Open-source AI hacking kits like ARTEX are now standard gear for real-world attacks

What's going on

Since February 2026, security firms have kept reporting break-ins where an AI agent does the grunt work. That means a language model that picks its own tools, writes commands and evaluates the results. Taken one by one, the cases looked like curiosities: CyberStrikeAI at universities in Africa and Latin America (Kaspersky), ARTEX at South Korean banks (CrowdStrike, Zscaler) and BOSSAI in Taiwan (Acronis). As of this week, they form a clear pattern. On November 4, India's cyber agency CERT-In named four freely available tools as the kit of a threat actor called "Crafty Falcon": ARTEX, PentAGI, Cairn and CyberStrikeAI. Almost at the same time, it emerged that a tampered ARTEX build plants a backdoor on its own users.

Our take: agent frameworks billed as pentest tools have become the standard attack toolkit within just a few months. A pentest is a commissioned, authorized break-in test. An agent framework is the scaffolding that connects a language model to hacking tools. This shift matters for three groups: the attackers themselves, the platforms hosting the tools, and the defenders.

The tools compared

The origins stand out. Two of the four tools are close to the same Chinese security vendor. ThreatBook bought CyberStrikeAI on October 1, and according to ThreatBook, ARTEX developer Li Puhua is product lead for its RedAgents platform. ARTEX is said to be a personal project. There's no evidence that ThreatBook directs it.

All the tools come with disclaimers. CyberStrikeAI says it's meant only for education and authorized testing. Cairn wants to be used exclusively in environments with explicit permission. Technically, none of that stops anything. According to Zscaler, ARTEX does block government and university domains, but not bank domains.

What the tools can really do, and what's marketing

The security firms' numbers sound dramatic, but read closely they often deliver less than the headlines suggest:

• VAPOR PANDA: CrowdStrike talks about more than 200 targeted organizations in at least 14 countries. Spokespeople told CyberScoop around 140 targets were compromised. In the blog post itself, active post-compromise activity on the network is confirmed at just nine organizations.
• Cairn: NorForge found 25 exposed panels with more than 1,100 projects. But a project isn't a victim, and the "GOAL MET" status is just a field in the attackers' panel. The "roughly 10%" success rate and the cost of around $5 per task are estimates. Individual cases were verified, including a webshell, a covertly uploaded remote-control script, on a hardware retailer's site.
• FortiGate: Amazon counted more than 600 compromised devices in over 55 countries. Team Cymru made the link to CyberStrikeAI via a server banner and network data. That's an inference, not a proven attribution of the whole campaign.
• BOSSAI: Acronis documents in detail how often the agents got it wrong. More than half of one agent's findings rated "high" or "critical" were false positives, and some models made up vulnerabilities. The systems that were breached were also poorly protected to begin with: a port left open since 2018 and unpatched Oracle databases.
• South Korea: The country's financial security agency stresses that the AI didn't attack on its own but was a tool in human hands. In the Kaspersky case, too, a human had to approve the suggested steps.

So what's proven isn't the "autonomous AI hacker" but something less spectacular: well-known attack techniques like SQL injection, password spraying (trying a few common passwords against many accounts), dumping LSASS or DCSync become cheaper, faster and parallelizable. As Microsoft puts it:

"Agents are not subject to the factors that constrain humans."

With Storm-0940, the password-spraying wave peaked at 2,900 failed attempts per minute. That particular wave wasn't successful, though: almost 98% of the activity ended in account lockouts.

Our assessment: Security firms sell protection against exactly the threat they describe. That doesn't make the reports wrong. But keep the metrics apart: targeted, allegedly compromised and confirmed are three different things.

South Korea and India: what the authorities say

On November 5, South Korea's Financial Services Commission (FSC) reported 40 incidents at 37 financial firms since September 30. Those affected include 4 banks, 5 investment firms, 5 savings banks and 10 e-finance providers. Around 473,000 records were exposed, including names, resident registration numbers and account numbers. About 1 billion won (around $750,000) was stolen, mostly from hot wallets at small crypto exchanges, meaning wallets that are permanently connected to the internet. The FSC plans to inspect more than 580 firms by year's end. One important caveat: the name ARTEX doesn't appear in Korea Times and Businesskorea coverage of the FSC announcement. So far, ARTEX has been confirmed in the first cases around Shinhan Bank, not in all 37.

CERT-In and its financial-sector unit CSIRT-Fin rate Crafty Falcon as "critical" and "active". According to reports, the attacker gets in through unprotected test and staging systems, abuses cloud services like AWS Systems Manager and Lambda, and calls victims' payout APIs directly. Before large transfers, it reportedly makes 1-rupee test transactions. Firms that only half-heartedly cleaned up after earlier warnings were hit again. CERT-In doesn't say who's behind Crafty Falcon, nor does it talk about state direction. The "Chinese" label in many headlines was added by the media.

The attackers get attacked

Researcher Badbyte analyzed the Docker image tomicdd/artex. A Docker image is a ready-made software package you can launch with a single command. Docker Hub shows around 9,000 downloads for it. The backdoor sits in a hidden verifyCaptcha() function in the login. If the CAPTCHA field starts with a secret marker, the server runs the rest as a shell command with root privileges, meaning full admin rights, and sends back the output. This happens before the password check. Among other channels, the image spread via the GitHub copy trhhubsd/ARTEX with 2,449 stars, where a single line in the docker-compose.yml file was changed.

On November 4, 1,645 publicly reachable ARTEX consoles were running, 62 of them on the poisoned version (26 in the US, 17 in Hong Kong, 7 in China). According to Badbyte, infected consoles also leak unpatched findings, valid credentials and access to victims' networks. Working backwards, the image was uploaded around October 8: twelve days before the first observed instance on October 20. That's exactly the day the developer made the original private. Anyone searching for ARTEX after that ended up with copies. Badbyte's dry comment: the victims had already chosen to run an unvetted attack tool as root on an open port.

Why GitHub and Docker Hub leave the tools up

GitHub's policy explicitly allows dual-use content, software that can be used for defense or attack, and assumes good faith. It only intervenes in "rare cases of very widespread abuse". Even then, access is usually just put behind a login rather than deleting the repo. Docker's terms of service do ban "malicious" content. At the same time, Docker shifts the responsibility: users are "solely responsible" for vetting any image before using it. tomicdd/artex was still available on November 5. We're not aware of a takedown of any of the four tools. Deleting them wouldn't achieve much anyway, as the ARTEX case shows: after the original was pulled, forks, commercial spin-offs and, yes, poisoned copies kept circulating.

What defenders get out of this

The good news: standard tools leave standard traces. CyberStrikeAI listens on port 8080 by default, and Team Cymru found attacker servers via the "CyberStrikeAI" banner. Cairn uses port 8000 and a fixed worker image. According to NorForge, a bug in the attackers' pipeline exposed dozens of panels: the page names were missing the first "w". Microsoft publishes Storm-0940's IP addresses and user agents. Oasis Security counted 359 ARTEX IPs in early October, Badbyte 1,645 consoles a month later. The methods differ, but the direction is clear.

Model providers' safeguards are less reliable. According to Acronis, commercial models did refuse attack tasks in the BOSSAI case. But the attacker switched to abliterated models, open models with their safety alignment stripped out, and ran them on their own GPUs. According to CrowdStrike, with Claude Code it was often enough to say you were doing an "authorized pentest". Anthropic regularly reports banned accounts and named PentAGI as a publicly available attack framework in its September report. In the Kaspersky case, the model ran on the attackers' server, and the implant never called an AI API. CERT-In still recommends monitoring AI API traffic from machines not used for development. But some attacks bypass that entirely.

The bigger picture

The evidence now spans countries: the same freely available agent frameworks are turning up with criminals, lone actors and state-linked groups, from Seoul to Mumbai to universities in Africa. What isn't proven is the autonomous super-hacker. The agents make mistakes, need human sign-off and almost exclusively exploit long-known vulnerabilities. Our assessment: The real shift is economic. An attack now costs just a few dollars in compute, and a single person can work hundreds of targets in parallel. For defenders, that means exposed test systems, old databases and half-hearted cleanup get found faster than ever. Fixed fingerprints like ports, images and banners are currently their biggest advantage, as long as attackers keep running their tools as sloppily as they have so far. The open question is whether GitHub, Docker and the model providers will adapt their rules to tools that, according to their documentation, are for testing, but in practice are used for breaking in.