# "Who still has the real ARTEX?": an AI pentest tool whose original repo was deleted, and how its English copy got 1,465 stars · GitHub open-source project

> Source: https://stringers.io/en/github/gh_BaaRai__ARTEX.html (Stringers / 什么值得做, generated 2026-11-08)
> Stringers answers one question every day: what small product can one or two people build in a few months and actually make money from. Numbers come from 15 databases we collect daily, each with source and date.
> For agents: these verdicts and the underlying databases (verified revenue, App Store / Google Play charts, ad libraries, GitHub, Product Hunt…) are queryable live over MCP — tools today / hot / products / directions / direction / data. Setup: https://github.com/komako-workshop/stringers (the user logs in at stringers.io → "配置 agent" to get a personal URL). Site index: https://stringers.io/llms.txt

> The original repo was 10-08 deleted. ARTEX was exposed as used in real attacks in Korea and made international security news. English readers who finished the news and wanted a working English version found the one that is still alive and still updating.

[GitHub open-source project](https://stringers.io/en/github/index.md) · written 11-6

BaaRai/ARTEX · BaaRai

# "Who still has the real ARTEX?": an AI pentest tool whose original repo was deleted, and how its English copy got 1,465 stars

**What it is** A GitHub copy that translated ARTEX, a Chinese developer's AI autopentest system, into English and kept maintaining it.

**Why it took off** The original repo was taken down 10-08, ARTEX was reported as used in real attacks on South Korea, and it made international security news. English readers who saw the news wanted a working English version, and this was the one still alive and still being updated.

**D** **How you could ride this** Don't follow ARTEX itself. Copy its playbook: watch for open-source projects that suddenly get famous but exist only in Chinese, and within a week or two ship a clean English version that credits upstream and keeps syncing.

Grade D: the window has closed, there are 47 copies, repos keep getting deleted, and it's a tool used in real attacks, so its stars can vanish with the repo at any time. What's worth copying is only the general play of "ship the English version first." Public / widely discussed

Data (updated daily) · Repo created 2026-10-08 · 1,662 stars · 7 days +704

GitHub · stars

Data 2026-10-19 → 2026-11-08 (21 days, 20 observations). Points before 10-28 come from deeply / archive backfill, not every day has one

BaaRai/ARTEX is an English translation of an AI autonomous pentesting tool. It took off not because it's better than the others, but because the original author deleted the repo after a bank hack in South Korea, and people around the world rushed for a copy that hadn't disappeared yet. This piece explains where the stars came from, who else is competing for them, and why you shouldn't follow this path.

### The day the repo was deleted

On Oct 8, 2026, a Chinese developer going by Autumn-27 announced on GitHub that his open-source project ARTEX was going closed-source and would no longer be publicly released, citing only "abuse." A few days earlier, CrowdStrike published a report saying an unidentified attacker had used ARTEX to breach several South Korean banks, one of them through a loan-status lookup system used by loan brokers; a Reddit user relayed that the whole campaign may have been the work of a single person. On Oct 9, Reuters followed up with a headline: "Chinese developer takes ARTEX closed-source after South Korean bank hack."

The original repo, Autumn-27/ARTEX, now shows 404. On the night of the deletion, 21:14, an account called BaaRai created BaaRai/ARTEX. The account has only this one repo.

### What it is

ARTEX was originally an "AI autonomous pentesting system": a Go backend, a Next.js frontend, connected to Claude or OpenAI models. Give it a target and an authorized scope, and a team of AI agents does reconnaissance, picks tools, and finds vulnerabilities on its own, so one person can monitor many targets at once. The original was positioned for learning, research, and authorized testing, released on GitHub in July, with a Chinese UI and Chinese prompts.

BaaRai's work started as translating the UI and prompts into English. The repo description is a single line: "ARTEX - AI autonomous penetration testing system (English translation)," under AGPL-3.0. But it didn't stop at translation: by November it had shipped v0.4.0, the README added approval-record details, a browser extension for traffic capture, and asset sync from ScopeSentry. Trendshift shows 10 contributors, and between 10-20 and 11-06 it merged 29 PRs. It went from a "copy" to a fork that people are actually maintaining.

### How the stars grew

Look at the curve first (GitHub stars and forks, recorded daily):

| Date | stars | forks |
|---|---|---|
| 10-19 | 22 | 10 |
| 10-24 | 166 | 94 |
| 10-28 | 362 | 190 |
| 10-29 | 723 | 278 |
| 11-01 | 958 | 369 |
| 11-06 | 1465 | 563 |

In the first ten days after creation, almost nobody looked at it; 10-19 had only 22 stars. The week the original was deleted, the traffic went to other mirrors. BaaRai really took off in late October, with its biggest day on 10-29, gaining 361 stars in one day.

That timing lines up with the second wave of Western security-community coverage: CrowdStrike

[GitHub repo ↗](https://github.com/BaaRai/ARTEX)

**Research notes: competitor table, acquisition evidence, full research report**

Competitors

| Name | Where | Launched | Scale | How it differs from this one |
|---|---|---|---|---|
| jiwoochris/artex-global | Open source | 2026-10-03 | 2757 stars / 2632 forks (#1 in the fork ecosystem) | The most direct competitor. It's also a translated/globalized version (English by default plus Korean/Chinese/Spanish/Japanese), started gaining traction earlier, and has nearly double the stars. BaaRai is English-only and behind. |
| mhtsec/ARTEX | Open source | 2026-10-08 | Once 4405 stars / 6607 forks (the largest mirror) | Removed by GitHub (now 404). Its users spilled over into the surviving repos, which actually fed BaaRai. |
| RuoJi6/ARTEX | Open source | 2026-10-09 | 1268 stars, with a v0.4.x release line plus Docker | Classified by artex.sh as a "maintained successor." It's more of a long-term successor than BaaRai, which only does translation. |
| XBOW | Big-company features | 2025 | A commercial product that topped the HackerOne leaderboard in 2026 | A serious company and product. ARTEX is an open-source project officially labeled a weapon, with its author gone; BaaRai's pitch is a "runnable English copy of a hot potato," not more features. |
| Cairn (oritera/Cairn) | Open source | 2026 | Open-source agentic attack framework, 2026-10 reportedly used to attack 100+ websites | Another agentic framework reported as used in real attacks, but an independent project rather than a fork of ARTEX. |
| PentestGPT / CyberStrikeAI / PentAGI | Open source | 2023-2026 | The open-source AI pentest project AhnLab named as a similar tool | An earlier multi-stage agent pentest tool, without ARTEX's "treated as a real weapon plus deleted repo" news hook. |

Where users come from

- **Verified** **Platform incident / repo rescue (Streisand effect)** : The original repo Autumn-27/ARTEX was deleted 2026-10-08 (artex.sh; now 404), and the author went closed-source (Reuters 10-09). A flood of forks appeared the same week, with fork/star ratios generally above 95% (mhtsec: 150%), which points to people saving a copy before deletion rather than contributing. BaaRai was created on the day of the deletion, 10-08.

- **Verified** **Security vendor / press coverage** : Reuters, CrowdStrike (Vapor Panda, 11 days, 14 countries, 200+ organizations), Microsoft (Storm-0940), Google/Mandiant, Wiz, AhnLab, and SOCRadar all published heavily. BaaRai's 10-29 single-day +361 landed right at the peak of coverage.

- **Verified** **Traffic settling on surviving mirrors** : The original repo and the largest mirror, mhtsec/ARTEX, were both 404. People looking for the tool moved to BaaRai, which was still alive and in English. It still gained +11-05 in a single day 109.

- Inferred **GitHub Trending** : trending_days_any=0, best_global_rank empty, repo age 29 days, under the 60-day trending threshold. The growth did not come from on-site recommendations.

## BaaRai/ARTEX: why an English mirror of a deleted Chinese "AI autonomous pentesting" tool took off

- Repo: [github.com/BaaRai/ARTEX](https://github.com/BaaRai/ARTEX) (still live as of 2026-11-06, HTTP 200)

- In one line: an **English translation fork** of Autumn-27's Chinese "AI autonomous pentesting system" (Go backend + Next.js frontend). After the original repo was 2026-10-08 deleted or taken closed-source, it became one of the few mirrors that survived.

- Bottom line: **It didn't take off on the strength of the product. It rode a global security incident** . ARTEX was used in real attacks by a China-state-linked hacking group (a South Korean bank, Japanese companies, a Microsoft 365 supply chain, what CrowdStrike calls Vapor Panda, and more), and Reuters, CrowdStrike, Microsoft, Google/Mandiant, Wiz, AhnLab, and SOCRadar all wrote about it. The original author was forced to delete the repo and go closed-source, so a wave of people forked and starred frantically to **rescue a tool that could vanish at any moment** . BaaRai/ARTEX happened to be the one that was "English, not yet deleted, and still being updated."

---

### 1. What it is, and how the timeline went

ARTEX is an LLM multi-agent autonomous pentesting framework. Give it a target and an authorized scope, and a team of AI agents does reconnaissance, picks tools, exploits, escalates privileges, and moves laterally, deciding each next step from the previous result, so one operator can run hundreds of targets in parallel. The original author is Chinese developer **Autumn-27** . It was released on GitHub in July 2026, positioned for "learning/research/authorized testing" (sources: SOCRadar 2026-11-05; AhnLab ASEC 2026-10-13).

Then it went wrong:

- **2026-10-08** : The original repo `Autumn-27/ARTEX` was deleted (source: artex.sh/forks states explicitly "Autumn-27/ARTEX was deleted on 2026-10-08"; we verified [github.com/Autumn-27/ARTEX](https://github.com/Autumn-27/ARTEX) is now 404).

- **2026-10-09** : Reuters ran "Chinese developer makes ARTEX AI agent closed-source after Korean bank hack"; the original author took the project closed-source after a Korean bank was hacked (source: reuters.com, 2026-10-09).

- As soon as the original vanished, **dozens of forks, mirrors and translations flooded in to rescue it** the same week. As of 2026-11-04, the standalone site **artex.sh** , which tracks this closely, lists 47 public ARTEX forks and copies, sorted into 7 types: maintained versions, translations, mirrors, archives, derivatives, attack variants and rewrites.

- **BaaRai/ARTEX was created on 2026-10-08 21:14** , the very day the original repo was deleted, making it one of the first rescue mirrors.

So this isn't a product growth story. It's **"repo deleted → network-wide rescue → mirror scramble"** . BaaRai is the English version that survived the scramble and kept updating.

### 2. Growth data (our GitHub repo_day, daily since 2026-10-19)

BaaRai/ARTEX star curve:

| Date | stars | forks |
|---|---|---|
| 10-19 | 22 | 10 |
| 10-24 | 166 | 94 |
| 10-28 | 362 | 190 |
| **10-29** | **723 (+361 in a single day, the biggest one-day gain)** | 278 |
| 11-01 | 958 | 369 |
| 11-06 | 1465 | 563 |

(Source: our GitHub repo_day, snapshot 2026-11-06)

Two key points:

1. **It benefited from the second wave, not the first.** The first wave of mirrors (see below) hit thousands of stars during 10-09~10-17; BaaRai still had only 10-19 stars by 22. **It really took off after 10-24, exploding by +361 in one day on 10-29.** That timing sits right on the peak of Western security vendor and media coverage (CrowdStrike's Vapor Panda operation since 10-17, with 14 countries and 200+ organizations hit over 11 days; dense posts from SOCRadar, the Google Cloud Blog and others). **English-speaking audiences flooded in at that point, and they wanted an English version.**

2. **It never made GitHub Trending** (data card trending_days_any=0, best_global_rank empty; and the repo is only 29 days old, below Trending's 60-day threshold). So growth **didn't come from GitHub's in-site recommendations** . It came entirely from **off-site news and security-community buzz** spilling over.

3. Over the last 7 days +628 versus +805 over the prior 7 days (data card): growth is falling off its peak. Event heat is receding, but because both the original and the largest mirror were deleted, traffic keeps settling onto the surviving repo (still +109 on 11-05).

### 3. The unusually high fork/star ratio: the core of the story, not star-botting

The data card flags the fork/star ratio of 38% as "abnormal". Looking across the whole ARTEX ecosystem, BaaRai's 38% is actually **on the low side** :

| Mirror | stars | forks | fork/star | Status (2026-11-06) |
|---|---|---|---|---|
| mhtsec/ARTEX | 4405 | 6607 | **150%** | **404 (deleted)** |
| jiwoochris/artex-global | 2757 | 2632 | 95% | Alive, English/Korean/Chinese/Spanish/Japanese |
| Hinln/ARTEX | 1343 | 1872 | 139% | — |
| RuoJi6/ARTEX | 1268 | 764 | 60% | Alive, maintained version |
| **BaaRai/ARTEX** | **1465** | **563** | **38%** | **Alive** |

(Source: our GitHub repo_profile / repo_day)

Forks outnumbering stars is common because **people fork not to contribute code, but to save a copy before it gets deleted** . That is the typical fingerprint of a deletion event, not bot activity. Supporting this: the largest mirror, mhtsec/ARTEX (4405 stars), and the original repo have both since been 404. GitHub keeps taking things down, so rescue forks are the rational move.

### 4. Competitors: two groups

**A. Other ARTEX mirrors in the same ecosystem (competing for the same crowd)**

- `jiwoochris/artex-global` (by a Korean author, 2757 stars, #1 in the fork ecosystem): multilingual versions (English default plus Korean/Chinese/Spanish/Japanese). It started gaining traction earlier and has nearly doubled BaaRai's stars. It is BaaRai's most direct rival, with overlapping positioning (both do translation and going global).

- `mhtsec/ARTEX` (once 4405 stars, the largest mirror): deleted. Its users spilled over to surviving repos, which in fact **fed BaaRai's growth** .

- `RuoJi6/ARTEX`, `sharenjun/ARTEX-main` and `MoLeft/ARTEX`: classed by artex.sh as "maintained versions/successors". They have their own version lines (v0.4.x) and Docker images, and look more like long-term successors than BaaRai, which only translates.

**B. Others doing the same thing (agentic offensive frameworks)**

- **XBOW** (commercial, xbow.com): autonomous AI pentesting, topped the HackerOne leaderboard in 2026, and is the most funded and talked-about player in the space.

- **Cairn** (`oritera/Cairn`, open source): another agentic attack framework, reported in 2026-10 as used against 100+ company websites (sources: Google Cloud Blog "ARTEX and Friends"; Reuters).

- **PentestGPT** (`GreyDGL/PentestGPT`, open source, earlier), **CyberStrikeAI** , **PentAGI** : open-source peers named by AhnLab.

**How they differ** : XBOW and Cairn are "proper products/companies". ARTEX is **an open-source project officially identified as a real weapon, deleted, with its author gone** . BaaRai's value isn't being more capable. It's being **the English, runnable, still-alive copy** of this hot potato.

### 5. Copycats already appearing

The whole ecosystem is a copycat scene: of the 47 forks artex.sh lists, 8 are translations (BaaRai included), with a pile of mirrors, archives, derivatives and rewrites. There are also name-riding spinoffs like `Ernket/CodeScan-Artex` (273 stars), the defense-oriented counter project `bluechips-zhao/DITING`, and `AntiFox-AI/antifox`. Someone even built a dedicated "ARTEX field guide" site, artex.sh, to monetize and funnel this wave of traffic.

### 6. Takeaways, differentiation, open questions

**Differentiation** : BaaRai's edge comes down to one thing. **On a high-heat tool that could be taken down at any moment, it holds the niche of "English + continuously updated + domain not blocked".** Functionally it's almost identical to jiwoochris/artex-global (both starting as v0.3.15 translations). Its advantage is that **it is still alive after the original and the largest mirror were deleted** , and that **it caught the second wave of Western media coverage** . This differentiation **is why it got going** , but it's fragile: it could become the next 404 at any time, and artex-global already has twice its stars.

**What others can learn** :

1. **Riding an event beats building a product** : attention generated by a global security incident (a state-level hacking group, real victims, major vendor reports) is far more powerful than any SEO or paid campaign, and it's free.

2. **Deletion = Streisand effect** : the more something is taken down or closed off, the crazier the rescue forks get. A fork surge signals scarcity and panic.

3. **Language and localization are the cheapest niche** : the original is in Chinese, so a clean English version can capture a large slice of the global second-wave traffic.

4. **Survivors get the rewards** : in a crowded topic, simply lasting longer (not getting deleted, steady small updates, domain still up) is itself a competitive advantage.

**Open questions** : (a) how many stars are real users versus people who just "saved a copy"? Usage can't be read from stars, and the high fork ratio suggests mostly bookmarking; (b) whether BaaRai's maintainer has commercial intent or it's purely a hobby or learning project; (c) whether GitHub will take it down too. That is its biggest uncertainty.

---

#### Main sources

- Our GitHub repo_profile / repo_day (snapshot 2026-11-06)

- artex.sh/forks "All 47 public ARTEX forks and copies"(2026-11-04)

- SOCRadar, "ARTEX AI Pentest Tool: What Security Teams Need to Know" (2026-11-05)

- AhnLab ASEC, "The Threat of AI-Driven Autonomous Penetration Testing" (2026-10-13)

- Reuters, "Chinese developer makes ARTEX AI agent closed-source after Korean bank hack" (2026-10-09)

- Google Cloud / Mandiant Blog, "ARTEX and Friends: Enter Agentic Offensive Frameworks"

- Live GitHub check: Autumn-27/ARTEX 404, mhtsec/ARTEX 404, BaaRai/ARTEX 200 (2026-11-06)

This article was written by AI from public data and the data we collect daily. Numbers are sourced, and inferences are labeled.