconfirmed	Whether it was used in the actual breaches

On October 6, the Financial Supervisory Service circulated the 28 IPs used in the attacks, with country information, to the financial sector, adding that some IPs couldn’t be tied to a country and that even those that could might be relayed, so they should be interpreted with care. The US having the most IPs doesn’t mean the attackers are in the US. When blocked, the attackers switched to other IPs to connect.

Herald Economy reported that the Chinese string “ARTEX autonomous penetration testing console” was found on a server believed to be attack infrastructure used against Shinhan Bank. A Financial Security Institute official explained that the hackers used an AI tool, not that the AI attacked on its own. Whether this tool was used in the actual breaches hasn’t been confirmed by an official investigation.

The same IPs also tried to access three internet banks. SBS reported that Kakao Bank, K Bank, and Toss Bank all blocked the access with their security systems, and no customer information was leaked.

How a pentest tool becomes an attack tool

Chart of the share of the GTG-1002 operation performed by AI — Source: self-rendered from Anthropic’s announcement

Penetration testing and hacking go through the same stages; the only difference is whether the target organization has given permission. So a tool that automates testing becomes, as is, a tool that automates attacks.

[Usage restrictions exist only on paper] The README notice is a promise, not a technical block

[Copies spread] 399 forks as of October 7, and a Korean-localized fork has appeared

[Task splitting] Small requests look like normal testing when viewed one at a time

[Local models can be used] Running a public model yourself operates outside AI companies’ monitoring

In November 2025, Anthropic announced that it had disrupted an operation in which GTG-1002, a group it assessed as linked to the Chinese government, targeted about 30 organizations using Claude Code. The attackers evaded safeguards by splitting the work into small, harmless-looking units; AI carried out 80–90% of the operation, and humans intervened in only 4–6 decisions per operation. The same report noted that the AI also made errors such as fabricating credentials or reporting public information as secret.

In August 2025, Check Point reported that HexStrike AI, an open-source tool for security testing, was used in exploitation attempts within a week of a Citrix NetScaler vulnerability being disclosed. Check Point assessed that a tool meant for defense was quickly abused as an attack tool.

One-line summary: AI tools have sped up finding weaknesses that are already known.

Why managing exposed assets works

Chart of the number of financial firms using the Financial Security Institute’s Atlas ASM — Source: self-rendered from the Financial Security Institute’s announcement

What was breached in these incidents was not customer apps but staff- and partner-facing systems such as loan broker pages. Because automated tools keep sending requests to every address visible from outside, systems missing from management inventories tend to become targets first.

Blocking IPs is an after-the-fact response to attacks that have already happened. Blocking 28 loses its effect as soon as the attackers switch to new IPs. Conversely, if you identify every externally exposed asset and close unauthenticated paths, there are fewer weaknesses to exploit no matter how fast the tool is.

The three things the Financial Services Commission asked of the financial sector on October 2 point the same way: thoroughly check IT assets exposed externally, block paths that reach internal information without authentication, and share attack IPs and methods immediately.

Atlas ASM, which the Financial Security Institute launched as a web service on June 29, 2026, discovers financial firms’ externally exposed assets and maps them to public vulnerabilities (CVEs). Users grew from 12 firms at launch to 147, and it manages more than 270,000 assets. ASM (attack surface management) is the ongoing work of discovering servers, devices, and applications exposed on the internet and analyzing their weaknesses.

What operators and customers should do

Service operators

Build an inventory of externally exposed assets and regularly reconcile it with actual scan results
Apply multi-factor authentication (MFA) to staff- and partner-facing pages too
Check that no API returns customer information without authentication
Add rules that detect automated requests arriving in bulk over a short time
SMEs should check the application period for the free security check programs KISA announces

Customers

Customers have no way to check directly whether their information was looked up in this attack. The realistic steps are to wait for individual notices from the financial firm and enable the credit transaction block and identity theft prevention services covered in the earlier post. If you receive a suspicious contact, you can call the KISA 118 call center.

ARTEX AI incident summary card — Source: self-rendered from Financial Supervisory Service, Financial Security Institute, and Anthropic announcements