ARTEX, the AI attack framework, in 2026
ARTEX, an open-source AI penetration testing framework, turned up in attacks on Korean financial firms, then in the ConnectWise breach, then in a Seoul extortion case with 90 victims.
4 steps · Updated
ARTEX lets a language model pick and run hacking tools on its own. In early October it was linked to data leaks at Korean financial firms, and its developer took it closed-source. Microsoft then tied it to the ConnectWise breach, and Seoul police said a lone hacker used it against about 90 businesses. Each step shows the same thing: old attacks, run faster and wider.
The timeline
CrowdStrike links ARTEX to attacks on Korean financial firms from late September
then
ARTEX developer says the tool has been misused and moves it to closed source
then
then
JPCERT/CC adds attacks run with AI pentest platforms, naming Cairn, CyberStrikeAI and ARTEX, to its Japan advisory
What to watch next
No dated next step is on record yet. We add one here when an agency, court or legislature sets a date.