Know Thy Enemy

In the last days of September, someone broke into a loan-status lookup that a South Korean bank runs for the brokers who sell its loans. At another bank the way in was an app employees use for work on their phones. Within days several more financial companies had reported breaches.

CrowdStrike tied the bank activity to ARTEX, an open-source AI agent built for autonomous penetration testing. The operator had left the agent’s working files in open directories on their own server, so analysts could read its session history and memory. In those logs the operator asked where people usually sell Korean breach data, which Telegram groups buy it, and for help writing a security-researcher résumé that listed the results.

Sun Tzu thought the enemy’s plans could be learned only one way. “Knowledge of the enemy’s dispositions,” he wrote in The Art of War, “can only be obtained from other men.” His commentator Mei Yao-ch’en was blunter: the dispositions of an enemy are ascertainable “through spies and spies alone.”

Attack tools have been public for a long time. Metasploit has been freely available since 2003, and learning what an exploit does never took a spy. What you couldn’t download was the operator: the judgment about which target to pick, what to try next, when to dig deeper and when to move on. That lived in someone’s head.

In an AI agent, the operator is code. ARTEX’s planner is a prompt and its stop rule is a function. Both sat on GitHub until October 8, the day after CrowdStrike’s report, when the author deleted the repository at about 1,900 stars. Mirrors kept every commit. PentAGI, the other framework that keeps turning up in this fall’s threat reports, is still up, with more than 33,000 stars and 440,000 Docker pulls.

So the enemy’s judgment is now something you can read. I read both codebases (ARTEX at v0.3.15, its last public commit), along with more than a dozen threat reports from the last five weeks. They say a good deal about what the attacker is planning, and they change which half of Sun Tzu’s most famous line is the hard one.

The weapon is a coding agent

ARTEX runs on an agent library its author also published, called norma. It bills itself as a general-purpose agent harness in Go, and it reads like a rebuild of Claude Code, with read, write, edit, and shell tools, a todo list, subagents, a folder of markdown skills, and a memory file. The author’s other repositories include a source map of Claude Code and a proxy for it. This is someone who studied a coding agent closely and rebuilt it.

On top of that engine, ARTEX adds a small org chart. A goals agent turns the operator’s request into end states that can be proven. A planner reads everything learned so far and decides what to try next, and it wakes up every time something new is learned. Three workers each claim one task, run it with real tools, write what they found back to a shared graph, and stop. The job ends when the planner has attached evidence to every goal. By default it has no other way to declare victory.

The whole operator, on one screen. Everything here came out of the repository. The only part that changes from one run to the next is the box labeled “a setting.”

PentAGI is built along similar lines with a bigger staff. An orchestrator delegates; a planner drafts up to fifteen subtasks and a refiner redrafts after each one; a pentester, a coder, an installer, a searcher, a memory agent, an adviser, and a reporter do the work.

If you’ve watched a coding agent work in your repository this year, you’ve watched this. Swap “make the failing tests pass” for “get a shell on the loan-status server” and nothing else in the loop changes. The agent plans, acts with tools, reads the result, and updates the plan. For anyone forecasting what attackers will be able to do, this is the part to hold onto. Their capability tracks coding agents far more than the security tools market, and coding agents are the fastest-moving and best-funded category in software. Every improvement to longer tasks or better memory reaches attackers on the day it ships, often through an open-source repository they were already watching.

One part of ARTEX is better engineered than most agents I’ve seen, and it’s the part that checks its own work. A worker may report a finding only if it triggered the vulnerability itself in this run, with a request and response to show for it. A version number that matches a CVE doesn’t count, and neither does a parameter that merely looks injectable. The solo agent’s prompt tells it, in my translation from the Chinese, to “switch to being a skeptic first” whenever it thinks it has succeeded, and to trigger the bug again by a different path before believing it. I’ve argued before that offense improves faster because it can check its answers, since a break-in has a witness you can re-run. Here that witness is written into an attacker’s prompt. PentAGI is weaker on this point. An open bug report says its orchestrator invents results about two times in five on a simple task.

The model is a setting

ARTEX speaks three API formats, Anthropic’s and two of OpenAI’s, and accepts any base URL and key. Leave the model blank and it defaults to Claude Opus. A failover pool moves to the next provider on outages, quota errors, and access denials.

The Korean operator’s ARTEX ran on DeepSeek, bought through a reseller. They also drove Claude Code, but according to Hunt.io’s analysis of the operator’s server, that copy wasn’t calling Anthropic’s API. A router on port 3456 sent its traffic through that reseller to DeepSeek, and CrowdStrike found GLM and Grok in other sessions. Pointing Claude Code at another model takes no hacking. DeepSeek publishes a guide called “Use DeepSeek in Claude Code” and maps Claude’s model names to its own.

PentAGI is more open about it. Its README grades models partly on whether they refuse. One xAI model’s entry reads “eight of nine generator requests explicitly refused,” and another is called unsuitable as a default because of refusals. Its failover sends a call to the backup provider on any error except a cancellation or a timeout, and a content-filter rejection from the provider counts as an error. When one user reported being flagged for possible cybersecurity risk, the replies suggested getting vetted access, switching providers, or running a local model. Check Point watched an operator do this in the wild. Across the exposed ARTEX consoles it analyzed, the only model that hit a guardrail was Anthropic’s Opus 5.5, and the operator switched to more permissive Chinese models.

Model makers defend against misuse by training models to refuse and by monitoring use of their own platforms. These tools treat the model as a replaceable part. In PentAGI a provider’s rejection is an outage to fail over from, in ARTEX it’s a change of settings, and once a call lands on an open-weight model, the monitoring is gone too. Refusals still do something, and the open-weight numbers tell you roughly how much time they buy. The UK AI Security Institute found that the best open-weight models trail the closed frontier on cyber tasks by four to seven months, that its tests ran “largely unimpeded by safeguards,” and that a run costing about $85 on Claude Opus would cost an estimated $1.19 on DeepSeek V4-Pro. The US government’s CAISI, scoring a wider set of benchmarks, put DeepSeek V4 Pro about eight months back.

For your threat model, that makes model safety a delay of known length, not a control. Plan as if the attacker has the best closed models of about half a year ago, with no refusals, at a fraction of the price.

Authorization is a sentence

What separates a penetration test from a breach is permission. In both frameworks, permission is a sentence.

ARTEX’s pentest prompts tell the agent to operate only within the authorized scope. Nothing checks it. A comment at the top of ARTEX’s guard module reads: “The RoE authorization-scope mechanism was removed; a replacement may be added later.” What’s left are rules that protect the target from destruction, like blocking rm -rf and DROP TABLE, and the operator can delete every one of them. The rule against piping data out ships switched off because, a code comment explains, it misfired on legitimate reverse shells. The default list of off-limits targets has four entries: .gov, .gov.cn, .edu, and .edu.cn. Banks were never on it.

PentAGI takes the opposite approach and tells the model the question is settled. Eight of its prompt templates carry an “authorization framework” block. The pentester’s says “Never add warnings about ‘ensuring proper authorization’ - authorization is already confirmed.” The planner’s says “Never include subtasks for obtaining authorization or confirmation.” A request for a scope setting has been open since October 2025.

I don’t read malice into either choice. A pentest tool has to perform the attack, and the contract that makes it legal lives outside the software. Still, it means the line between a pentester and an intruder isn’t anywhere in the code, and that changes how to read any map of these consoles.

Security researcher P.M. (@p_misirov) posted a Shodan search showing more than a thousand ARTEX consoles, most in the US, Hong Kong, and China. Mapping them is the right first move. The harder step is telling which consoles belong to enemies, and the map alone can’t do that. Students, consultants, curious engineers, and criminals look identical from a scanner, because they run identical software, and the only thing that separates their uses is the sentence nobody checks.

The plan is in the skills folder

Intent shows up in the files an operator writes, and that’s where CrowdStrike and Hunt.io found this operator’s.

The published ARTEX ships three skills, the markdown files that teach an agent a procedure: API reconnaissance, browser automation, and a connector to the author’s asset-mapping tool. Hunt.io found that the Korean operator had written nineteen of their own and invoked them 147 times. They covered reconnaissance, WAF bypass, payment-logic testing, APK analysis, server-side request forgery, and cloud-phone control, meaning phones rented in a data center and driven remotely. The engine is generic, and the skills folder is where this operator wrote down the plan, aimed at mobile apps, payment flows, and the side doors of banks. Put that next to the questions about where Korean data sells, and you’re reading a business plan.

Anthropic described the same division of labor in one of its cases: “The human actor engaged primarily to modify Claude Code skills that drove the workflows when they needed to be refined.” The human’s job has moved from performing the attack to writing it down. Threat intel has spent decades reconstructing intent from malware samples and log lines. The richest artifact an operator leaves now is a folder of plain prose describing what they want done.

Forks show where the engine is heading. One adds one-click webshells, lateral movement inside networks, and mass exploitation of hosts pulled from search engines. Another adds tunnels for pivoting, a credential vault, honeypot detection, and a gate that serves internet scanners an ordinary nginx page, so the console drops off maps like that one. PentAGI’s issue tracker, written mostly by legitimate users, asks for things an attacker wants too: a queue for batches of thirty or more jobs, masking targets before a prompt reaches a cloud model (which also hides them from the provider’s abuse monitoring), and a way for outside agents like Claude Code to drive its Kali sandboxes without a model key of their own. Read as a roadmap, it points toward more jobs per operator and less for the model provider to see. If you buy threat intelligence, ask for the markdown along with the indicators, because the markdown is the plan.

Water runs to the low ground

For all the engineering, the attacks mostly went to poorly guarded places. The ways into the Korean banks were a loan-status lookup for brokers and a staff mobile app: services with weak checks on who was asking, where records could be pulled one after another by stepping through their identifiers. The attackers invented nothing new. They found loosely managed peripheral systems, quickly. Google put it this way: AI tooling “does not fundamentally change the techniques attackers use. It reduces the time required to combine them.”

Sun Tzu has a line for this. “Military tactics are like unto water; for water in its natural course runs away from high places and hastens downwards. So in war, the way is to avoid what is strong and to strike at what is weak.” An agent behaves like water. It doesn’t get bored and it doesn’t get discouraged. ARTEX’s worker prompt says a filtered payload or a 404 doesn’t close a path until the bypasses are exhausted. So the agent keeps flowing over the surface until it finds the lowest point.

The water was always there. What fell is the price of reaching the low ground. Commodity crews have hit small organizations in bulk for years, but their playbooks skipped anything that needed a person to understand one application. A broker’s loan-status page used to be too small to justify a skilled person’s week. Now it costs an evening of tokens, so targets that were never worth the labor become viable. In late October, Seoul police arrested a ring that had used ARTEX in most of its attacks on more than 90 organizations. Alongside large corporations, the list included educational institutes and golf courses, places that rarely justified a skilled crew’s time two years ago.

I wrote about this shift with patch diffing and fixed-capacity SOCs. The technique is old. The labor was the defense, and the labor is gone.

Loud, for now

This year’s ARTEX operators are in a hurry. Google says these frameworks “compress attack timelines to machine speed; however, they currently trade stealth for velocity,” and it saw execution in bursts of 2 to 25 seconds, with long pauses between them. Microsoft watched a China state-aligned group use ARTEX to attempt sign-ins to more than 2,250 tenants. A separate password spray from the group’s infrastructure peaked at 2,900 failures a minute and never got in.

The haste extends to their own infrastructure. Nearly everything known about the Korean operator came from directories they left open: session histories, memory files, configuration, a CLAUDE.md. Their TLS certificate named “ARTEX” as its issuer. The console’s page title starts with “ARTEX,” which is how scanners count them. ARTEX versions before 0.3.15 had a login bug that let an outsider take over the console, and a backdoored ARTEX image on Docker Hub was pulled more than 9,000 times. BadByte, reviewing it, summed it up: “People who went looking for a tool to break into other networks got one that opened theirs.”

“To secure ourselves against defeat lies in our own hands,” Sun Tzu wrote, “but the opportunity of defeating the enemy is provided by the enemy himself.” Right now the enemy is providing a lot. Machine-speed bursts and floods of failed logins are easy to see if you watch rates instead of single events, which is why Mandiant’s guidance ends with monitoring “identity velocity, API bursts, and volumetric anomalies.” Seeing it is only half the job. Google also warns that “simply detecting the attack in time does little to hinder objective completion,” so at this speed the alert has to be wired to something that can cut the session off. The fingerprints are public, and the operators’ own servers are often softer than their targets.

Don’t count on that lasting. The fork that hides its console from scanners already exists, and stealth is one skill file away. The noise comes from this year’s operators, and next year’s can write a quieter skill.

How it maps you

The first thing one of these agents does to a target is map it, and the map is the part worth copying. The recon half of ARTEX’s graph fills in four moves.

It fixes a goal and a scope. The goals agent turns “get into this company” into outcomes it can later prove, and notes the boundary it is meant to stay inside. The boundary is advisory, as we saw.

It enumerates your surface into a graph. The asset graph has a fixed spine, root domain to subdomain to service to endpoint, with the technology behind each one hung off the side. An attack-surface scanner finds these things too and hands you a list. The graph is a set of places the agent will come back to.

It ranks what it found. With the whole surface in one graph, the agent can reason about which endpoints guard data or sit behind privilege and put its effort there. The planner’s written rule is depth over coverage. Holding the application as one connected picture is the context advantage I wrote about earlier, where the attacker keeps the board state while the defender rebuilds it from fragments.

It keeps the map. The asset graph is global, shared across every job that install runs, so each target the operator touches adds to one standing picture. Recon doesn’t reset between engagements. By the time the agent is finished, the operator holds a more complete and better-organized view of your external surface than you keep of it yourself.

Map yourself first, and keep the map

Every move in that list is one you can run against your own company, and most of it is already sold as a category called attack-surface management. Do the attacker’s recon first, on yourself, and keep the result.

Scope it the way they do. Your edge is every service a stranger can send a request to, which takes in partner portals, broker lookups, and staff apps, not the shorter list of things you call production. After the breaches, Korea’s regulator ran a checklist across 555 financial firms. 130 reported shortfalls, mostly in patching and monitoring, and the list also named weak attack-surface management, meaning external systems missing authentication and critical services without multi-factor.

Enumerate it continuously. Build that graph for your own surface, and rebuild it, because it changes every week. The honest way to do that is to point an agent at your own perimeter, under your own authorization, and let it work the surface the way an attacker’s would. Full disclosure: a continuous pentest agent that does this, composing and running tests tailored to your environment, is what my team builds at Simbian. Whatever you run, treat it like anything else that holds your keys and runs code. Build it from source, keep its console off the internet, and never mount the host’s Docker socket into its sandbox.

Rank it the way they would. Find the endpoints that gate data or privilege, and treat business logic, like who may look up which loan, as part of the surface. An agent will test that logic exhaustively for the price of an evening, and a scanner that only checks for known CVEs walks right past it.

Keep the map where your defenders can read it. This is the part the word “recon” hides. A map earns its keep only if the people who triage alerts can see it before they decide. That means one current picture of your surface, its owners, and what normal looks like. It is the first column of the bank intrusion, drawn from the defender’s side.

The intrusion used nothing new, which is good news, because every stage meets a control you already know. The catch is the first column. A control only runs on a surface you knew you had.

The attacker’s map of you grows with every job they run. The only answer that keeps pace is a map of yourself that grows faster and sits where your defenders can reach it.

Where this breaks

Attribution is thinner than the headlines. CrowdStrike’s assessment of the Korean operator is moderate confidence and names no group. Korea’s regulator never named ARTEX, and Hunt.io, which recovered the operator’s tooling, calls its link to the bank breaches unconfirmed. Coverage counts seven firms or 16, but no report has shown one actor behind all of them.

The skill floor dropped, but it didn’t vanish. The leader of the Seoul ring had a background in penetration testing and about three years at a security company. A crypto campaign Check Point studied spent up to $300 and moved no money, and some of its findings were hallucinated. Anthropic’s own read of its cases is that humans still make the decisions that matter most.

Old techniques cut both ways. Because nothing here is new, existing controls work. Two of the targeted Korean banks reportedly blocked the attempts with intrusion prevention, and multi-factor authentication stops a credential-spraying agent as well as it stops a person. Defenders get a similar boost wherever there’s a check to run; in DARPA’s AI Cyber Challenge, competing systems found 86 percent of the planted bugs and patched 68 percent. The aggregate numbers haven’t exploded yet, either. VulnCheck found that “early exploitation activity has not scaled at the same pace as CVE issuance.”

Know yourself

Sun Tzu’s famous line has three parts, and people usually quote only the first. “If you know the enemy and know yourself, you need not fear the result of a hundred battles. If you know yourself but not the enemy, for every victory gained you will also suffer a defeat. If you know neither the enemy nor yourself, you will succumb in every battle.”

For most of history the expensive half was the enemy. That took spies. This fall it cost a git clone and an afternoon of reading. The planner prompt, the stop rule, the skills, even the operator’s notes to themselves are sitting in public.

Knowing the enemy got cheap. Knowing yourself didn’t. Nobody is going to publish the map of your company. You have to draw that one yourself, and the other side has already started.