Overview
Check Point Research has published findings on the criminal weaponisation of ARTEX, a Chinese open-source agentic penetration testing framework originally designed for authorised security assessments. Researchers identified more than 1,800 publicly exposed ARTEX instances being operated by threat actors to conduct fully autonomous cyberattacks. The platform coordinates fleets of LLM-driven agents that independently plan, execute, and document exploitation campaigns — requiring human operators only to set an initial goal. The scale, autonomy, and accessibility of this tooling marks a qualitative shift in the threat landscape.
Technical Analysis
ARTEX leverages large language models — most prevalently DeepSeek Flash in observed campaigns — to orchestrate multiple AI agents across a web dashboard. Each agent autonomously selects targets, runs security tooling, identifies vulnerabilities such as Remote Code Execution (RCE), and captures exploitation evidence without further operator input. Operators were observed interacting with their agent fleets almost exclusively to check progress, not to direct individual actions.
Attacks were characterised as opportunistic and financially motivated, executed at broad scale. In several cases, agents leveraged initial access obtained through web vulnerability exploitation to conduct downstream supply chain attacks — a particularly concerning escalation. Alongside ARTEX, researchers identified related frameworks including CyberStrike, Cairn, PentAGI, and custom-built platforms such as “PZZ,” indicating ARTEX is part of a broader ecosystem of agentic offensive tooling.
Following documented attacks against South Korean banks, the original ARTEX developer closed the source repository on 8 October 2026. However, maintained forks and archived backups have kept the tool accessible to threat actors, neutralising this mitigation.
Framework Mapping
MITRE ATLAS:
- AML.T0103 (Deploy AI Agent): Core operational method — criminals deploy ARTEX agent fleets to conduct attacks autonomously.
- AML.T0047 (AI-Enabled Product or Service): ARTEX itself is the AI-enabled attack service being abused.
- AML.T0010 (AI Supply Chain Compromise): Agents pivoted from initial access to supply chain attacks in observed cases.
- AML.T0065 (LLM Prompt Crafting): Operators crafted initial goals that guided fully autonomous exploitation chains.
OWASP LLM Top 10:
- LLM08 (Excessive Agency): Agents operated with broad, unchecked autonomy across network exploitation tasks.
- LLM05 (Supply Chain Vulnerabilities): Both the tool’s own fork ecosystem and agent-driven supply chain pivots are relevant.
- LLM02 (Insecure Output Handling): Agent-generated exploitation outputs were acted upon directly by downstream tooling.
Impact Assessment
The combination of full autonomy, low operator skill requirements, and broad-scale opportunistic targeting makes ARTEX-class tooling a democratising force for cybercrime. Financial institutions, web application operators, and software vendors are all directly exposed. The supply chain pivot capability means compromise of one target can cascade to downstream customers and partners. With 1,800+ live instances observed, the attack surface is already substantial and likely growing given the availability of forks.
Mitigation & Recommendations
- Harden internet-facing applications: Prioritise patching RCE and high-severity web vulnerabilities that automated agents are most likely to exploit at scale.
- Deploy behavioural detection: Identify scanning and exploitation patterns consistent with agentic tooling — sequential automated tool invocations, structured evidence capture, and rapid multi-step exploitation chains.
- Monitor supply chain integrity: Implement software composition analysis and integrity checks to detect agent-driven tampering in build pipelines.
- Restrict ARTEX fork access: Where possible, block known ARTEX-related infrastructure at the network perimeter and report exposed instances.
- Assume low-skill adversaries: Threat models should no longer require technical sophistication as a filtering assumption — agentic platforms remove this barrier entirely.