The Chinese developer of ARTEX says they have converted the AI agent into a closed-source project after CrowdStrike said it was used to hack South Korean banks
Context & Ripple Effects
CrowdStrike's analysis identified ARTEX in the South Korean bank intrusions and characterized the actor as likely Chinese-speaking and financially motivated. The case follows an August report that suspected Chinese hackers used open-source AI agents to build an autonomous tool against Taiwanese government websites, making public agent code a security-governance issue rather than solely a developer-distribution choice.
The ARTEX developer's stated move from open source to closed source is a direct response to that alleged misuse. It also arrives amid CrowdStrike's earlier finding that Chinese entities accounted for a large share of state-sponsored attacks targeting technology companies and AI assets.
First-order effects
- ARTEX's developer takes control of access to the agent's source code, ending the project's open-source distribution model after CrowdStrike linked it to attacks on South Korean banks.
- South Korean banks and their incident-response partners gain a named AI-agent lead from CrowdStrike's analysis of the intrusions for investigating the reported activity.
Second-order effects
- Independent defenders lose the ability to inspect ARTEX's source directly, shifting assessment of the tool toward observed behavior and developer disclosures.
- Other developers of open-source agentic cybersecurity tools face greater pressure to weigh broad code availability against the risk that financially motivated attackers can adapt their work.
Third-order effects
- If developers repeatedly close agentic tools after reported abuse, cyber-AI development may split more sharply between publicly auditable projects and access-controlled offerings.
- The Taiwanese and South Korean cases point toward AI-agent governance being shaped not only by model capability, but by who can obtain, modify, and operationalize the surrounding tooling.
The trend: Agentic cybersecurity tools are becoming a model-access governance issue as reported misuse forces developers to reconsider open-source distribution.