The tool behind the South Korean bank breaches is free, open source, and fast. A Security's research team ran it against a vulnerable web application generated by ARENA, our open-source benchmarking tool, and read the code. Artex works well, attackers are already using it, and nothing in it stops an operator from pointing it anywhere.
Key Findings
Artex works. We tested its external attack surface module, and that's what a bank should worry about most: given only a company domain, Artex maps the internet-facing footprint the way an attacker would. It finds subdomains, reads the applications behind them, hunts for subdomain takeovers, and tries to get past access gates, with an AI planner writing its own probes as it goes.
We also tested it on ARENA, our open-source benchmark that generates a fresh, never-before-seen vulnerable web application and keeps an answer key of every planted flaw. Behind a WAF, CAPTCHA, rate limiting, and MFA, Artex reported eight vulnerabilities in about 45 minutes, among them a critical privilege escalation to admin, and chained them into a full attack path. An AI planner and a handful of free scanners were enough.
Attackers are already using it. CrowdStrike and Microsoft tied Artex to data theft from South Korean financial institutions, a supply-chain compromise, and a financially motivated group targeting the financial sector. Censys counted 1,465 Artex consoles exposed on the internet this week.
It isn't safe for defenders to run on their own estate. Scope isn't enforced, there's no sandbox, findings aren't verified, and a backdoored copy has been downloaded about 9,000 times. Defenders need the same kind of testing on a platform built for authorized use.
Artex in the Wild, By the Numbers
Artex was published on GitHub in July 2026 by a single developer. By late September it was pulling loan, income, and employment records out of South Korean banks. By mid-October a China-aligned group had used it in a ConnectWise supply-chain compromise, and a second group had pointed it at more than 200 organizations in under two weeks. The developer took the project closed-source, but the forks were already public, so nothing changed.
What Artex Is: Inside the AI Attack Tool's Architecture
Artex is an open-source AI pentest tool published on GitHub in July 2026 by a single developer. Microsoft and CrowdStrike describe it as an agentic offensive framework, and in practice it's one application a single operator installs, made of a Go service, a Next.js front end, and a PostgreSQL database, about 65,000 lines of Go and 56,000 of front-end code. What makes it work is the multi-agent design. A conductor agent plans the engagement and reasons over a graph of goals, intents, and facts. Worker agents carry out each step and can read each other's notes, and an AI report writer writes up the findings. There's no vulnerability-specific logic. Reconnaissance, enumeration, and exploitation are decided by the model, prompt by prompt, and the model is whatever the operator points it at. The Korean campaign ran mainly on DeepSeek.
The run is a conversation. The operator can redirect an agent, add constraints, or ask it to "deepen" a finding and see how far the access goes. When the agents hit a login, a captcha, or a one-time code, the operator signs in by hand and the agents inherit the session. MFA slows Artex down; it doesn't stop it.
None of the pieces is sophisticated, and that's the point. An AI planner driving a handful of free scanners is enough to attack hardened targets at scale.
What Artex Gets Right
A Security builds an autonomous offensive security platform for authorized testing. Artex is a free attack tool that automates parts of the same work, with no guardrails at all. Banks are going to ask how the two differ, and the only credible answer comes from running it. So we installed it, pointed it at a target we control, and read the code.
Eight vulnerabilities in 45 minutes
We ran the English-language fork against a target from ARENA, the open-source tool we released for benchmarking autonomous offensive security. ARENA generates a fresh, never-before-seen vulnerable web application, puts real-world defenses in front of it (a WAF, CAPTCHA, rate limiting, MFA, single-session guards), and documents every planted vulnerability in an answer key, so a run is checked against ground truth.
Artex needed about 45 minutes and almost no input from us. It reported eight vulnerabilities, including a critical privilege escalation to admin, a stored cross-site scripting bug that runs in the admin's session, a cross-site request forgery, and a broken-object-level-authorization bug, and chained them into a single path. It even tested across roles, logging in as both the admin and a normal user. The one stall came on the simplest target in the set, a plain login form, where a bug in its credential-fetching tool meant it never used the credentials it had. We pasted them into the chat and it carried on.
No manual engagement moves that fast, and this one cost a download, one install script, and a model key.
Given a whole company, it hunts like an attacker
Our run measured one application. Pointed at an organization's whole internet-facing footprint, the same engine:
- Finds subdomains from public sources, certificate transparency logs, and DNS brute force, and drops the fake hosts a catch-all domain produces.
- Pulls apart JavaScript bundles to find undocumented APIs, and tests session cookies, login flows, CSRF protection, and redirects.
- Checks for subdomain takeover and tries header and path tricks against CDN access proxies, 403 pages, and reverse proxies.
- Writes its own probes, mostly curl and Python, and shares what it learns between workers so one dead end informs the next.
nmap, nuclei, ffuf, sqlmap, and dalfox are installed, but the model decides what to run. Coverage depends on its choices, not on a fixed playbook.
Where Artex Falls Short for Defenders
Gaps that don't matter to an attacker matter a lot to a security team testing its own estate.
Scope is only a suggestion. The scope you configure is passed to the agents as context. It tells them what to target and never checks what they do. The repository's own notes say the authorization-scope mechanism was removed. What remains is a regex list of blocked commands, which an agent routes around with a different tool, and an optional AI judge. A user can switch off both.
There's no sandbox. Agents run shell commands on the machine or container Artex is installed on, with its network access. If an agent decides a host one hop outside scope looks interesting, no layer says no.
Nothing checks its work. A reported vulnerability is the model's opinion. Nothing replays a finding automatically, and a retest runs only when someone starts one. On our run, Artex marked none of its findings as reproduced and attached no independent evidence, despite recording all its own traffic. An attacker doesn't care, since a wrong guess costs a few requests. A defender gets a stack of tickets to verify by hand.
The supply chain is already poisoned. The Hacker News reported that a GitHub copy changed one line in docker-compose.yml to pull a tomicdd/artex image that grants a root shell to anyone sending an unauthenticated request to the login endpoint. Docker Hub counted about 9,000 downloads. We scanned our fork for backdoors before running it.
It stops at the foothold, and it's built for one person. There's no Active Directory testing and no lateral movement. The README describes chains that end in lateral movement, but no code backs them. In the intrusions Microsoft documented, attackers downloaded conventional remote access tools once Artex got them in. There's one admin account, no roles, no SSO, Markdown and CSV reports with no severity standard, and no ticketing.
How to Defend Against Artex
Test the edges first. The Korean victims weren't breached through core banking. They were breached through loan-broker portals, partner services, and employee-facing sites with weak authentication, the surfaces an agent finds first. Test those with exploitation, continuously, not once a year. Plain login forms and unauthenticated endpoints go to the top of the list.
Find your exposed secrets before an agent does. Artex hunts GitHub and public sources for API keys and OAuth application secrets, and Microsoft has documented attackers using it for exactly that. Rotate anything you find.
Watch for the traffic shape, and set traps. Bursts of varied requests, default nmap, curl, and headless Chromium user agents, and machine-speed retries won't stop an agent, but they tell you a test is underway. Microsoft reports that honeypots, tarpits, and decoy "wins" pulled autonomous agents away from real assets in its testing, and all three are cheap to deploy.
How A Security Is Different
A Security runs the same kind of autonomous testing, built to be pointed at production by the people who own it.
Enforced scope is the line that matters most to a bank. It separates a tool an attacker runs once from a system a security team can put in front of production.
A bank also decides where the platform runs and which AI it talks to. With bring your own cloud (BYOC) and bring your own model (BYOM), A Security runs inside the bank's own cloud account on any major cloud vendor, every AI call goes to a model the bank has approved, and it runs even in air-gapped environments.
It also covers ground Artex doesn't reach. Beyond web applications, A Security tests exposed databases and cloud storage, remote access services, mail servers, and gateways, including default credentials. Continuous Internal Infrastructure Testing (CIIT), now in Early Access, takes it inside the network to Active Directory, lateral movement, and privilege escalation, where real attackers go once they're through the front door.
The New Baseline for Autonomous Offensive Security
Artex is a planning agent, a shell, and a handful of tools security teams have run for years, and it was still enough to breach banks. The targets were peripheral systems nobody had tested with exploitation in mind, and nothing in the tool ever told the operator to stop. The next tool will be better, and the install will still be one command.
If your team is ready to see what an autonomous test finds on your perimeter before someone else runs one, get a demo of A Security's autonomous offensive security platform.
