ARTEX Korean Fork Surfaces After AI Pentesting Tool Hit Seven Banks
A Korean localization of ARTEX, the Chinese autonomous pentest framework linked to recent bank breaches, lands on GitHub under AGPL-3.0.
- Korean localization of ARTEX published at jiwoochris/artex-ko under AGPL-3.0, Go plus Next.js stack.
- Upstream Autumn-27/ARTEX won Baidu Security Response Center's Agent+ challenge.
- CrowdStrike linked ARTEX to breaches at seven South Korean financial firms exposing roughly 68,000 people.
- Dual-graph architecture separates persistent asset truth from per-task exploration lineage, joined by anchors.
- Event-driven planner with shared todolist handles multi-step attack chains without reordering or duplication.
- Workers can query each other's execution traces to reuse observations that never became formal facts.
Korean ARTEX Fork Adds Korean Output to an Autonomous Pentesting Framework
A Korean-language fork of ARTEX has been published on GitHub. The fork preserves the upstream project’s Chinese internal prompts while translating findings, reports, summaries, and chat responses into Korean. South Korean reports citing CrowdStrike have linked the upstream framework to recent bank breaches, giving developers and defenders a concrete reason to examine how the software operates.
Inside the orchestration stack
ARTEX coordinates large language models, security tools, and multiple software agents to map assets, identify potential vulnerabilities, plan tests, execute commands, and evaluate results. External models such as Claude, ChatGPT, and DeepSeek help direct the workflow, while the application manages tools, state, and evidence.
| Upstream | ARTEX repository |
|---|---|
| Korean fork | artex-ko repository |
| License | AGPL-3.0 |
| Application stack | Go backend with an embedded Next.js frontend |
| State | PostgreSQL graphs and task records |
| Model access | Anthropic, OpenAI, and OpenAI-compatible endpoints |
The Autumn-27 account published the upstream project and credits it with winning the Baidu Security Response Center’s “Agent+” challenge. South Korean coverage reported that it placed first among roughly 150 teams. At the repository snapshot cited here, GitHub displayed 0 stars and 0 forks.
Why the release draws scrutiny
South Korean reports citing CrowdStrike said attackers used ARTEX against at least seven financial institutions, including Shinhan and KB Kookmin, between late September and early October 2026. The incidents reportedly exposed data associated with roughly 68,000 people. CrowdStrike attributed the activity to attackers combining ARTEX with large language models such as Anthropic’s Claude.
This story is for Pro members
You've reached the end of the free preview. Upgrade to AlphaSignal Pro to read the full article - and everything else behind the paywall.
Comments
