AI agent incident
Attackers used the ARTEX agentic pentesting tool to steal data from South Korean financial firms
What happened
CrowdStrike reported a campaign from late September to early October that used ARTEX, an open-source multi-agent penetration testing tool developed in China, to exfiltrate data from South Korean financial firms including Shinhan Bank and Yegaram Savings Bank. CrowdStrike found it through open directories exposing the operator's Claude Code session histories and ARTEX configuration files, and the tool's developer has since taken it closed source.
Why it matters
The tool was published for authorized testing and ran here on DeepSeek, probably bought through an API reseller, with GLM and Grok models alongside it. With three providers' models in one instance, a single provider's abuse controls are not much of a defense. South Korea's financial regulators have told customers to expect phishing and loan scams built on the stolen data.