{"id":24778,"date":"2026-10-09T07:39:08","date_gmt":"2026-10-09T07:39:08","guid":{"rendered":"https:\/\/www.securitytoday.de\/?p=24778"},"modified":"2026-10-15T19:47:20","modified_gmt":"2026-10-15T19:47:20","slug":"when-the-penetration-testing-agent-switches-sides","status":"publish","type":"post","link":"https:\/\/www.securitytoday.de\/en\/2026\/10\/09\/when-the-penetration-testing-agent-switches-sides\/","title":{"rendered":"When the Penetration Testing Agent Switches Sides"},"content":{"rendered":"<p><strong>An unidentified attacker used the open-source AI penetration testing agent ARTEX against South Korean financial organizations from late September to early October 2026, stealing data in the process. A query service for loan brokers and a mobile system for employees were reportedly affected. The number of affected organizations remains unconfirmed.<\/strong><\/p>\n<div style=\"background:#003340;color:#fff;padding:32px 36px;margin:32px 0;border-radius:8px;\">\n<p style=\"color:#69d8ed;text-transform:uppercase;letter-spacing:0.08em;font-size:0.82em;font-weight:700;margin:0 0 16px;\">Key Takeaways<\/p>\n<ul style=\"margin:0;padding-left:20px;line-height:1.7;\">\n<li style=\"margin-bottom:10px;\"><strong style=\"color:#69d8ed;\">A defensive tool turned against its targets.<\/strong> ARTEX is an open-source agentic penetration testing tool from China that was used alongside language models against financial institutions.<\/li>\n<li style=\"margin-bottom:10px;\"><strong style=\"color:#69d8ed;\">Data was stolen through systems used by staff.<\/strong> Shinhan Bank reports that 25,729 people were affected by a breach of a query service for loan brokers.<\/li>\n<li style=\"margin-bottom:0;\"><strong style=\"color:#69d8ed;\">The developer pulls the plug.<\/strong> Following the misuse, the developer is making ARTEX closed-source and ending maintenance.<\/li>\n<\/ul>\n<\/div>\n<p style=\"border-bottom:1px solid rgba(230,227,218,0.14);padding:14px 0;margin:28px 0;font-size:0.92em;color:#b8c5ce;\"><strong style=\"color:#69d8ed;\">Related:<\/strong> <a href=\"https:\/\/www.securitytoday.de\/en\/2026\/09\/30\/ciso-does-not-take-responsibility-from-leadership\/\">A chief information security officer (CISO) does not absolve management of its responsibilities<\/a><\/p>\n<h2>The Agent on the Wrong Team<\/h2>\n<p>ARTEX is a recently released open-source agentic penetration testing tool from China: software that independently plans and executes attack steps rather than simply running individual commands. It was designed to test the security of users\u2019 own systems. In the campaign against South Korean financial organizations, it worked alongside large language models on the attackers\u2019 side. CrowdStrike has <a href=\"https:\/\/www.crowdstrike.com\/en-us\/blog\/unknown-threat-actor-uses-artex-to-target-south-korean-finance\/\">not attributed the activity to a named adversary<\/a>. It assesses with moderate confidence that the actor is likely Chinese-speaking and financially motivated, based on the use of ARTEX and Chinese-language prompts.<\/p>\n<p><strong>What is an agentic penetration testing tool?<\/strong> An agentic penetration testing tool is software that independently plans, sequences and executes attack steps, often guided by a large language model behind the scenes. It is intended to test the resilience of users\u2019 own systems by replicating real attack sequences. Because the same level of automation also reduces the workload for actual attackers, the line between a testing tool and an attack tool becomes blurred.<\/p>\n<h2>What data leaked from the banks<\/h2>\n<p>According to Shinhan Bank, data on 25,729 people was exposed through a query service for loan brokers. <a href=\"https:\/\/biz.heraldcorp.com\/article\/10892497\">KB Kookmin Bank reports<\/a> that 119 records leaked from a mobile employee support system, while Hana Bank reported 89 records leaked from a sales support system called ODS, and BNK Busan Bank reported the exposure of information on eleven contract employees. Woori Bank and NH NongHyup Bank were also attacked but suffered no breach because their systems did not contain the vulnerabilities the attackers were targeting.<\/p>\n<h2>Traces in Open Directories<\/h2>\n<p>The attacker left Claude Code session logs, ARTEX configuration files and Claude memory files in publicly accessible directories on their own servers. The attacker used two servers: the primary infrastructure was in Hong Kong, while a second server likely hosted the ARTEX instance used in the attacks in South Korea. During the sessions, the actor asked for help finding Korean Telegram groups for selling data and wanted to know where threat actors typically sell information from Korean data breaches. Since late September, <a href=\"https:\/\/www.reuters.com\/world\/suspect-behind-south-korea-bank-hacks-may-be-26-year-old-china-cybersecurity-2026-10-08\/\">at least nine South Korean banks<\/a> have disclosed cyberattacks or been identified as targets by local media. Police have launched investigations, and President Lee Jae Myung has called for robust countermeasures.<\/p>\n<h2>Regulators respond<\/h2>\n<p>An unnamed official at the Korea Financial Security Institute said a hacker had used AI as a tool; the AI had not acted independently without human involvement. When one IP address was blocked, the attacker switched to the next. On 4 October, South Korea\u2019s Financial Services Commission instructed financial firms to conduct a comprehensive review of all external access points, particularly systems used by employees, loan brokers and contractors. Together with the Financial Supervisory Service, it issued a <a href=\"https:\/\/www.fsc.go.kr\/eng\/pr010101\/87887\">Level I consumer alert<\/a> on 6 October about potential phishing and loan fraud, launched a one-month special response period and directed firms to operate help desks, step up monitoring through their Fraud Detection System and use the AI-powered ASAP platform to combat phishing.<\/p>\n<h2>The developer steps back<\/h2>\n<p>The developer known on GitHub as Autumn-27 said the ARTEX project would no longer be updated because of its misuse and would <a href=\"https:\/\/www.reuters.com\/world\/china\/chinese-developer-makes-artex-ai-agent-closed-source-after-korean-bank-hack-2026-10-09\/\">become closed source<\/a>. No further versions would be publicly released or maintained. He said the original aim had been security testing for businesses and organizations, rejected illegal use and disclaimed responsibility for unlawful conduct. The ARTEX GitHub page is no longer accessible.<\/p>\n<h2 style=\"padding-top:64px;margin-bottom:20px;\">Frequently Asked Questions<\/h2>\n<p class=\"st-faq-hint\">Every question is locked. A tap unlocks the answer.<\/p>\n<details>\n<summary><strong>Which models were used to carry out the attack?<\/strong><\/summary>\n<p style=\"margin:8px 0 4px 24px;color:#555;line-height:1.6;\">The suspected ARTEX instance used a DeepSeek model as its primary language model backend. Other Claude Code sessions used models from Zhipu AI and xAI, while access to DeepSeek was likely routed through a reseller.<\/p>\n<\/details>\n<details>\n<summary><strong>Is there a specific suspect?<\/strong><\/summary>\n<p style=\"margin:8px 0 4px 24px;color:#555;line-height:1.6;\">CrowdStrike does not attribute the activity to a named adversary and assesses with moderate confidence that the actor is likely Chinese-speaking and financially motivated. No individual or group has been definitively identified as responsible.<\/p>\n<\/details>\n<details>\n<summary><strong>Have any financial losses been confirmed?<\/strong><\/summary>\n<p style=\"margin:8px 0 4px 24px;color:#555;line-height:1.6;\">At the time the consumer warning was issued, there were no confirmed cases of phishing involving financial losses or stolen funds linked to the leaked consumer data. Financial firms were instructed to provide affected consumers with redress and compensation.<\/p>\n<\/details>\n<p><!--ST-LOWER-CARDS lang=en--><\/p>\n<h3 style=\"margin:48px 0 18px;font-size:1.05em;font-weight:800;color:#e6e3da;line-height:1.2;\">Editor&#8217;s Picks<\/h3>\n<p><a href=\"https:\/\/www.securitytoday.de\/en\/2026\/10\/08\/wikimedia-reveals-traces-of-openai-agents\/\" style=\"display:flex;align-items:center;gap:14px;padding:12px 14px;margin:0 0 10px;background:#23261f;border:1px solid rgba(105,216,237,0.18);border-radius:12px;box-shadow:0 6px 18px rgba(0,0,0,0.22);text-decoration:none;color:#e6e3da;box-sizing:border-box;width:100%;\"><span style=\"flex:0 0 116px;aspect-ratio:16\/9;overflow:hidden;border-radius:8px;background:#111210;border:1px solid rgba(230,227,218,0.08);display:block;\"><img decoding=\"async\" src=\"https:\/\/www.securitytoday.de\/wp-content\/uploads\/2026\/10\/cover-hero-5-250x141.jpg\" alt=\"\" loading=\"lazy\" width=\"116\" height=\"65\" style=\"width:100%;height:100%;object-fit:cover;display:block;\"><\/span><span style=\"display:block;min-width:0;\"><span style=\"display:block;font-size:0.68em;font-weight:700;letter-spacing:0.1em;text-transform:uppercase;color:#69d8ed;margin-bottom:5px;\">Editor&#8217;s Pick<\/span><span style=\"display:block;font-size:1.0em;font-weight:650;line-height:1.35;color:#e6e3da;overflow-wrap:anywhere;\">Wikimedia reveals traces of OpenAI agents<\/span><\/span><\/a><a href=\"https:\/\/www.securitytoday.de\/en\/2026\/10\/06\/cyber-insurance-evidence-policy-at-risk\/\" style=\"display:flex;align-items:center;gap:14px;padding:12px 14px;margin:0 0 10px;background:#23261f;border:1px solid rgba(105,216,237,0.18);border-radius:12px;box-shadow:0 6px 18px rgba(0,0,0,0.22);text-decoration:none;color:#e6e3da;box-sizing:border-box;width:100%;\"><span style=\"flex:0 0 116px;aspect-ratio:16\/9;overflow:hidden;border-radius:8px;background:#111210;border:1px solid rgba(230,227,218,0.08);display:block;\"><img decoding=\"async\" src=\"https:\/\/www.securitytoday.de\/wp-content\/uploads\/2026\/08\/cyber-versicherung-nachweise-cover-hero-250x141.jpg\" alt=\"\" loading=\"lazy\" width=\"116\" height=\"65\" style=\"width:100%;height:100%;object-fit:cover;display:block;\"><\/span><span style=\"display:block;min-width:0;\"><span style=\"display:block;font-size:0.68em;font-weight:700;letter-spacing:0.1em;text-transform:uppercase;color:#69d8ed;margin-bottom:5px;\">Editor&#8217;s Pick<\/span><span style=\"display:block;font-size:1.0em;font-weight:650;line-height:1.35;color:#e6e3da;overflow-wrap:anywhere;\">Cyber insurance: lack of evidence puts the policy at risk<\/span><\/span><\/a><a href=\"https:\/\/www.securitytoday.de\/en\/2026\/10\/04\/killsec-dismantled-16-year-old-suspected-leader\/\" style=\"display:flex;align-items:center;gap:14px;padding:12px 14px;margin:0 0 10px;background:#23261f;border:1px solid rgba(105,216,237,0.18);border-radius:12px;box-shadow:0 6px 18px rgba(0,0,0,0.22);text-decoration:none;color:#e6e3da;box-sizing:border-box;width:100%;\"><span style=\"flex:0 0 116px;aspect-ratio:16\/9;overflow:hidden;border-radius:8px;background:#111210;border:1px solid rgba(230,227,218,0.08);display:block;\"><img decoding=\"async\" src=\"https:\/\/www.securitytoday.de\/wp-content\/uploads\/2026\/10\/cover-hero-250x141.jpg\" alt=\"\" loading=\"lazy\" width=\"116\" height=\"65\" style=\"width:100%;height:100%;object-fit:cover;display:block;\"><\/span><span style=\"display:block;min-width:0;\"><span style=\"display:block;font-size:0.68em;font-weight:700;letter-spacing:0.1em;text-transform:uppercase;color:#69d8ed;margin-bottom:5px;\">Editor&#8217;s Pick<\/span><span style=\"display:block;font-size:1.0em;font-weight:650;line-height:1.35;color:#e6e3da;overflow-wrap:anywhere;\">KillSec dismantled: 16-year-old suspected of leading group<\/span><\/span><\/a><\/p>\n<h3 style=\"margin:48px 0 18px;font-size:1.05em;font-weight:800;color:#e6e3da;line-height:1.2;\">More from the MBF Media Network<\/h3>\n<p><a href=\"https:\/\/www.cloudmagazin.com\/en\/2026\/10\/08\/photoshop-clone-in-one-week-closed-source-falters\/\" style=\"display:flex;align-items:center;gap:14px;padding:12px 14px;margin:0 0 10px;background:#23261f;border:1px solid rgba(105,216,237,0.18);border-radius:12px;box-shadow:0 6px 18px rgba(0,0,0,0.22);text-decoration:none;color:#e6e3da;box-sizing:border-box;width:100%;\"><span style=\"flex:0 0 116px;aspect-ratio:16\/9;overflow:hidden;border-radius:8px;background:#111210;border:1px solid rgba(230,227,218,0.08);display:block;\"><img decoding=\"async\" src=\"https:\/\/www.securitytoday.de\/wp-content\/uploads\/2026\/10\/net-photoshop-nachbau-in-einer-woche-closed-29379758.jpg\" alt=\"\" loading=\"lazy\" width=\"116\" height=\"65\" style=\"width:100%;height:100%;object-fit:cover;display:block;\"><\/span><span style=\"display:block;min-width:0;\"><span style=\"display:block;font-size:0.68em;font-weight:700;letter-spacing:0.1em;text-transform:uppercase;color:#0bb7fd;margin-bottom:5px;\">cloudmagazin<\/span><span style=\"display:block;font-size:1.0em;font-weight:650;line-height:1.35;color:#e6e3da;overflow-wrap:anywhere;\">Photoshop clone in a week: Closed source falters<\/span><\/span><\/a><a href=\"https:\/\/mybusinessfuture.com\/en\/e-invoicing-three-key-decisions-for-the-mittelstand\/\" style=\"display:flex;align-items:center;gap:14px;padding:12px 14px;margin:0 0 10px;background:#23261f;border:1px solid rgba(105,216,237,0.18);border-radius:12px;box-shadow:0 6px 18px rgba(0,0,0,0.22);text-decoration:none;color:#e6e3da;box-sizing:border-box;width:100%;\"><span style=\"flex:0 0 116px;aspect-ratio:16\/9;overflow:hidden;border-radius:8px;background:#111210;border:1px solid rgba(230,227,218,0.08);display:block;\"><img decoding=\"async\" src=\"https:\/\/www.securitytoday.de\/wp-content\/uploads\/2026\/10\/net-e-rechnung-drei-entscheidungen-fuer-den-86570628-250x143.jpg\" alt=\"\" loading=\"lazy\" width=\"116\" height=\"65\" style=\"width:100%;height:100%;object-fit:cover;display:block;\"><\/span><span style=\"display:block;min-width:0;\"><span style=\"display:block;font-size:0.68em;font-weight:700;letter-spacing:0.1em;text-transform:uppercase;color:#aa8ac2;margin-bottom:5px;\">MyBusinessFuture<\/span><span style=\"display:block;font-size:1.0em;font-weight:650;line-height:1.35;color:#e6e3da;overflow-wrap:anywhere;\">E-invoicing: Three decisions for the Mittelstand<\/span><\/span><\/a><!--\/ST-LOWER-CARDS--><\/p>\n<p style=\"font-style:italic;text-align:right;font-size:0.85em;margin-top:8px;\">Image source: AI-generated (October 2026)<\/p>\n","protected":false},"excerpt":{"rendered":"An open-source AI penetration testing agent breached South Korean banks, turning a defensive tool into an offensive weapon.","protected":false},"author":10,"featured_media":24625,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_yoast_wpseo_focuskw":"ARTEX","_yoast_wpseo_title":"When the Penetration Testing Agent Switches Sides","_yoast_wpseo_metadesc":"An open-source AI penetration testing agent breached South Korean banks, turning a defensive tool into an offensive weapon.","_yoast_wpseo_meta-robots-noindex":"","_yoast_wpseo_meta-robots-nofollow":"","_yoast_wpseo_meta-robots-adv":"","_yoast_wpseo_canonical":"","_yoast_wpseo_opengraph-title":"","_yoast_wpseo_opengraph-description":"","_yoast_wpseo_opengraph-image":"","_yoast_wpseo_opengraph-image-id":0,"_yoast_wpseo_twitter-title":"","_yoast_wpseo_twitter-description":"","_yoast_wpseo_twitter-image":"","_yoast_wpseo_twitter-image-id":0,"_evm_slot_owner":"","evm_cvss":0,"evm_risk":0,"evm_casefile":"","evm_primary_cve":"","evm_pin_until":0,"evm_external_preview_token":"","evm_external_preview_expires":"","_evm_translation_lang":"en","featured_post":0,"featured_post_sortierung":0,"_wp_old_slug":[],"footnotes":""},"categories":[251],"tags":[],"class_list":["post-24778","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-news"],"evm_reading_time_minutes":5,"wpml_language":"en","wpml_translation_of":24618,"_links":{"self":[{"href":"https:\/\/www.securitytoday.de\/en\/wp-json\/wp\/v2\/posts\/24778","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.securitytoday.de\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.securitytoday.de\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.securitytoday.de\/en\/wp-json\/wp\/v2\/users\/10"}],"replies":[{"embeddable":true,"href":"https:\/\/www.securitytoday.de\/en\/wp-json\/wp\/v2\/comments?post=24778"}],"version-history":[{"count":7,"href":"https:\/\/www.securitytoday.de\/en\/wp-json\/wp\/v2\/posts\/24778\/revisions"}],"predecessor-version":[{"id":24810,"href":"https:\/\/www.securitytoday.de\/en\/wp-json\/wp\/v2\/posts\/24778\/revisions\/24810"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.securitytoday.de\/en\/wp-json\/wp\/v2\/media\/24625"}],"wp:attachment":[{"href":"https:\/\/www.securitytoday.de\/en\/wp-json\/wp\/v2\/media?parent=24778"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.securitytoday.de\/en\/wp-json\/wp\/v2\/categories?post=24778"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.securitytoday.de\/en\/wp-json\/wp\/v2\/tags?post=24778"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}