INSPECTING ARCHIVED INTELLIGENCE (OUTDATED VERSION).

Open Source Security Tool Compromised via Unpatched Vulnerability in GitHub

| 2026-10-02 11:20 HIGH LOW DATA BREACH
JSON
Executive Summary
AI-generated
A recent data breach incident at Shinhan Bank, where approximately twenty-five thousand people's information was leaked due to a bypass of the authentication procedure for its loan recruitment service, has raised concerns about the misuse of publicly available security tools. The 'ARTEX AI' open-source security tool, which is an LLM-based autonomous penetration testing system that was previously tested in various challenges and released on GitHub, may have been used in this incident. According to Jun Hyun, CEO of Juniper Security Center, the use of AI tools by attackers has led to a more common era of hacking, as these tools can be utilized efficiently in licensed security verification environments but also pose a risk when exploited by attackers to automate and increase the efficiency of cyber attacks. The attack cycle involved surveillance, vulnerability scanning, penetration, and information theft, highlighting the potential risks associated with using AI-based security testing and automation tools without proper controls.
Technical Mitigations AI-generated
• Account Use Policies (ATT&CK mitigation for Credential Stuffing): Set account lockout policies after a certain number of failed login attempts to prevent passwords from being guessed. • Reset credentials and API keys that may have been exposed, and review access logs for the affected accounts or integrations.
Intelligence Metadata
Actors / Malware / CVEs / Campaigns
Target & Sectors
US
financefinance
Incident Timeline
‎2026/10/02
Threat actors used ARTEX AI, an open-source LLM-based autonomous penetration testing system, to target Fortinet devices via network vulnerabilities.
organisation Fortinet
Team Cymru, a US-based threat intelligence company, has raised the possibility that this tool could be exploited by nation-state actors to carry out attacks on Fortinet devices via network vulnerabilities.
organisation Hestra Strike
In May, the Google Threat Intelligence Group (GTIG) has identified a pattern of activity suggesting a Chinese-linked attacker targeting a Japanese technology company and an East Asian cyber security platform, using both Hestra Strike and Strikex together.
organisation Shinhan Bank
"Attacked 'Open Source Security Tool'···Urgent: Open Source Security Issue". Shinhan Bank has raised concerns that the 'ARTEX AI' open-source security tool may have been used in the recent data breach incident, prompting the need for alternative measures to prevent the misuse of publicly available security tools.
organisation ARTEX
Recently, credential stuffing incidents have occurred in the domestic financial sector, with the possibility of ARTEX AI being used also being raised.
organisation LLM
ARTEX AI is an open-source, LLM-based autonomous penetration testing system that was publicly released on GitHub.
organisation ARTEX AI
The official GitHub page of ARTEX AI explicitly states that it should not be used for scanning, exploring, or attacking websites, online services, or internet-connected systems.
organisation Juniper Security Center
According to Jun Hyun, the CEO of Juniper Security Center, "The fact that AI tools that can be used by anyone may have been used in the attack has led to a more common era of hacking.
organisation Androptic
Hermes used the Androptic's Claude Offer 4.6, while Strix and Cairn used the GLM and DeepSight models.
organisation GLM
Hermes used the Androptic's Claude Offer 4.6, while Strix and Cairn used the GLM and DeepSight models.
organisation DeepSight
Hermes used the Androptic's Claude Offer 4.6, while Strix and Cairn used the GLM and DeepSight models.
organisation HexStrike AI
Additionally, HexStrike AI stated on its official GitHub that it is a security tool developed for autonomous execution of more than 150 security tools by its AI agent, and that it is only intended for use on approved systems.
organisation CyberStrike AI
The AI-based open-source security tool CyberStrike AI integrates over one hundred security tools, automating vulnerability discovery, attack chain analysis, and exploitation.
Tactical Metrics
Metrics
infrastructure
138
Hosts
The attackers conducted a penetration test tool called Strix from August 23 to 31, executing it in deep mode 146 times and scanning 138 hosts, and from September 10 to 15, they used the penetration test engine Cairn and autonomous AI agent Hermes to conduct 105 attacks, causing damage to more than 27 companies.
Intelligence Sources
Datanet 2026-10-02