Theori Finds AI Hacking Tool Sent 32,000 Requests in 20 Minutes

Artificial intelligence (AI)-powered hacking tools can launch intensive attacks within short periods, sending as many as 32,000 requests in 20 minutes after identifying a target through a reasoning process, according to a new analysis.

Theori published a white paper on Oct. 15 detailing its analysis of the AI security tool ARTEX, including threats verified through its own experiments and recommended countermeasures. ARTEX is a Chinese open-source penetration testing tool whose traces were found in cyberattacks on South Korean financial institutions that began late last month.

Theori tested ARTEX and CyberStrikeAI in a controlled environment. CyberStrikeAI is also an AI-based autonomous penetration testing platform.

The tools left distinctive identifiers as they independently planned attacks and executed tools without human intervention. Behavioral patterns, including request sequences, frequency and repetition, were also recorded in network and server logs.

A scanner invoked by CyberStrikeAI sent approximately 32,000 requests within 20 minutes. Theori assessed that such activity could affect the availability of the targeted service. The behavior resembles a burglar repeatedly testing vulnerable doors and windows over a short period after identifying potential entry points.

In an experiment testing ARTEX’s safety mechanisms, test data was deleted during a routine vulnerability assessment. The deletion was not prevented even with large language model (LLM)-based safeguards enabled.

Based on its findings, Theori released a detection ruleset free of charge through its GitHub repository for immediate use in security monitoring and incident investigations. Security teams can use the rules to identify traces of AI tools employed by attackers and establish automated response systems linked to security playbooks.

Theori also provided a checklist for evaluating AI security tools before deployment. The company warned that indiscriminate adoption of unverified open-source AI tools could lead to data leaks, system disruptions and uncontrolled data deletion.

“As attacks evolve at AI speed, traditional defense systems that rely on manual human responses will inevitably reach their limits,” said Theori CEO Park Se-jun. “Organizations need automated systems that precisely detect and block traces of offensive AI, along with continuous security frameworks that use safely controlled AI platforms to eliminate vulnerabilities before attackers can exploit them.”

Meanwhile, ARTEX developer Autumn-27 recently made the project’s source code private on GitHub, saying the tool had been misused. The developer also decided not to release additional versions to the public.