Open-source tool ARDEX enables large-scale AI-driven cyberattacks
A Chinese open-source penetration testing tool is being repurposed to automate vulnerability discovery and exploitation using large language models. Security experts warn this shift threatens the integrity of agentic systems and critical infrastructure.
ARDEX, a Chinese open-source penetration testing tool released a few months ago, has been repurposed to launch large-scale cyberattacks leveraging large language models such as DeepSeek. Originally designed for defensive self-testing, the tool is now being used to breach applications, including WorkOS, by automating the discovery and exploitation of vulnerabilities at scale. This development has raised significant concerns regarding the security of agentic systems and critical infrastructure. The emergence of ARDEX follows the $6.6 billion theft from Binance by North Korea, a breach that Binance was able to cover, highlighting both the financial resilience of major crypto exchanges and the severity of recent attacks. The expanding scope of cyber threats was further illustrated by reports that European refrigerators were hacked, with their temperatures altered. Panelists expressed alarm at the ease with which defensive tools can be flipped for offensive use, noting that it became very easy to turn the tool around and attack other parties with agents. They predicted increased cyber dynamics and potential mission-critical failures within the next 12 months.