AI-based offensive cybersecurity company Theori said on Oct. 15 it published a white paper that provides an in-depth analysis of the AI security tool ARTEX, whose traces were confirmed in a recent security breach in South Korea’s financial sector. The company said the paper includes threats and countermeasures verified through its own tests.

The white paper covers the open-source AI security tool ARTEX used in breaches targeting domestic financial institutions that occurred from late September 2026. It also details how AI-based attack tools, which have recently increased sharply, operate and the nature of the threats they pose.

The analysis found that AI security tools, in carrying out attacks by planning and executing tools without human involvement, leave behavioural patterns such as the sequence, frequency and repetition of requests, along with unique identifying information.

In an experiment verifying ARTEX safety mechanisms, test data was actually deleted during a simple vulnerability-check process. Theori said the deletion was not blocked even with LLM-based safety mechanisms enabled.

Based on the findings, Theori released for free a set of detection rules that can be applied in corporate monitoring and incident investigations through its GitHub repository. The company said security teams can use the rulesets to identify traces of AI tools used by attackers and establish systems for automated responses linked to playbooks.

Se-jun Park (박세준), Theori's chief executive, said, "In a situation where attacks are evolving at AI speed, traditional defense systems where people respond manually are bound to hit their limits." He added, "Along with automated systems that precisely detect and block traces of attack AI, there must be an always-on security system that uses a safely controlled AI platform to protect service availability and data and proactively remove vulnerabilities before attackers do."