After CrowdStrike tied it to South Korean bank breaches, open-source pentest agent ARTEX goes closed source and its GitHub repo comes down

Why it matters

【Key points】

On Oct 7 CrowdStrike said the string of breaches at South Korean financial institutions since late September was most likely the work of a China-based 26-year-old using the open-source AI pentest agent ARTEX together with Anthropic's Claude Code. A day later ARTEX's developer, GitHub user Autumn-27, posted a notice on GitHub: because of misuse, the project will no longer be updated and will become closed source, with no further public releases and no maintenance.

【Verifiable】

Reuters reported the notice on Oct 9 and said ARTEX's GitHub page had been taken down when it checked. The notice says the tool was meant for authorized security testing, opposes illegal use and disclaims responsibility for unlawful conduct, without naming the Korean attacks. ARTEX is not a model but a multi-agent framework that connects to external LLMs such as ChatGPT, Claude and DeepSeek to analyze targets, plan attack paths and run security tools. At least nine Korean financial firms have disclosed or been reported as targets; police have opened a probe and President Lee Jae-myung has called for a strong response. Experts note already-downloaded copies keep working. ARTEX-related posts on X totaled about 420 in the past 24 hours and are still running at a dozen or so an hour.

【Our read】

This is the first time an open-source AI agent has been pulled by its own author after a real-world attack, but it reads more as a liability disclaimer than real containment: the code is already widely copied, and the attack capability comes mostly from the commercial models it calls. The pressure now shifts two ways. Model providers will be expected to detect automated attack chains at the API and coding-agent layer, and regulators may start treating agent frameworks that can run penetration tests autonomously as their own category for release norms. Next to watch: whether GitHub and similar platforms tighten policy on comparable projects.