What happened
Hunt.io has published a technical breakdown of the ARTEX autonomous penetration testing framework, linking it to data breaches at seven South Korean financial institutions that impacted approximately 66,000 individuals and 2,200 corporations. The report identifies a sophisticated infrastructure setup that utilizes Claude Code as a base, modified via local shims to route requests through DeepSeek v4.1 Flash, GLM 5.3, and Grok 4.6 models. The framework, which was previously identified by CrowdStrike and Genians, operated via a two-server configuration involving a Hong Kong-based jump host and a Los Angeles-based console server.
Hunt.io's investigation into the ARTEX framework reveals a highly modular attack architecture. The framework leverages Claude Code version 2.1.221, but redirects its traffic through a custom proxy layer. This layer includes 'ds-models-shim.py', which fakes a model list to satisfy the agent's requirements, and 'xcai-effort-shim.py', which injects reasoning parameters required by the DeepSeek backend.
The infrastructure relied on a two-server setup. A jump host in Hong Kong (23.248.226[.]250) managed file storage and reverse SSH tunnels, while a console server in Los Angeles (38.244.50[.]120) hosted the ARTEX interface. Hunt.io discovered open directories on these servers containing 19 custom 'skills'—reusable instruction sets for the —that automated tasks such as code auditing, reconnaissance, and payment logic testing.
The report confirms that the ARTEX framework was used to target South Korean financial institutions between late September and early October 2026. The exposed data included personal, employment, income, and loan information. While the GitHub repository and Docker images for ARTEX were removed on October 11, Hunt.io's scanning indicates that the framework remains active across a wide range of global IP addresses.
Beyond the primary breach, Hunt.io identified additional tools within the ARTEX ecosystem, including scripts for JNDI/LDAP exploitation, cryptocurrency exchange admin session targeting, and Android/iOS kernel utilities. The firm emphasizes that while these tools were present, their direct involvement in the South Korean financial breaches remains unconfirmed.
Source details: securityaffairs.com
Why it matters
The report demonstrates how open-source AI tools are being repurposed for malicious automation, specifically through 'shim' proxies that bypass model-specific restrictions and compatibility checks. By modifying Claude Code to interact with unauthorized backends, the operator successfully automated complex tasks including WAF bypass, authentication testing, and payment logic exploitation. This incident highlights a critical security gap: the ease with which legitimate AI development tools can be weaponized when exposed on the public internet. The findings provide a blueprint for defenders to identify similar rogue AI-agent infrastructure by monitoring for specific proxy patterns and unauthorized model gateway traffic.
The ARTEX campaign represents a significant evolution in AI-assisted cybercrime, moving from simple -based attacks to the deployment of autonomous agents that can execute multi-stage kill chains. The use of 'shims' to force compatibility between different AI models and agentic frameworks allows attackers to leverage the most capable or cost-effective models for specific stages of an attack.
The incident underscores the danger of 'shadow AI' infrastructure. By exposing administrative consoles and proxy services to the public internet, operators created a persistent, automated environment that could be easily scaled. The presence of 19 distinct 'skills' within the framework suggests a professionalized approach to developing and maintaining attack automation.
For financial institutions and other high-value targets, this highlights the necessity of treating AI-agent infrastructure with the same rigor as traditional server-side vulnerabilities. The ability of these agents to perform complex tasks like WAF bypass and payment logic testing means that traditional perimeter defenses may be insufficient if the underlying AI-agent control plane is compromised or exposed.
Interactive Mechanism: How It Actually Works
Explore the underlying technology behind this development interactively.
An agent must create a draft calendar event for Tuesday at 2 p.m. Which evidence would establish the requested result?
What to watch next
Security teams should monitor for the specific indicators of compromise identified by Hunt.io, including the use of 'ds-models-shim.py' and 'xcai-effort-shim.py' scripts, which are used to force AI agents to communicate with non-standard model backends. Organizations should audit their own infrastructure for exposed administrative consoles, particularly those using the ARTEX framework's specific certificate issuers or page titles. Furthermore, the discovery of 1,303 potential ARTEX-related addresses globally suggests that this framework is being utilized by multiple actors beyond the individual responsible for the South Korean financial breaches, necessitating broader vigilance against automated penetration testing tools.
Defenders are advised to implement strict access controls for all AI-related administrative services, moving them behind VPNs or IP allowlists. Secrets, including API keys and proxy credentials, must be stored in managed vaults with least-privilege access, as the exposure of these credentials was a key factor in the ARTEX operator's ability to maintain persistence.
Organizations should monitor for anomalous network activity, specifically unexpected LDAP and JNDI traffic, DNS callbacks, and unauthorized remote script downloads. The use of AI model gateways should be restricted and audited to ensure that agents are only communicating with authorized, internal, or verified external endpoints.
Hunt.io's methodology for identifying ARTEX servers—searching for specific certificate issuers and page titles—provides a template for proactive threat hunting. Security teams should perform similar scans across their own networks and external attack surfaces to identify and remediate any exposed ARTEX consoles or related exploitation kits.