The open-source AI penetration testing tool ARTEX has been moved to a closed-source model following its alleged use in cyberattacks against South Korean financial institutions. Developer Li Puhua restricted access to the project on October 8, 2026, the same day its GitHub repository was removed.
Between late September and early October 2026, attackers compromised internal systems at seven to nine financial firms. The breach exposed personal data of approximately 68,000 individuals, including names, phone numbers, income levels, and loan limits. Shinhan Bank reported the largest impact, with 25,000 records affected.
CrowdStrike investigators linked the attacks to a 26-year-old individual in China. The perpetrator reportedly combined the ARTEX agent with the Claude Code AI assistant to bypass internal security protocols. To obscure the origin of the traffic, the attacker routed operations through IP addresses across more than ten countries.
South Korean President Lee Jae Myung has called for stronger cybersecurity measures in response to the incidents. Authorities have launched an investigation, though the cross-border nature of the attacks presents significant challenges for enforcement.
