# ARTEX.sh

> How the ARTEX AI pentest framework works, its 42 public forks, benchmark scores and dated news. Unofficial, source-linked.

ARTEX is an open-source (AGPL-3.0) AI system for autonomous penetration testing by Autumn-27: LLM planner and worker agents over a dual graph, in Go with a Next.js console over PostgreSQL. The original repo Autumn-27/ARTEX was deleted on 2026-10-08; the last original release is v0.3.15 (commit e6ec569). RuoJi6/ARTEX is the main maintained fork (latest v0.3.25). Unofficial. Not affiliated with Autumn-27, ThreatBook / RedAgents, or any fork maintainer. Hosts no ARTEX code. Data as of 2026-11-02.

## Pages

- [Home](https://www.artex.sh/): overview, the 42 copies, scores, news and FAQ
- [How ARTEX works: agents, graphs and the guard](https://www.artex.sh/how-it-works): How the ARTEX AI pentest framework runs: planner and worker agents, a dual graph, a three-step guard and every release.
- [All 42 ARTEX forks, mirrors and copies](https://www.artex.sh/forks): Every notable public ARTEX fork after the original repo was deleted: stars, version, last push and kind, as of 2026-11-02.
- [ARTEX benchmarks: Baidu Agent+ and TSecBench](https://www.artex.sh/benchmarks): ARTEX scored 67.83 on the Baidu Agent+ live range and 89.78 on Tencent TSecBench, and won the 2026 Baidu Agent+ final.
- [ARTEX news: bank breaches, deletion, GTIG report](https://www.artex.sh/news): Dated ARTEX news from the first commit to the GTIG report: Korean bank breaches, the deletion, Storm-0940 and more.

## Forks

- [RuoJi6/ARTEX](https://www.artex.sh/forks/ruoji6-artex): Maintained, 1017 stars, v0.3.15, last push 2026-11-02. Actively maintained successor. Releases + Docker ruoji6/artex.
- [sharenjun/ARTEX-main](https://www.artex.sh/forks/sharenjun-artex-main): Maintained, 151 stars, v0.3.15, last push 2026-11-02. Accepts issues; commits to maintaining.
- [fraternity-z/ARTEX](https://www.artex.sh/forks/fraternity-z-artex): Maintained, 1 stars, v0.3.15, last push 2026-10-22. Independently maintained, AGPL history kept.
- [jiwoochris/artex-global](https://www.artex.sh/forks/jiwoochris-artex-global): Translations, 2521 stars, v0.3.15, last push 2026-10-14. English default, KO/CN/ES/JA.
- [BaaRai/ARTEX](https://www.artex.sh/forks/baarai-artex): Translations, 1106 stars, v0.3.15, last push 2026-10-25. English translation of UI and prompts.
- [cskwork/scopeweaver](https://www.artex.sh/forks/cskwork-scopeweaver): Translations, 860 stars, v0.3.15, last push 2026-10-30. English + Korean localization (ScopeWeaver).
- [bdg9412/artex-ko-plus](https://www.artex.sh/forks/bdg9412-artex-ko-plus): Translations, 256 stars, v0.3.15, last push 2026-10-31. Korean edition + incident-response features.
- [azrielnan/artex-ko-main](https://www.artex.sh/forks/azrielnan-artex-ko-main): Translations, 111 stars, v0.3.15, last push 2026-10-30. Korean-oriented authorized-research platform.
- [horizonl/ARTEX](https://www.artex.sh/forks/horizonl-artex): Translations, 26 stars, v0.3.15, last push 2026-10-07. English UI build.
- [chrgu000/artex](https://www.artex.sh/forks/chrgu000-artex): Translations, 2 stars, v0.3.15, last push 2026-10-08. Default-Chinese build restored from the Korean edition.
- [Error336070/ARTEX](https://www.artex.sh/forks/error336070-artex): Translations, 1 stars, v0.3.15, last push 2026-10-13. English port.
- [trhhubsd/ARTEX](https://www.artex.sh/forks/trhhubsd-artex): Mirrors, 1274 stars, v0.3.15, last push 2026-10-19. Chinese mirror of the original project page.
- [bookSiYi1412/ARTEX](https://www.artex.sh/forks/booksiyi1412-artex): Mirrors, 19 stars, v0.3.15, last push 2026-10-12. Mirror with Baidu agent+ champion copy.
- [RC-CHN/ARTEX](https://www.artex.sh/forks/rc-chn-artex): Mirrors, 9 stars, v0.3.15, last push 2026-10-27. Unmodified mirror.
- [Hinln/ARTEX](https://www.artex.sh/forks/hinln-artex): Archives, 1239 stars, v0.3.15, last push 2026-10-08. v0.3.15 backup with original history. Most-linked backup.
- [jaykwok/ARTEX](https://www.artex.sh/forks/jaykwok-artex): Archives, 34 stars, v0.3.15, last push 2026-10-23. Backup of v0.3.15 (e6ec569) with recovery notes.
- [yes-chen/ARTEX](https://www.artex.sh/forks/yes-chen-artex): Archives, 13 stars, v0.3.15, last push 2026-10-08. Re-upload from Hinln/ARTEX.
- [3185263343/ARTEX](https://www.artex.sh/forks/3185263343-artex): Archives, 10 stars, v0.3.15, last push 2026-10-08. Backup of the deleted mhtsec/ARTEX mirror.
- [Core-RCE/ARTEX-original-version](https://www.artex.sh/forks/core-rce-artex-original-version): Archives, 8 stars, v0.3.15, last push 2026-10-13. Unmodified pre-closure archive.
- [wpsec/ARTEX-local](https://www.artex.sh/forks/wpsec-artex-local): Archives, 6 stars, v0.3.15, last push 2026-10-30. Last-version source + from-source Docker notes.
- [bear20252026/ARTEX-release](https://www.artex.sh/forks/bear20252026-artex-release): Archives, 5 stars, v0.3.12, last push 2026-10-10. v0.3.12 precompiled binaries.
- [acheong08/artex](https://www.artex.sh/forks/acheong08-artex): Archives, 4 stars, v0.3.15, last push 2026-10-09. Mirror.
- [richard1230/artex-backup](https://www.artex.sh/forks/richard1230-artex-backup): Archives, 4 stars, v0.3.14, last push 2026-10-08. v0.3.14 offline backup (fail-open auth RCE).
- [Ernket/CodeScan-Artex](https://www.artex.sh/forks/ernket-codescan-artex): Derivatives, 255 stars, v0.3.15, last push 2026-10-28. Code-audit variant, Java decompile, multi-account.
- [bluechips-zhao/DITING](https://www.artex.sh/forks/bluechips-zhao-diting): Derivatives, 123 stars, v0.3.15, last push 2026-10-30. Rebranded workbench (DITING).
- [AntiFox-AI/antifox](https://www.artex.sh/forks/antifox-ai-antifox): Derivatives, 63 stars, v0.3.15, last push 2026-10-31. Second-generation platform from ARTEX.
- [willsurpass/WSARTEX](https://www.artex.sh/forks/willsurpass-wsartex): Derivatives, 21 stars, v0.3.15, last push 2026-10-20. Asset discovery, vuln management, local panel.
- [IcebergN2026/artex-ld](https://www.artex.sh/forks/icebergn2026-artex-ld): Derivatives, 13 stars, v0.3.15, last push 2026-11-02. Pipeline / orchestration variant.
- [wufufu770/reArtex](https://www.artex.sh/forks/wufufu770-reartex): Derivatives, 10 stars, v0.3.15, last push 2026-10-28. Hardened: tool-tier approval, encrypted keys, audit hash chain.
- [TATHPE/ARTEX-Endfield](https://www.artex.sh/forks/tathpe-artex-endfield): Derivatives, 6 stars, v0.3.15, last push 2026-10-18. Arknights: Endfield themed.
- [D4rk-3ch0/artex-c](https://www.artex.sh/forks/d4rk-3ch0-artex-c): Derivatives, 5 stars, v0.3.15, last push 2026-10-15. Honeypot detection, RoE gating, CoT prompting.
- [kismetpro/0x](https://www.artex.sh/forks/kismetpro-0x): Derivatives, 2 stars, v0.3.15, last push 2026-10-24. Renamed coexistence branch (separate ports/images).
- [ThanatosXingYu/BRTEX](https://www.artex.sh/forks/thanatosxingyu-brtex): Derivatives, 2 stars, v0.3.15, last push 2026-11-02. Personal modified edition.
- [Xiao1an/ARTEX-God](https://www.artex.sh/forks/xiao1an-artex-god): Offensive, 54 stars, v0.3.15, last push 2026-10-21. Getshell, lateral movement, IoT/satellite protocols.
- [panda0x123/artex-ymh](https://www.artex.sh/forks/panda0x123-artex-ymh): Offensive, 51 stars, v0.3.15, last push 2026-09-19. External breach to internal depth.
- [2561769445/ycode-auto-pentest](https://www.artex.sh/forks/2561769445-ycode-auto-pentest): Offensive, 6 stars, v0.3.23, last push 2026-10-26. YUELuo build: domain attack, report automation.
- [therustymate/ARTXploit](https://www.artex.sh/forks/therustymate-artxploit): Offensive, 6 stars, v0.3.14, last push 2026-10-11. Pre-auth RCE PoC vs v0.3.14 fail-open auth.
- [chu0119/artex-skill](https://www.artex.sh/forks/chu0119-artex-skill): Rebuilds, 12 stars, methodology, last push 2026-10-09. Methodology as a portable agent skill.
- [01NGVI-QINGYI/ARIA-X](https://www.artex.sh/forks/01ngvi-qingyi-aria-x): Rebuilds, 4 stars, methodology, last push 2026-10-23. Python rebuild fusing ARTEX + Cairn + PentAGI ideas.
- [hmruu/ARTEX-Magisk](https://www.artex.sh/forks/hmruu-artex-magisk): Rebuilds, 3 stars, v0.3.15, last push 2026-10-21. Run ARTEX on Android via Magisk.
- [froiibn/ARTEX-Desktop](https://www.artex.sh/forks/froiibn-artex-desktop): Rebuilds, 2 stars, v0.3.15, last push 2026-10-15. Rust desktop rebuild, no Docker/DB server.
- [nina27owo/ARTEX-Controller](https://www.artex.sh/forks/nina27owo-artex-controller): Rebuilds, 2 stars, v0.3.15, last push 2026-10-30. Multi-machine SSH console.

## Benchmarks

- Baidu BSRC 'Agent+' attack/defense challenge, overall: National champion, 1st overall (50% live range + 50% jury review) (2026-09-03)
- Baidu Agent+ live range: 67.83/100, 7th place; 5h08m18s effective time; 456,495,944 tokens (2026-08-16)
- Tencent TSecBench blind-test range: 89.78/100, 6th on the latest leaderboard; 5h03m40s effective time; 270,797,493 tokens (reported 2026-09-03)
- BaaRai/ARTEX L3 benchmark harness (Juice Shop ground truth, 8 entries, independent LLM judge, Wilson 95% CI): Harness only; results dir is gitignored, no numbers published (2026-10-12 (PR #59))
- docker-compose.bench.yml in upstream: Compose stub for an artex-bench container (Dockerfile.bench, bench/.env not in repo); no results (undated)
- /btw side-question validation: Engineering test table, all pass; not a capability benchmark (2026-09-10)

## News

- 2026-10-30 [ARTEX and Friends: Enter Agentic Offensive Frameworks](https://cloud.google.com/blog/topics/threat-intelligence/artex-and-friends-enter-agentic-offensive-frameworks) (Google Threat Intelligence Group + Mandiant, EN)
- 2026-10-26 [Former pentester used ARTEX AI to steal 8.2 million data records](https://www.bleepingcomputer.com/news/security/former-pentester-used-artex-ai-to-steal-82-million-data-records/) (BleepingComputer, EN)
- 2026-10-26 [China-Aligned Hackers Used AI Tool To Target Over 2,250 Cloud Environments Worldwide](https://www.republicworld.com/tech/china-aligned-hackers-used-ai-tool-to-target-over-2250-cloud-environments-worldwide-2026-10-26-139713) (Republic World, EN)
- 2026-10-22 [Microsoft: Chinese State Actor Used AI to Compromise ConnectWise Tenants](https://infosecurity-magazine.com/news/microsoft-chinese-ai-connectwise) (Infosecurity Magazine, EN)
- 2026-10-21 [Microsoft ties Storm-0940 to ARTEX-driven ConnectWise Cloud Backup compromise](https://thehackernews.com/2026/10/china-linked-hackers-use-artex-ai.html) (Microsoft Threat Intelligence (via The Hacker News, 2026-10-22), EN)
- 2026-10-20 [日本企業への不正アクセス、中国のAIツール「ARTEX」使用を確認](https://watch.impress.co.jp/docs/news/2149749.html) (Impress Watch, JA)
- 2026-10-19 [GMO Cybersecurity by Ierae confirms ARTEX on infrastructure attacking Japanese companies](https://scan.netsecurity.ne.jp/article/2026/10/21/56522.html) (ScanNetSecurity (dated 2026-10-21), JA)
- 2026-10-16 [ThreatBook launches RedAgents with ARTEX Pro](https://zdnet.co.kr/view?no=20261020091002) (ZDNet Korea (press release, dated 2026-10-20), KO)
- 2026-10-13 [冠军 AI 渗透工具 ARTEX 架构拆解](https://cn-sec.com/archives/5490221.html) (CN-SEC (repost of WeChat 知白守黑1024), ZH)
- 2026-10-10 [Chinese AI tool linked to Korean bank hacks halts public updates as suspect denies involvement](https://www.koreajoongangdaily.com/business/chinese-ai-tool-linked-to-korean-bank-hacks-halts-public-updates-as-suspect-denies-involvement/12913376) (Korea JoongAng Daily, EN)
- 2026-10-10 [Hacker used ARTEX AI and Claude agents to target South Korean banks](https://www.bleepingcomputer.com/news/security/hacker-used-artex-ai-and-claude-agents-to-target-south-korean-banks/) (BleepingComputer, EN)
- 2026-10-09 [금융권 해킹 'ARTEX', 여러 AI 지휘하는 플랫폼으로 진화](https://www.sedaily.com/article/20099790) (Seoul Economic Daily (서울경제), KO)
- 2026-10-09 [ARTEX AI Agent Goes Closed After Korea Bank Hacks](https://www.technology.org/2026/10/09/artex-ai-agent-closed-source-korea-bank-hacks/) (Technology.org, EN)
- 2026-10-09 [China's ARTEX makes AI agent closed-source after Korean bank hack](https://www.dealstreetasia.com/?p=497682) (DealStreetAsia, EN)
- 2026-10-09 [AI-Driven tool ARTEX used in attacks against South Korean Banks](https://securityaffairs.com/200661/) (Security Affairs, EN)
- 2026-10-08 [ARTEX AI pentesting tool used in data theft from South Korean financial firms](https://thehackernews.com/2026/10/artex-ai-pentesting-tool-used-in-data.html) (The Hacker News, EN)
- 2026-10-08 [ARTEX goes closed-source; Autumn-27/ARTEX deleted](https://www.koreajoongangdaily.com/business/chinese-ai-tool-linked-to-korean-bank-hacks-halts-public-updates-as-suspect-denies-involvement/12913376) (GitHub / multiple outlets, EN)
- 2026-10-07 [금융권 공격한 '아르텍스', 中 AI '딥시크' 연동 기능 갖췄다](https://www.fnnews.com/news/202610071820584232) (Financial News (파이낸셜뉴스), KO)
- 2026-10-07 [Unknown Threat Actor Uses AI-Driven ARTEX to Target South Korean Finance](https://www.crowdstrike.com/en-us/blog/unknown-threat-actor-uses-artex-to-target-south-korean-finance/) (CrowdStrike blog, EN)
- 2026-10-06 [ARTXploit: ARTEX v0.3.14 pre-auth RCE via fail-open authentication](https://github.com/therustymate/ARTXploit) (GitHub (therustymate), EN)
- 2026-10-06 [AhnLab finds ARTEX on 600 IPs as police probe South Korean bank breaches](https://runtimewire.com/article/south-korea-bank-breaches-artex-ai-probe) (RuntimeWire (citing Yonhap), EN)
- 2026-10-05 [Open-Source AI Agent Hacked Seven South Korean Banks, Exposing 65,000 Records](https://www.techtimes.com/articles/328541/20261005/open-source-ai-agent-hacked-seven-south-korean-banks-exposing-65000-records.htm) (Tech Times, EN)
- 2026-10-04 [해킹에 악용된 AI 에이전트는 아르텍스](https://www.hankyung.com/article/2026100427051) (Hankyung (한국경제), KO)
- 2026-09-03 [ARTEX wins the first Baidu BSRC 'Agent+' attack/defense challenge (national champion)](https://cn-sec.com/archives/5418792.html) (CN-SEC (repost of WeChat 网络安全透视镜), ZH)
- 2026-08-16 [ARTEX live-range run in the Baidu Agent+ challenge](https://cn-sec.com/archives/5418792.html) (CN-SEC (repost of WeChat 网络安全透视镜), ZH)
- 2026-07-26 [ARTEX first commit 'chore: ARTEX 初始化' (open-source release on GitHub)](https://github.com/Hinln/ARTEX/commit/0ef8561411dd1757e41ba3c45d1436e1fd3774f1) (GitHub (history preserved in Hinln/ARTEX), ZH)
- 2026-07-20 [norma agent SDK repo created by Autumn-27](https://github.com/Autumn-27/Norma) (GitHub, EN)

## FAQ

### What is ARTEX?

An open-source AI system for autonomous penetration testing by Autumn-27: LLM planner and worker agents over a dual graph, written in Go with a Next.js console. AGPL-3.0.

### Where is the original ARTEX GitHub repo?

Autumn-27/ARTEX was deleted on 2026-10-08 and returns 404. The last open release, v0.3.15, survives in archives such as Hinln/ARTEX.

### Which ARTEX fork is maintained?

RuoJi6/ARTEX is the most active successor, with releases up to v0.3.25 and Docker images at ruoji6/artex.

### What is ARTEX Pro?

A commercial edition sold by ThreatBook on RedAgents. It has no public source code.

### Was ARTEX used in the Korean bank breaches?

CrowdStrike, AhnLab and Korean press tied ARTEX to the October 2026 breaches at South Korean financial firms. The author denies involvement.

### How does ARTEX work?

A planner agent reads the target graph and dispatches tasks. Three worker agents run real tools like nmap, curl and Playwright, and a guard checks every tool call before it runs.

### What is the latest ARTEX version?

RuoJi6/ARTEX ships v0.3.25. The last release from the original repo is v0.3.15, commit e6ec569, which most mirrors and archives keep.

### What license is ARTEX under?

AGPL-3.0. Forks that run ARTEX as a network service must publish their source code under the same license.

### Which ports does ARTEX use?

The web console and API listen on port 8787. The recording proxy that captures all tool traffic uses port 8788 with its own certificate authority.

### Is ARTEX available in English?

Yes. The original interface is Chinese. jiwoochris/artex-global defaults to English, and other forks add Korean, Chinese, Spanish and Japanese.

### Is it safe to expose an ARTEX console online?

No. v0.3.14 has a login bypass that lets an outsider take over the console. Upgrade, keep the console off the internet and put it behind a VPN.

### Is artex.sh official?

No. It is an independent guide. It is not affiliated with Autumn-27, ThreatBook or any fork maintainer, and it hosts no code.