{"schema_version":"0.9.0","id":"LR-2026-0232","record_version":3,"title":"ARTEX autonomous penetration-testing agent used in attacks on South Korean financial institutions","verification":{"human_verified":false,"method":"automated_gate","auto_verified":true,"score":48.5,"score_breakdown":{"source_authority":12.1,"independent_corroboration":7.0,"implicated_party_confirmed":0.0,"citation_integrity":14.0,"specificity":0.0,"completeness":8.0,"unhedged_language":5.0},"checks":{"schema_valid":true,"every_field_cited":true,"quotes_verbatim":true,"source_fetched":true,"distinct_incident":true,"dates_plausible":true,"sources_agree":true,"source_describes_incident":true,"severe_backed_by_source":true,"record_integrity":true},"gate_version":"gate-2026-10-18.7","cross_check_model":null,"cross_check_agreement":null,"duplicate_of":null,"verified_by":null,"verified_at":"2026-10-21","extraction_run_id":null},"system":{"model_name":null,"model_version":null,"developer":"unknown","harness":"ARTEX","tools_granted":["vulnerability_scanner","security_tools","network_access"],"permissions_scope":null,"autonomy_level":"full-auto","guardrails_present":[],"deployment_context":"unknown","tier":null,"lifecycle_stage":null,"integration_type":null,"intended_use":"Autonomous penetration testing to verify the weaknesses of companies' own systems in advance","safeguard_state":null,"production_intended":false},"event":{"date_occurred":null,"date_disclosed":"2026-10-21","incident_class":"security_compromise","failure_class":null,"agent_involved":true,"secondary_failure_classes":[],"trigger":"unknown","duration":null,"detection_method":"third_party","summary":"ARTEX, an open-source autonomous penetration-testing agent that calls external LLMs such as ChatGPT, Claude and DeepSeek as its decision-maker, was reportedly used in attacks on South Korean financial institutions and on Japanese companies.","tags":["ai-agent-attack-tooling","penetration-testing-agent","japan","south-korea","open-source-agent"],"date_detected":null,"near_miss":null,"root_cause":null,"root_cause_detail":null,"failure_class_detail":null,"responsible_party":null,"adversarial_actor":"external_attacker","input_provenance":null,"time_to_contain":null,"operations_paused":null,"remediation":null,"precursor_events":null},"impact":{"direct_loss_usd":null,"remediation_hours":null,"records_exposed":null,"third_parties_affected_count":8,"severity":"major","severity_because":"major: Eight Japanese companies announced data breaches and reports suggest the number of targets could reach approximately 80 companies.","harm_class":["third_party_security","privacy"],"affected_description":"Eight targeted Japanese companies that announced data breaches; reports suggest the number of targets could reach approximately 80 companies","protected_class_involved":null,"data_categories_exposed":[],"loss_range_usd":null,"reversibility":null,"downstream_exposure_count":null},"evidence":{"sources":[{"url":"https://note.com/r38/n/nc78ea15f67cd?hl=en","publisher":"news search (Bing News index)","date":"2026-10-21","type":"press","title":"[Data Breach] The Era Where AI Automatically Searches for \"Entry Points\"! - 6 Things to Do This Week Following the Chinese AI \"ARTEX\" Incident｜Rin Sumi Zeal","archived_url":null,"attachment":"first_report"}],"per_field_confidence":{"system.harness":"C","system.tools_granted":"D","system.intended_use":"C","system.production_intended":"C","system.developer":"D","system.autonomy_level":"D","system.deployment_context":"D","event.tags":"C","event.adversarial_actor":"C","event.agent_involved":"C","event.detection_method":"D","event.summary":"C","event.incident_class":"D","event.date_disclosed":"A","event.trigger":"D","impact.third_parties_affected_count":"C","impact.harm_class":"D","impact.affected_description":"C","impact.severity":"D","context.industry":"C","context.denominator_available":"D","context.country":"C","impact.severity_because":"D"},"field_citations":{"system.developer":[{"source_index":0,"quote":"ARTEX is an open-source autonomous penetration testing AI agent released on GitHub by developers in the Chinese-speaking world."}],"system.harness":[{"source_index":0,"quote":"ARTEX is an open-source autonomous penetration testing AI agent released on GitHub by developers in the Chinese-speaking world."}],"system.tools_granted":[{"source_index":0,"quote":"- Execution of security tools"}],"system.intended_use":[{"source_index":0,"quote":"The original purpose is for companies to verify the weaknesses of their own systems in advance, placing it on the side of defense."}],"system.production_intended":[{"source_index":0,"quote":"In fact, the developers themselves explained that it was \"created for learning and research purposes,\" and it is reported that the GitHub page also contained a disclaimer stating not to use it for field testing on real systems."}],"system.autonomy_level":[{"source_index":0,"quote":"AI can run tasks that would take a human tester several days to complete without ever taking a break."}],"event.detection_method":[{"source_index":0,"quote":"On October 19, GMO Cybersecurity by Ierae (GMO Cyber Crime Prevention Center) announced that it had confirmed ARTEX was used in a series of unauthorized access attempts targeting Japanese companies."}],"event.summary":[{"source_index":0,"quote":"It is a mechanism that calls external LLMs such as ChatGPT, Claude, and DeepSeek as a \"decision-maker\" to continuously execute the following tasks:"}],"event.tags":[{"source_index":0,"quote":"ARTEX is an open-source autonomous penetration testing AI agent released on GitHub by developers in the Chinese-speaking world."}],"event.adversarial_actor":[{"source_index":0,"quote":"All the attackers needed was not to carefully examine each company one by one, but simply to use an AI agent to \"search\" for companies with vulnerabilities."}],"event.incident_class":[{"source_index":0,"quote":"- Eight of the targeted Japanese companies have already announced data breaches between September and October."}],"event.agent_involved":[{"source_index":0,"quote":"ARTEX is an open-source autonomous penetration testing AI agent released on GitHub by developers in the Chinese-speaking world."}],"impact.third_parties_affected_count":[{"source_index":0,"quote":"- Eight of the targeted Japanese companies have already announced data breaches between September and October."}],"impact.affected_description":[{"source_index":0,"quote":"Reports suggest that the number of targets could reach approximately 80 companies."}],"impact.harm_class":[{"source_index":0,"quote":"- Eight of the targeted Japanese companies have already announced data breaches between September and October."}],"context.industry":[{"source_index":0,"quote":"The industries involved are wide-ranging, including insurance and finance, e-commerce, points and gifts, education, and logistics, and it is reported that the industries targeted differed for each server."}],"context.country":[{"source_index":0,"quote":"On October 19, GMO Cybersecurity by Ierae (GMO Cyber Crime Prevention Center) announced that it had confirmed ARTEX was used in a series of unauthorized access attempts targeting Japanese companies."}],"impact.severity":[{"source_index":0,"quote":"- Eight of the targeted Japanese companies have already announced data breaches between September and October."}],"impact.severity_because":[{"source_index":0,"quote":"- Eight of the targeted Japanese companies have already announced data breaches between September and October."}],"event.date_disclosed":[{"source_index":0,"quote":"published: 2026-10-21"}]},"notes_on_gaps":"No source states a specific model version, permissions scope, guardrails present, deployment context, lifecycle stage, integration type, safeguard state, failure_class, root cause, responsible party, input provenance, direct loss figure, records exposed, remediation hours, reversibility, downstream exposure count, org size, denominator, systemic exposure, shared model id, regulatory details or coverage. event.failure_class left null: the sources describe misuse of a tool by attackers, not an agent-mechanism failure. event.root_cause left null: no source names what failed. event.date_disclosed not written (derived). event.date_detected, duration and time_to_contain not written; no dated detection/containment pair given. system.developer written as 'unknown' per the source's own value, though the source describes Chinese-speaking developers. impact.harm_class inferred from announced data breaches (grade D). event.incident_class security_compromise rests on attacker-driven breaches. event.trigger human_misuse rests on the source's statement about intent of the user. system.autonomy_level full-auto is a weak inference from 'without ever taking a break'; no explicit statement that no human was in the loop. event.trigger: human_misuse was classified, not stated; a trigger is never inferred, so it is unknown. event.date_occurred: a source described it but did not state it; left null. system.tier: not set; no operator named and deployment_context is not a lab's. [aggregated by deepseek-chat, aggregate-2026-09-27.1, 2026-10-21] system.tools_granted: classified from described behaviour. system.developer: no source names the developer. system.autonomy_level: a source states no person was in the loop while it ran (not: silence about a human is not a statement that none was there). system.deployment_context: no source states where it ran. event.detection_method: a source states an outside organisation (a vendor, a partner, a platform) noticed it first (not: the affected party is victim, not third party). event.incident_class: a source states an attacker, an injected instruction or a misused credential caused the system to act, or that the system's own boundary (sandbox, permissions, weights, accounts) was breached (not: an agent acting on a goal of its own with no external cause is agent_misalignment; a wrong action with no adversary and no breach is operational_error). event.trigger: no source states a cause. impact.harm_class: classified from described behaviour. context.denominator_available: no denominator is available for this incident. [corrected by Srini Iyer, approved 2026-10-22 in the corrections review: linked to the records the matcher relates (same disclosure or summary)]"},"context":{"industry":"Finance and Insurance","org_size_band":null,"country":"JP","denominator_available":false,"denominator":null,"related_incident_ids":["LR-2026-0140","LR-2026-0229"],"systemic_exposure":null,"shared_model_id":null,"upstream_incident_id":null,"incident_evidence":null,"regulatory":null,"coverage":null},"narrative":{"steps":[{"step":"doing","text":"ARTEX, an open-source autonomous penetration-testing agent, called external LLMs such as ChatGPT, Claude and DeepSeek as decision-makers to gather information, scan for vulnerabilities, plan intrusion routes, run security tools and verify exploits, reportedly against South Korean and Japanese companies.","quote":"It is a mechanism that calls external LLMs such as ChatGPT, Claude, and DeepSeek as a \"decision-maker\" to continuously execute the following tasks:","source_index":0,"grade":"C"},{"step":"went_wrong","text":"It was used for attack rather than defense, exploiting minor system weaknesses and leaked credentials to gain footholds, and reportedly switching among hundreds of IP addresses to stay below WAF rate limits.","quote":"However, penetration testing tools can turn into tools for attack depending on the intent of the person using them.","source_index":0,"grade":"C"},{"step":"reached","text":"Traces were found on all six overseas public servers targeting Japanese companies; eight Japanese companies announced data breaches and reports suggest up to approximately 80 targets across insurance, finance, e-commerce, points, education and logistics.","quote":"- Eight of the targeted Japanese companies have already announced data breaches between September and October.","source_index":0,"grade":"C"},{"step":"caught","text":"GMO Cybersecurity by Ierae confirmed ARTEX was used in unauthorized access attempts targeting Japanese companies, and CrowdStrike reported its use in the South Korean attacks.","quote":"- On October 19, GMO Cybersecurity by Ierae (GMO Cyber Crime Prevention Center) announced that it had confirmed ARTEX was used in a series of unauthorized access attempts targeting Japanese companies.","source_index":0,"grade":"C"},{"step":"done","text":"The developer announced on GitHub that updates would be discontinued and the source code made private due to misuse; the article recommends asset inventory, patching, API authorization and rate limits, MFA, behavioral detection and automated response.","quote":"- On October 8, the developer of ARTEX announced on GitHub that they would discontinue updates and make the source code private due to its misuse.","source_index":0,"grade":"C"}],"model":"deepseek-chat","prompt_version":"aggregate-2026-09-27.1","extracted_at":"2026-10-21","source_urls":["https://note.com/r38/n/nc78ea15f67cd?hl=en"]}}