The Pulse
ARTEX Developer Ends Public Releases After South Korean Bank Attacks
ARTEX developer Autumn-27 said on October 8 that the AI penetration-testing agent would become closed-source, with no new public versions or maintenance. CrowdStrike had linked ARTEX to a campaign against South Korean financial organization
AI.info Team · Written with AI ·
On October 8, the developer of ARTEX posted that the AI penetration-testing project would stop receiving updates and become closed-source. The GitHub account, which uses the handle Autumn-27, said no new versions or maintenance support would be released publicly, citing the tool’s misuse. The decision followed a CrowdStrike report linking ARTEX to a campaign that stole data from South Korean financial organizations.
Autumn-27 halts public releases
“Given the misuse of the tool, the ARTEX project will no longer be updated and will be converted to closed source. No further versions will be released to the public nor will maintenance support be provided,” the developer said, in the English translation published by Reuters. The GitHub statement describes ARTEX’s intended purpose as helping organizations test security risks within authorized assets and improve their defenses. It condemns unauthorized use and says the project’s author bears no responsibility for illegal activity.
Reuters reported that ARTEX’s GitHub page had been taken down. The author’s notice remains on the Autumn-27 GitHub profile, dated October 8. The announcement does not explicitly address the South Korean incidents, though it cites misuse as the reason for ending public development.
CrowdStrike links ARTEX to data theft
CrowdStrike’s October 7 report describes a campaign active from late September to early October 2026 against South Korean financial organizations. The cybersecurity firm said it found ARTEX configuration files, Claude Code session histories and related records in open directories connected to infrastructure it associated with the threat actor. Those materials gave investigators insight into the operator’s tools and activity.
The report says the operator used ARTEX alongside large language models, including DeepSeek v4.1-flash as the primary backend for an ARTEX instance. CrowdStrike also found evidence of GLM-5.3 and Grok 4.6 in additional Claude Code sessions. It assessed with moderate confidence that the actor was likely a Chinese speaker and financially motivated, but said the activity had not been attributed to a named adversary.
CrowdStrike’s report describes data exfiltration and intrusions involving systems at financial organizations, including a loan-progress inquiry service used by brokers and an employee mobile work-support system. It cautioned that the number of affected organizations was unconfirmed. The firm’s findings connect the tool to observed activity; they do not establish that ARTEX alone carried out the intrusions.
A testing agent built around outside models
ARTEX is not a standalone language model. Reuters describes it as an open-source agent designed to automate penetration testing by connecting to external models such as ChatGPT, Claude and DeepSeek. That arrangement let the tool coordinate security-testing tasks while relying on separate services for language-model capabilities.
The distinction matters to the developer’s move: Autumn-27 can stop publishing and maintaining its own project, but that announcement does not change the broader models ARTEX was designed to connect to. CrowdStrike’s account also describes the campaign as combining agentic AI tools with traditional offensive capabilities, rather than presenting the software as an independent, self-contained attacker.
The scale of the campaign is still unclear
South Korean financial organizations faced a series of cyber incidents in the same period, but CrowdStrike’s public analysis says the count of affected organizations was not confirmed as of October 7. Reuters reported that at least nine banks had disclosed or been reported by local media as targets since late September; that figure refers to reported targets, not a confirmed count of breaches linked to ARTEX.
Autumn-27’s notice ends public versions and maintenance from the developer. CrowdStrike’s report, meanwhile, leaves the scope of the South Korean campaign unresolved: it confirms data exfiltration in activity targeting financial organizations, but gives no final total of affected institutions.