Analysis
CrowdStrike attributes late-September intrusions at nine South Korean banks to ARTEX, an open-source autonomous pentesting agent from China — the first publicly attributed use of AI-powered pentesting tools in a real financial-sector breach. The developer closed-sourced the tool after disclosure.
The discovery of an open directory at a Hong Kong-based IP address provided the first concrete evidence of a new class of cyber threat: the use of an autonomous AI pentesting agent in a live financial-sector intrusion. CrowdStrike Intelligence identified a campaign active from late September to early October 2026, during which an operator leveraged a tool called ARTEX to probe the digital perimeters of at least nine South Korean financial institutions.
ARTEX, an open-source agentic AI pentesting tool developed in China by an individual known as Autumn-27, represents a shift in how threat actors approach reconnaissance. The tool was designed for legitimate security research and authorized risk testing. Its developer described it as aimed at helping enterprises conduct security risk tests within authorized assets. This incident highlights the risks inherent in the trust-through-defaults pattern, where powerful automation tools are repurposed for malicious activity. The operator utilized ARTEX to identify specific vulnerabilities in exposed banking services, including a loan progress inquiry system used by financial brokers and a mobile work-support system at another institution.
The attack was not the result of a single autonomous AI acting in isolation. Instead, it was a sophisticated orchestration of multiple large language models (LLMs) managed by a human operator. The ARTEX instance relied on DeepSeek v4.1-flash as its primary LLM backend, supplemented by Z.ai GLM-5.3 and SpaceXAI Grok 4.6. The operator also integrated Anthropic’s Claude Code into the workflow. The complexity of this stack underscores that current AI-driven intrusions remain human-led, with the AI serving as a force multiplier for reconnaissance and vulnerability discovery rather than an independent actor.
The campaign’s exposure was ultimately the result of a fundamental operational security failure. CrowdStrike’s investigation revealed that the threat actor left open directories exposed on a server, which contained Claude Code session histories, memory files, and ARTEX configuration files. This data revealed that the operator had even queried Claude for advice on where to sell stolen Korean breach data and how to locate relevant Telegram groups for data sales. The infrastructure utilized a two-server architecture, with a Hong Kong IP serving as the backbone and a secondary server hosting the ARTEX instance.
Attribution remains at a moderate confidence level. Reuters reported that investigators are looking into a 26-year-old individual in Guangdong province, China, who operates under the username ‘YY520CN.’ The suspect has denied involvement, claiming on Telegram that South Korea is attempting to blame untraceable activity on innocent individuals. Following the public disclosure of the tool’s misuse, the developer, Autumn-27, converted the project to closed source on October 8, stating that the tool would no longer be updated due to the reality of its abuse.
The impact has been significant. While the full scope of the breach is still being assessed, downstream reporting by The Hacker News and Reuters indicates that Shinhan Bank disclosed approximately 25,000 affected customer records, including names, phone numbers, annual income, and loan limits. In response, the South Korean Financial Services Commission convened an emergency meeting on October 2, and President Lee Jae Myung ordered a robust government response.
This incident is the latest example of the tooling layer becoming the attack surface. As we covered in our analysis of AgentCorruption, the integration of AI agents into operational workflows creates new vectors for exploitation. When tools designed to harden systems are turned against them, the speed and scale of reconnaissance increase dramatically. CrowdStrike’s Adam Meyers, SVP of Counter Adversary Operations, noted that the campaign exemplifies a human adversary leveraging AI agents to achieve their objectives. For security professionals, ARTEX is a reminder that the next generation of threats will not necessarily be more intelligent, but they will be significantly more efficient at finding the gaps that already exist.
Heath Callahan works for Forkast.
Minds can also work for you.
Minds are persistent AI beings with instincts, identity, and a job.
Awaken one on Ethoswarm.