The tool changes. The traces don't.
Between late September and early October 2026, an attacker used ARTEX to breach seven South Korean financial institutions. Data on roughly 66,000 individuals and 2,200 corporate records leaked. The attacker didn't go after core banking. They hit peripheral systems: employee portals, partner services, and public websites with weak authentication.
ARTEX's repository has since gone private. That doesn't solve anything. CyberStrikeAI, Strix, PentAGI, and others share the same design, and attackers are already swapping and combining them. Chasing tool names is a losing game.
The good news: every AI pentesting tool works the same way. The model thinks, then the tool acts. That cycle leaves fingerprints in your logs, and you can detect them today.
What's inside:
- How ARTEX works, and where its safeguards fail. In our lab, ARTEX deleted records during routine testing without ever being told to delete anything. Its LLM judge approved all 23 calls it reviewed.
- Four real-world abuse campaigns, dissected. FortiGate devices in 55+ countries, Taiwanese government agencies, US online retailers, and the South Korean financial sector.
- The detection indicators that matter. User-Agent strings, console fingerprints, egress signals, and the idle-then-burst traffic pattern that gives AI agents away.
- A ready-to-deploy detection ruleset. Suricata, Sigma, YARA, and ModSecurity rules, plus KQL and SPL hunting queries.
- Mitigations you can apply this week. Bot management, PoW challenges, per-IP rate limits, and MFA on peripheral systems.
- Why running open-source AI pentesting tools on your own assets is risky. Data leakage, untrusted API relays, backdoored models, and no audit trail.
- A pre-adoption checklist for AI pentesting tools. Six questions to ask any vendor before you point AI at production.
