Released as Open Source, Including ARTEX
Easy for Beginners to Modify Source Code
Urgent Need to Strengthen Defense Systems and Invest in Human Resources
It has been revealed that not only 'ARTEX', which was recently known to have been abused in attacks on the domestic financial sector, but also various penetration testing artificial intelligence (AI) tools have been released as open source accessible to anyone. Industry evaluations suggest that security threats have grown because even beginners can utilize them for actual attacks if they modify the source code. Vulnerability diagnosis assuming AI-based attacks is urgent.
According to the industry on the 6th, on 'GitHub', the world's largest software development platform, 'Pozhen Agent' and 'BLHX', which competed with ARTEX in the Baidu Security Response Center (BSRC) 'Agent+' offense and defense capability competition last month, were also found to be open-sourced.
In addition, 'Strix', which automates vulnerability detection and attack verification, 'PentAGI', in which AI combines multiple security tools to perform penetration testing, and 'PentestGPT', which supports Large Language Model (LLM)-based penetration testing, are also open to the public and attracting developers' attention.
The original purpose of penetration testing AI is defense. Instead of humans inspecting systems one by one, AI is used to find vulnerabilities, test attack possibilities, and elevate security levels.
The problem arises after they are released as open source. In the process of downloading the full source code and maliciously modifying it, attackers can remove safety mechanisms placed by developers or alter functionalities. As AI handles parts of the penetration process that previously required substantial specialized expertise, the barrier to entry for hacking itself has lowered.
Cases of actual open-source abuse are also being reported. Cisco Cyber Threat Intelligence unit (Talos) disclosed an instance in August where Chinese-speaking hacking group 'UAT-10147' utilized multiple open-source attack and penetration tools, including PentestGPT, in actual attacks. The attackers utilized AI tools in the process of searching for vulnerabilities on web servers and verifying attacks.
It is difficult to prevent the open-source release of AI penetration tools itself. This is because security researchers also utilize the same tools to identify vulnerabilities and improve defensive technologies.
Experts assess that many of the AI-based attack methods recently reported are combinations of low- to mid-level hacking techniques, such as conventional vulnerability scanning and tool automation. Analysts also indicate that attacks on the domestic financial sector using ARTEX AI are at a low level.
For this reason, they advise that AI attacks at the level of the recent financial sector attacks can be largely prevented simply through basic vulnerability management, prompt patching, and strengthening access controls.
For mid-level attacks as well, even if attackers use AI, defenses must be prepared in a form that reinforces security systems so that penetration requires more time and cost.
Park Chan-am, CEO of STEALIEN, said, “Defenders should also use publicly available open-source penetration testing AI to conduct their own vulnerability assessments.” He added, “Vulnerabilities discovered during this process must be patched immediately, and active investments should be made in adopting necessary security solutions and hiring specialized talent.”
