Loading...
New
See what manual alert triage really costs your security team.
New
See what manual alert triage really costs your security team.
See what manual alert triage really costs your security team.
See what manual alert triage really costs your security team.
Loading...
We left ARTEX AI alone in our lab and it confirmed 2 Medium findings, which doesn't sound like much. Then one of our senior researchers wrote it a phased test plan and the count went to 17, 1 of them Critical. If you're briefing leadership on ARTEX this week, the second run is the one to plan around, because attackers write plans too.
ARTEX AI is an open-source agentic pentest framework, now public through forks, that attackers have used against South Korean financial organizations and hundreds of organizations globally. On one target in Simbian's lab, its default run on a simple goal confirmed 2 Medium findings and an expert-written plan confirmed 17. Its input shapes its output, and attackers control that input.
For the past week, almost every CISO and security practitioner has been hearing about this tool, concerned that an adversary could deploy an ARTEX-style weaponized AI tool against their organization. Global computer emergency response teams, including CERT-In and CERT-EU, have begun issuing advisories. Their message is consistent: stay vigilant, inspect your perimeter, and take active measures to ensure you are not the next victim.
Picture a staging server that nobody got around to taking down, still on the internet, with an admin token sitting inside a minified JavaScript bundle. The AI Pentest Agent found that kind of token in our lab, and staging systems are a way in according to CERT-In's Critical advisory of 4 November 2026, which names the ARTEX family among the tools used on banking and financial services entities. A day later CERT-EU said that public availability will likely speed up adoption by threat actors. We ran the ARTEX AI pentest tool ourselves.
We tested three setups against the same target: ARTEX on a simple goal, ARTEX on a researcher's plan, and the Simbian AI Pentest Agent. We audited the code of an English-language fork, BaaRai/ARTEX.
The table shows what each run was given, what it confirmed, and how much traffic it took.
| Measure | ARTEX, default run | ARTEX, expert plan | Simbian AI Pentest Agent |
|---|---|---|---|
| Input | Simple goal | Phased plan from a senior researcher | Scope and authentication |
| Verified findings | 2 (both Medium) | 17 (1 Critical, 3 High, 10 Medium, 3 Low) | 138 (8 Critical, 44 High) |
| Setup | 45 minutes, stalled early | Senior researcher writes the plan | Under 60 seconds (scope + auth) |
| HTTP requests | 312 | 2,840 | 120,798 |
| Validation | Own five-part gate | Own five-part gate | Independent blind validator |
| Classes confirmed | IDOR, CWE-1236 | CWE-918, CWE-1236, CWE-522, CWE-200, others | CWE-798, CWE-89, CWE-287, CWE-306, CWE-79 |
It's one vendor-run test on one target, and we built one of the tools, so use it to judge how much input each run needed.
ARTEX AI stalled early on a simple goal, at 312 requests and 2 findings. Its reporting gate is strict. ARTEX treats every candidate as a hypothesis and tries to disprove it first, and that same five-part gate ran in the expert-plan run, so the gate wasn't what changed between them.
Our code audit of the ARTEX repository (BaaRai/ARTEX) found the gate in agent/promptcatalog.go, where ARTEX embeds an adversarial 5-axis falsification gate:
For that staging server the first axis is easy, because on the open internet an external routing path usually exists.
That gate is careful engineering, and with a plan behind it ARTEX found 1 Critical and 3 High. To its credit, ARTEX proved that given unlimited time, it is intensely goal-oriented at uncovering vulnerabilities.
The gap between two Mediums and the breach reports likely starts with input. CrowdStrike reported in October 2026 that it found ARTEX config files in open directories tied to attacks on South Korean financial organizations, and a Claude Code file on the server hosting ARTEX "contained a Chinese-language pentesting prompt that specified how the LLM should conduct pentesting activities." CrowdStrike doesn't say that prompt was fed to ARTEX.
Storm-0940 is the big example. Microsoft said in October 2026 that, after unauthorized access, the group used ARTEX to try signing in to more than 2,250 tenants. Most of its targeting failed, but it still "achieved privileged cloud persistence at many organizations in a brief time."
Don't read the result as a skills barrier. Google Threat Intelligence Group assessed in October 2026 that adversary use is still early, with open source tools "currently being used in low-sophisticated ways, resulting in broad and noisy, but still successful campaigns." CERT-In says tools in this class "execute complete attack chains autonomously at machine speed," though CERT-EU also says ARTEX "is designed to be observed and steered by a human operator through a dashboard."
So 2 findings is no comfort. The expert run went deep on one target. An attacker who already holds that staging token, or who's working a soft target, may need less.
If you run an AI pentest tool on your own estate, its scope controls have to sit outside the testing model, something has to check exploits before they touch production, and the agent that found a flaw shouldn't validate it. CERT-EU says ARTEX leaves scope and destructive actions to configurable rules and the model, with "no hard technical enforcement."
ARTEX's limits come from whoever writes its goal. A careful tester can set a scope and ban destructive actions. An attacker can leave all of that out.
Your rules of engagement for an AI pentest only hold if the tool enforces them. Ask the vendor of any AI pentesting agent a plain question: if it finds that staging token, and production isn't in scope, what stops it from following the token there? Get the answer in writing.
An enterprise agent must operate with strict guardrails:
In Simbian, out-of-scope hosts get blocked in code, outside the model, and anything newly discovered waits for a human to approve it. Safe mode adds a second model that looks at each candidate exploit for exfiltration or disruption risk before it runs, and Standard mode runs without disrupt-class actions.
In the lab run the Agent touched 8,982 endpoints and came back with 138 findings, including the same kind of token as our example. During our lab evaluations, Simbian verified multiple high-severity vulnerability classes:
The Simbian AI Pentest Agent covers the attack surface across enterprise environments:
In Simbian, the entire setup takes less than sixty seconds:
The engine does the heavy lifting, not the user. Once the test concludes, your team receives verified findings with actionable proof and the Thought Trace behind each one, ready to review and sign off.
Separately, our research team and the Agent have found multiple zero-day vulnerabilities in enterprise software. We reported them under coordinated disclosure, and we aren't naming them here because each one is still pending vendor confirmation or a patch.
Adversaries are actively deploying weaponized AI tools like ARTEX against organizations. Attackers possess unlimited time and zero rules of engagement.
Start with your own version of that staging server. CERT-In describes internet-exposed staging systems as entry points, and says attackers move on to production through shared credentials, tokens, or network paths. It says to isolate those systems from production, and separately to prohibit hardcoded tokens in source and build code.
By running continuous assessments across your applications and infrastructure, you identify and fix vulnerabilities before an external attacker can point an AI tool at your perimeter. CERT-EU recommends regular vulnerability scans, penetration tests, and "trusted AI-assisted cybersecurity tools and frameworks."
Don't let low-severity findings slide either. AI tooling can chain "minor misconfigurations into higher-impact attack paths," CERT-EU warns. CERT-In tells entities to tune SIEM correlation for machine-speed, multi-technique attack patterns and adopt automated containment. Your team also has to notice someone else using that token, and we built our AI Threat Hunt Agent and AI SOC Agent to do that job.
Simbian is SOC 2 Type II attested and trusted by Fortune 500 enterprises. Someone could write an ARTEX plan for an estate like yours, so book a demo and test your attack surface first.
Q: Is ARTEX AI fully autonomous? Largely, once someone gives it a job. ARTEX workers get through reconnaissance and testing steps on their own, and CERT-In says tools like it run complete attack chains autonomously. That job still comes from an operator, and our lab shows how much it counts: 2 findings on a simple goal, 17 on an expert plan.
Q: Is ARTEX AI malware? No, by design it's a penetration testing framework with no AI model of its own, CERT-EU says, which is why operators connect an external LLM. On your network, treat it as an attack tool, because the danger depends on who points it at a target and whether they have authorization.
Q: Should we run ARTEX AI on our own systems? Not without written sign-off. If you're a banking or financial services entity, CERT-In says to prohibit unauthorized offensive AI frameworks on corporate infrastructure, and all penetration testing needs written approval, a defined scope, and a time window, since "the tools themselves do not validate authorization."
Q: How can we detect ARTEX AI activity? Start in your logs. CERT-EU says to hunt for artifacts of ARTEX use, such as automated scanning patterns and specific tool signatures. CERT-In would also have you watch for downloads of offensive AI frameworks, for AI coding agents running with permission checks disabled, and for LLM API traffic coming from servers, since that may point to an attack rig.
Q: Is ARTEX AI still on GitHub? Only as forks, as far as anyone can tell. CERT-EU says the author took the original down in October 2026 after reports of misuse, and the forks that remain won't necessarily match each other. We audited one of them, BaaRai/ARTEX.
