"Who still has the real ARTEX?": an AI pentest tool whose original repo was deleted, and how its English copy got 1,465 stars
What it is A GitHub copy that translated ARTEX, a Chinese developer's AI autopentest system, into English and kept maintaining it.
Why it took off The original repo was taken down 10-08, ARTEX was reported as used in real attacks on South Korea, and it made international security news. English readers who saw the news wanted a working English version, and this was the one still alive and still being updated.
DHow you could ride this Don't follow ARTEX itself. Copy its playbook: watch for open-source projects that suddenly get famous but exist only in Chinese, and within a week or two ship a clean English version that credits upstream and keeps syncing.
- Data (updated daily) · Repo created 2026-10-08 · 1,662 stars · 7 days +704
GitHub · stars Data 2026-10-19 → 2026-11-08 (21 days, 20 observations). Points before 10-28 come from deeply / archive backfill, not every day has one
BaaRai/ARTEX is an English translation of an AI autonomous pentesting tool. It took off not because it's better than the others, but because the original author deleted the repo after a bank hack in South Korea, and people around the world rushed for a copy that hadn't disappeared yet. This piece explains where the stars came from, who else is competing for them, and why you shouldn't follow this path.
The day the repo was deleted
On Oct 8, 2026, a Chinese developer going by Autumn-27 announced on GitHub that his open-source project ARTEX was going closed-source and would no longer be publicly released, citing only "abuse." A few days earlier, CrowdStrike published a report saying an unidentified attacker had used ARTEX to breach several South Korean banks, one of them through a loan-status lookup system used by loan brokers; a Reddit user relayed that the whole campaign may have been the work of a single person. On Oct 9, Reuters followed up with a headline: "Chinese developer takes ARTEX closed-source after South Korean bank hack."
The original repo, Autumn-27/ARTEX, now shows 404. On the night of the deletion, 21:14, an account called BaaRai created BaaRai/ARTEX. The account has only this one repo.
What it is
ARTEX was originally an "AI autonomous pentesting system": a Go backend, a Next.js frontend, connected to Claude or OpenAI models. Give it a target and an authorized scope, and a team of AI agents does reconnaissance, picks tools, and finds vulnerabilities on its own, so one person can monitor many targets at once. The original was positioned for learning, research, and authorized testing, released on GitHub in July, with a Chinese UI and Chinese prompts.
BaaRai's work started as translating the UI and prompts into English. The repo description is a single line: "ARTEX - AI autonomous penetration testing system (English translation)," under AGPL-3.0. But it didn't stop at translation: by November it had shipped v0.4.0, the README added approval-record details, a browser extension for traffic capture, and asset sync from ScopeSentry. Trendshift shows 10 contributors, and between 10-20 and 11-06 it merged 29 PRs. It went from a "copy" to a fork that people are actually maintaining.
How the stars grew
Look at the curve first (GitHub stars and forks, recorded daily):
| Date | stars | forks |
|---|---|---|
| 10-19 | 22 | 10 |
| 10-24 | 166 | 94 |
| 10-28 | 362 | 190 |
| 10-29 | 723 | 278 |
| 11-01 | 958 | 369 |
| 11-06 | 1465 | 563 |
In the first ten days after creation, almost nobody looked at it; 10-19 had only 22 stars. The week the original was deleted, the traffic went to other mirrors. BaaRai really took off in late October, with its biggest day on 10-29, gaining 361 stars in one day.
That timing lines up with the second wave of Western security-community coverage: CrowdStrike
Research notes: competitor table, acquisition evidence, full research report
- Competitors
Name Where Launched Scale How it differs from this one jiwoochris/artex-global Open source 2026-10-03 2757 stars / 2632 forks (#1 in the fork ecosystem) The most direct competitor. It's also a translated/globalized version (English by default plus Korean/Chinese/Spanish/Japanese), started gaining traction earlier, and has nearly double the stars. BaaRai is English-only and behind. mhtsec/ARTEX Open source 2026-10-08 Once 4405 stars / 6607 forks (the largest mirror) Removed by GitHub (now 404). Its users spilled over into the surviving repos, which actually fed BaaRai. RuoJi6/ARTEX Open source 2026-10-09 1268 stars, with a v0.4.x release line plus Docker Classified by artex.sh as a "maintained successor." It's more of a long-term successor than BaaRai, which only does translation. XBOW Big-company features 2025 A commercial product that topped the HackerOne leaderboard in 2026 A serious company and product. ARTEX is an open-source project officially labeled a weapon, with its author gone; BaaRai's pitch is a "runnable English copy of a hot potato," not more features. Cairn (oritera/Cairn) Open source 2026 Open-source agentic attack framework, 2026-10 reportedly used to attack 100+ websites Another agentic framework reported as used in real attacks, but an independent project rather than a fork of ARTEX. PentestGPT / CyberStrikeAI / PentAGI Open source 2023-2026 The open-source AI pentest project AhnLab named as a similar tool An earlier multi-stage agent pentest tool, without ARTEX's "treated as a real weapon plus deleted repo" news hook. - Where users come from
- Verified Platform incident / repo rescue (Streisand effect): The original repo Autumn-27/ARTEX was deleted 2026-10-08 (artex.sh; now 404), and the author went closed-source (Reuters 10-09). A flood of forks appeared the same week, with fork/star ratios generally above 95% (mhtsec: 150%), which points to people saving a copy before deletion rather than contributing. BaaRai was created on the day of the deletion, 10-08.
- Verified Security vendor / press coverage: Reuters, CrowdStrike (Vapor Panda, 11 days, 14 countries, 200+ organizations), Microsoft (Storm-0940), Google/Mandiant, Wiz, AhnLab, and SOCRadar all published heavily. BaaRai's 10-29 single-day +361 landed right at the peak of coverage.
- Verified Traffic settling on surviving mirrors: The original repo and the largest mirror, mhtsec/ARTEX, were both 404. People looking for the tool moved to BaaRai, which was still alive and in English. It still gained +11-05 in a single day 109.
- Inferred GitHub Trending: trending_days_any=0, best_global_rank empty, repo age 29 days, under the 60-day trending threshold. The growth did not come from on-site recommendations.
BaaRai/ARTEX: why an English mirror of a deleted Chinese "AI autonomous pentesting" tool took off
- Repo: github.com/BaaRai/ARTEX (still live as of 2026-11-06, HTTP 200)
- In one line: an English translation fork of Autumn-27's Chinese "AI autonomous pentesting system" (Go backend + Next.js frontend). After the original repo was 2026-10-08 deleted or taken closed-source, it became one of the few mirrors that survived.
- Bottom line: It didn't take off on the strength of the product. It rode a global security incident. ARTEX was used in real attacks by a China-state-linked hacking group (a South Korean bank, Japanese companies, a Microsoft 365 supply chain, what CrowdStrike calls Vapor Panda, and more), and Reuters, CrowdStrike, Microsoft, Google/Mandiant, Wiz, AhnLab, and SOCRadar all wrote about it. The original author was forced to delete the repo and go closed-source, so a wave of people forked and starred frantically to rescue a tool that could vanish at any moment. BaaRai/ARTEX happened to be the one that was "English, not yet deleted, and still being updated."
---
1. What it is, and how the timeline went
ARTEX is an LLM multi-agent autonomous pentesting framework. Give it a target and an authorized scope, and a team of AI agents does reconnaissance, picks tools, exploits, escalates privileges, and moves laterally, deciding each next step from the previous result, so one operator can run hundreds of targets in parallel. The original author is Chinese developer Autumn-27. It was released on GitHub in July 2026, positioned for "learning/research/authorized testing" (sources: SOCRadar 2026-11-05; AhnLab ASEC 2026-10-13).
Then it went wrong:
- 2026-10-08: The original repo
Autumn-27/ARTEXwas deleted (source: artex.sh/forks states explicitly "Autumn-27/ARTEX was deleted on 2026-10-08"; we verified github.com/Autumn-27/ARTEX is now 404). - 2026-10-09: Reuters ran "Chinese developer makes ARTEX AI agent closed-source after Korean bank hack"; the original author took the project closed-source after a Korean bank was hacked (source: reuters.com, 2026-10-09).
- As soon as the original vanished, dozens of forks, mirrors and translations flooded in to rescue it the same week. As of 2026-11-04, the standalone site artex.sh, which tracks this closely, lists 47 public ARTEX forks and copies, sorted into 7 types: maintained versions, translations, mirrors, archives, derivatives, attack variants and rewrites.
- BaaRai/ARTEX was created on 2026-10-08 21:14, the very day the original repo was deleted, making it one of the first rescue mirrors.
So this isn't a product growth story. It's "repo deleted → network-wide rescue → mirror scramble". BaaRai is the English version that survived the scramble and kept updating.
2. Growth data (our GitHub repo_day, daily since 2026-10-19)
BaaRai/ARTEX star curve:
| Date | stars | forks |
|---|---|---|
| 10-19 | 22 | 10 |
| 10-24 | 166 | 94 |
| 10-28 | 362 | 190 |
| 10-29 | 723 (+361 in a single day, the biggest one-day gain) | 278 |
| 11-01 | 958 | 369 |
| 11-06 | 1465 | 563 |
(Source: our GitHub repo_day, snapshot 2026-11-06)
Two key points:
- It benefited from the second wave, not the first. The first wave of mirrors (see below) hit thousands of stars during 10-09~10-17; BaaRai still had only 10-19 stars by 22. It really took off after 10-24, exploding by +361 in one day on 10-29. That timing sits right on the peak of Western security vendor and media coverage (CrowdStrike's Vapor Panda operation since 10-17, with 14 countries and 200+ organizations hit over 11 days; dense posts from SOCRadar, the Google Cloud Blog and others). English-speaking audiences flooded in at that point, and they wanted an English version.
- It never made GitHub Trending (data card trending_days_any=0, best_global_rank empty; and the repo is only 29 days old, below Trending's 60-day threshold). So growth didn't come from GitHub's in-site recommendations. It came entirely from off-site news and security-community buzz spilling over.
- Over the last 7 days +628 versus +805 over the prior 7 days (data card): growth is falling off its peak. Event heat is receding, but because both the original and the largest mirror were deleted, traffic keeps settling onto the surviving repo (still +109 on 11-05).
3. The unusually high fork/star ratio: the core of the story, not star-botting
The data card flags the fork/star ratio of 38% as "abnormal". Looking across the whole ARTEX ecosystem, BaaRai's 38% is actually on the low side:
| Mirror | stars | forks | fork/star | Status (2026-11-06) |
|---|---|---|---|---|
| mhtsec/ARTEX | 4405 | 6607 | 150% | 404 (deleted) |
| jiwoochris/artex-global | 2757 | 2632 | 95% | Alive, English/Korean/Chinese/Spanish/Japanese |
| Hinln/ARTEX | 1343 | 1872 | 139% | — |
| RuoJi6/ARTEX | 1268 | 764 | 60% | Alive, maintained version |
| BaaRai/ARTEX | 1465 | 563 | 38% | Alive |
(Source: our GitHub repo_profile / repo_day)
Forks outnumbering stars is common because people fork not to contribute code, but to save a copy before it gets deleted. That is the typical fingerprint of a deletion event, not bot activity. Supporting this: the largest mirror, mhtsec/ARTEX (4405 stars), and the original repo have both since been 404. GitHub keeps taking things down, so rescue forks are the rational move.
4. Competitors: two groups
A. Other ARTEX mirrors in the same ecosystem (competing for the same crowd)
jiwoochris/artex-global(by a Korean author, 2757 stars, #1 in the fork ecosystem): multilingual versions (English default plus Korean/Chinese/Spanish/Japanese). It started gaining traction earlier and has nearly doubled BaaRai's stars. It is BaaRai's most direct rival, with overlapping positioning (both do translation and going global).mhtsec/ARTEX(once 4405 stars, the largest mirror): deleted. Its users spilled over to surviving repos, which in fact fed BaaRai's growth.RuoJi6/ARTEX,sharenjun/ARTEX-mainandMoLeft/ARTEX: classed by artex.sh as "maintained versions/successors". They have their own version lines (v0.4.x) and Docker images, and look more like long-term successors than BaaRai, which only translates.
B. Others doing the same thing (agentic offensive frameworks)
- XBOW (commercial, xbow.com): autonomous AI pentesting, topped the HackerOne leaderboard in 2026, and is the most funded and talked-about player in the space.
- Cairn (
oritera/Cairn, open source): another agentic attack framework, reported in 2026-10 as used against 100+ company websites (sources: Google Cloud Blog "ARTEX and Friends"; Reuters). - PentestGPT (
GreyDGL/PentestGPT, open source, earlier), CyberStrikeAI, PentAGI: open-source peers named by AhnLab.
How they differ: XBOW and Cairn are "proper products/companies". ARTEX is an open-source project officially identified as a real weapon, deleted, with its author gone. BaaRai's value isn't being more capable. It's being the English, runnable, still-alive copy of this hot potato.
5. Copycats already appearing
The whole ecosystem is a copycat scene: of the 47 forks artex.sh lists, 8 are translations (BaaRai included), with a pile of mirrors, archives, derivatives and rewrites. There are also name-riding spinoffs like Ernket/CodeScan-Artex (273 stars), the defense-oriented counter project bluechips-zhao/DITING, and AntiFox-AI/antifox. Someone even built a dedicated "ARTEX field guide" site, artex.sh, to monetize and funnel this wave of traffic.
6. Takeaways, differentiation, open questions
Differentiation: BaaRai's edge comes down to one thing. On a high-heat tool that could be taken down at any moment, it holds the niche of "English + continuously updated + domain not blocked". Functionally it's almost identical to jiwoochris/artex-global (both starting as v0.3.15 translations). Its advantage is that it is still alive after the original and the largest mirror were deleted, and that it caught the second wave of Western media coverage. This differentiation is why it got going, but it's fragile: it could become the next 404 at any time, and artex-global already has twice its stars.
What others can learn:
- Riding an event beats building a product: attention generated by a global security incident (a state-level hacking group, real victims, major vendor reports) is far more powerful than any SEO or paid campaign, and it's free.
- Deletion = Streisand effect: the more something is taken down or closed off, the crazier the rescue forks get. A fork surge signals scarcity and panic.
- Language and localization are the cheapest niche: the original is in Chinese, so a clean English version can capture a large slice of the global second-wave traffic.
- Survivors get the rewards: in a crowded topic, simply lasting longer (not getting deleted, steady small updates, domain still up) is itself a competitive advantage.
Open questions: (a) how many stars are real users versus people who just "saved a copy"? Usage can't be read from stars, and the high fork ratio suggests mostly bookmarking; (b) whether BaaRai's maintainer has commercial intent or it's purely a hobby or learning project; (c) whether GitHub will take it down too. That is its biggest uncertainty.
---
Main sources
- Our GitHub repo_profile / repo_day (snapshot 2026-11-06)
- artex.sh/forks "All 47 public ARTEX forks and copies"(2026-11-04)
- SOCRadar, "ARTEX AI Pentest Tool: What Security Teams Need to Know" (2026-11-05)
- AhnLab ASEC, "The Threat of AI-Driven Autonomous Penetration Testing" (2026-10-13)
- Reuters, "Chinese developer makes ARTEX AI agent closed-source after Korean bank hack" (2026-10-09)
- Google Cloud / Mandiant Blog, "ARTEX and Friends: Enter Agentic Offensive Frameworks"
- Live GitHub check: Autumn-27/ARTEX 404, mhtsec/ARTEX 404, BaaRai/ARTEX 200 (2026-11-06)