When the Penetration Testing Agent Switches Sides

An unidentified attacker used the open-source AI penetration testing agent ARTEX against South Korean financial organizations from late September to early October 2026, stealing data in the process. A query service for loan brokers and a mobile system for employees were reportedly affected. The number of affected organizations remains unconfirmed.

Related: A chief information security officer (CISO) does not absolve management of its responsibilities

The Agent on the Wrong Team

ARTEX is a recently released open-source agentic penetration testing tool from China: software that independently plans and executes attack steps rather than simply running individual commands. It was designed to test the security of users’ own systems. In the campaign against South Korean financial organizations, it worked alongside large language models on the attackers’ side. CrowdStrike has not attributed the activity to a named adversary. It assesses with moderate confidence that the actor is likely Chinese-speaking and financially motivated, based on the use of ARTEX and Chinese-language prompts.

What is an agentic penetration testing tool? An agentic penetration testing tool is software that independently plans, sequences and executes attack steps, often guided by a large language model behind the scenes. It is intended to test the resilience of users’ own systems by replicating real attack sequences. Because the same level of automation also reduces the workload for actual attackers, the line between a testing tool and an attack tool becomes blurred.

What data leaked from the banks

According to Shinhan Bank, data on 25,729 people was exposed through a query service for loan brokers. KB Kookmin Bank reports that 119 records leaked from a mobile employee support system, while Hana Bank reported 89 records leaked from a sales support system called ODS, and BNK Busan Bank reported the exposure of information on eleven contract employees. Woori Bank and NH NongHyup Bank were also attacked but suffered no breach because their systems did not contain the vulnerabilities the attackers were targeting.

Traces in Open Directories

The attacker left Claude Code session logs, ARTEX configuration files and Claude memory files in publicly accessible directories on their own servers. The attacker used two servers: the primary infrastructure was in Hong Kong, while a second server likely hosted the ARTEX instance used in the attacks in South Korea. During the sessions, the actor asked for help finding Korean Telegram groups for selling data and wanted to know where threat actors typically sell information from Korean data breaches. Since late September, at least nine South Korean banks have disclosed cyberattacks or been identified as targets by local media. Police have launched investigations, and President Lee Jae Myung has called for robust countermeasures.

Regulators respond

An unnamed official at the Korea Financial Security Institute said a hacker had used AI as a tool; the AI had not acted independently without human involvement. When one IP address was blocked, the attacker switched to the next. On 4 October, South Korea’s Financial Services Commission instructed financial firms to conduct a comprehensive review of all external access points, particularly systems used by employees, loan brokers and contractors. Together with the Financial Supervisory Service, it issued a Level I consumer alert on 6 October about potential phishing and loan fraud, launched a one-month special response period and directed firms to operate help desks, step up monitoring through their Fraud Detection System and use the AI-powered ASAP platform to combat phishing.

The developer steps back

The developer known on GitHub as Autumn-27 said the ARTEX project would no longer be updated because of its misuse and would become closed source. No further versions would be publicly released or maintained. He said the original aim had been security testing for businesses and organizations, rejected illegal use and disclaimed responsibility for unlawful conduct. The ARTEX GitHub page is no longer accessible.

Frequently Asked Questions

Every question is locked. A tap unlocks the answer.

Which models were used to carry out the attack?

The suspected ARTEX instance used a DeepSeek model as its primary language model backend. Other Claude Code sessions used models from Zhipu AI and xAI, while access to DeepSeek was likely routed through a reseller.

Is there a specific suspect?

CrowdStrike does not attribute the activity to a named adversary and assesses with moderate confidence that the actor is likely Chinese-speaking and financially motivated. No individual or group has been definitively identified as responsible.

Have any financial losses been confirmed?

At the time the consumer warning was issued, there were no confirmed cases of phishing involving financial losses or stolen funds linked to the leaked consumer data. Financial firms were instructed to provide affected consumers with redress and compensation.

Editor’s Picks

Editor’s PickWikimedia reveals traces of OpenAI agentsEditor’s PickCyber insurance: lack of evidence puts the policy at riskEditor’s PickKillSec dismantled: 16-year-old suspected of leading group

More from the MBF Media Network

cloudmagazinPhotoshop clone in a week: Closed source faltersMyBusinessFutureE-invoicing: Three decisions for the Mittelstand

Image source: AI-generated (October 2026)

Translated from the German original using artificial intelligence. The German version is authoritative.