Theori today announced the release of a whitepaper that takes an in-depth look at “ARTEX,” an AI security tool whose use was confirmed in recent breaches at Korean financial institutions, along with the threats and countermeasures Theori validated through its own experiments.

The whitepaper examines ARTEX, an open-source AI security tool used in a series of breaches targeting Korean financial institutions since late September 2026, as well as how the fast-growing category of AI-powered attack tools operates and the real threats it poses.

According to the whitepaper, Theori ran AI security tools including ARTEX and CyberStrikeAI in a controlled environment and precisely measured the common behavioral traces that offensive AI leaves in network and server logs.

The analysis found that as AI security tools plan attacks and execute tools on their own without human intervention, they leave behind unique identifiers along with behavioral patterns in the sequence, frequency, and repetition of their requests. Once an AI security tool settles on an action after reasoning, it tends to concentrate its requests. In terms of volume, a scanner invoked by CyberStrikeAI generated more than 32,000 requests in 20 minutes, enough to potentially affect the availability of the target service. In a separate experiment testing ARTEX’s safeguards, test data was actually deleted during a simple vulnerability check, and the tool’s LLM-based safeguards failed to prevent it even when enabled.

Based on these findings, Theori has released free “detection rulesets” (for Suricata, Sigma, YARA, ModSecurity, and more) on its GitHub repository that security teams can apply immediately in monitoring and incident investigation. Security organizations can use the rulesets to identify traces of the AI tools attackers are using and link them to playbooks for automated response.

The whitepaper also stresses that because attackers have used AI to drastically shorten the speed and cadence of their attacks, defenders must likewise use controlled AI security tools to continuously test their own assets on shorter cycles. At the same time, because indiscriminately deploying unvetted open-source AI tools in internal production environments can lead to data leaks, system outages, and uncontrolled data deletion, the whitepaper also provides a “Pre-Adoption Checklist for AI Security Tools.”

“As attacks evolve at the speed of AI, traditional defenses that rely on manual human response will inevitably hit their limits,” said Brian Pak, CEO of Theori. “Organizations need automated systems that precisely detect and block traces of offensive AI, combined with an always-on security posture that uses a safely controlled AI platform, one that protects service availability and data, to find and eliminate vulnerabilities before attackers do.”