Artificial intelligence has become a familiar part of the conversation about how security teams can detect threats and investigate incidents more efficiently. Increasingly, however, the same conversation needs to consider how attackers are using AI-assisted tools in real intrusions. Research published by CrowdStrike on 7 October 2026 linked the ARTEX AI-powered penetration-testing agent to attacks targeting South Korean financial institutions, including reported data exfiltration. Recovered configurations and session histories offered a rare view into how agentic tooling and large language models were used during the campaign.
Reuters subsequently reported that ARTEX’s developer withdrew the project’s publicly available source code following reports of misuse. The withdrawal is notable, but the wider lesson is not about one tool. AI-assisted offensive capabilities may allow attackers to accelerate parts of reconnaissance and intrusion activity, while defenders still need to recognise suspicious behaviour across increasingly complex networks.
What the ARTEX Case Reveals About AI-Assisted Attacks
The findings matter because they go beyond a theoretical demonstration. The recovered records helped researchers reconstruct aspects of the attacker’s workflow, although they do not establish that the entire campaign operated autonomously without human direction. AI-assisted activity can coexist with conventional intrusion techniques and human decision-making. The practical concern is that certain tasks may become faster or less labour-intensive, potentially increasing the pressure on already stretched security operations teams.
For organisations protecting sensitive applications and infrastructure, the most useful response is not to try to predict every offensive AI tool that might appear. It is to ask whether existing security capabilities can detect changes in system behaviour, connect individual observations and provide enough evidence for a timely investigation.
Why Network Visibility Still Matters
Whether an intrusion is directed by a person, an automated script or an AI agent, an attacker may still need to communicate with internal systems, access applications and transfer data. Those actions can produce observable network activity. The challenge is distinguishing the activity that matters from the enormous volume of legitimate connections in modern data centres, particularly east-west traffic between applications, databases and services.
Network Detection and Response (NDR) provides a useful perspective by examining communications and behavioural changes across the environment. An unfamiliar connection is not necessarily malicious, but when it appears alongside unexpected internal access, changes in traffic volumes or repeated outbound sessions, the combined pattern may warrant investigation. Network intelligence helps analysts understand those relationships rather than treating each signal as an isolated alert.
IntSOC Network Overview: application, protocol, host and infrastructure context.
Turning Network Activity Into Security Intelligence
Collecting network information is only the first step. Analysts need to understand which systems are communicating, how current activity compares with expected behaviour and whether several unusual signals point towards the same incident. Within IntSOC, behavioural and machine-learning detection can help identify anomalies, beaconing, unusually long-lived flows and suspicious communication patterns, giving investigators more context than a single alert can provide.
Consider a compromised application server that begins communicating with database and management systems it has not previously accessed. The new connections may seem unremarkable when viewed separately, but they become more meaningful when examined against the server’s established communication patterns and alongside unusual traffic volumes or suspicious external activity. Our AI-Powered Network Observability and NDR for Data Centres use case explores how this type of network context can support investigation.
IntSOC Graph Visualiser helps analysts explore relationships between communicating systems.
Where Agentic AI Fits Into Threat Investigation
The ARTEX case also raises a question for defenders: how can AI-assisted investigation help security teams work through evidence more efficiently? Traditional automation follows predefined steps, while machine-learning models identify patterns in data. Agentic AI can support a sequence of investigative tasks, such as gathering additional evidence, correlating related alerts and exploring possible explanations before escalating activity that requires an analyst’s judgement.
Within IntSOC, Agentic AI capabilities can support alert evaluation, prioritisation, evidence correlation, threat-intelligence gathering and hypothesis-based threat hunting. The important point is that an agent needs reliable information on which to base its investigation. Network visibility and behavioural context do not become less important when investigation is automated; they become essential to making the resulting conclusions useful and explainable.
IntSOC Agentic AI investigation interface showing the evidence and investigation workflow.
Organisations should also understand the limits of autonomy. Which tasks can an agent perform independently? What information can it access? How are its conclusions supported, and when is an analyst brought into the process? These questions are particularly important when security teams are deciding how to use Agentic AI in operational environments.
The Additional Challenge of High-Speed Data Centres
As networks operate at 100G and 400G and organisations plan for 800G, the amount of traffic that NDR platforms must process places further demands on visibility and investigation. A headline throughput figure does not by itself explain whether traffic is sampled, what network intelligence is retained or whether that information remains available under sustained load.
IntSOC combines high-speed network processing with network intelligence, behavioural detection and AI-assisted investigation. The IntSOC 400 configuration provides a specific basis for evaluating performance at 400 and 800G.
What Security Leaders Should Take From the ARTEX Findings
The ARTEX campaign does not mean every cyberattack is about to become fully autonomous. It does show that AI-assisted tooling can form part of real malicious activity, making the quality and speed of investigation an increasingly relevant concern. CISOs should consider whether their teams can identify unusual communications, reconstruct behaviour around an incident and correlate evidence without losing sight of where human oversight is required.
As offensive tools evolve, defenders will not always know which technology is behind a suspicious connection. What remains important is the ability to see what systems are doing, understand when that behaviour changes and investigate the activity in context. Effective Network Detection and Response and carefully governed AI-assisted investigation can help security teams meet that challenge.
Meet Telesoft at Cloud Expo in Amsterdam
We’ll be at Cloud Expo in Amsterdam and would welcome the opportunity to discuss how IntSOC brings together network visibility, behavioural detection and AI-assisted investigation. If you’re attending, come and speak with our team about the challenges of protecting high-speed networks against evolving threats.
Go Back
