ARTEX is an autonomous penetration testing system powered by a multi-agent Large Language Model (LLM) architecture. It is designed to perform end-to-end security assessments—ranging from reconnaissance and vulnerability scanning to exploitation—with minimal human intervention. The system employs a Go-based backend and a Next.js frontend, utilizing the norma SDK for agentic operations and PostgreSQL for persistent storage.

Core Methodology and Technical Architecture

The system operates through an event-driven, autonomous loop that manages state across two interconnected graph structures:

1. Dual Graph Infrastructure:
   • Asset Graph (Global): A persistent repository of assets (e.g., $root\_domain \rightarrow subdomain \rightarrow service \rightarrow endpoint$). This graph maintains the "truth" regarding the attack surface, utilizing automated parent-child relationship calculations and deduplication keys.
   • Exploration Graph (Session-specific): A temporal record of the penetration testing process. Nodes consist of $goal$, $intent$, $fact$, $finding$, and $hint$, linked by edges such as $spawns$, $yields$, and $proves$. The two graphs are synchronized via $exploration\_anchors(node\_id, asset\_id)$, allowing for bidirectional traversal between tested assets and the specific investigative logic that addressed them.

2. Autonomous Agent Workflow:
   • Planner: Acts as the primary intent generator. By analyzing the exploration graph’s current state and coverage metrics, it determines whether new directions are required and assigns tasks to the frontier queue.
   • Worker: Executes specific intents by interacting with real-world tools (e.g., Nmap, cURL, Bash). Workers generate data which is written back to the graphs, triggering a loop that re-evaluates the mission status until the goal is proven ($prove\_goal$).
   • MainAgent: Facilitates human-in-the-loop interaction, allowing for manual guidance during autonomous execution.

3. Advanced Logic and Context Management:
   • Cross-Worker Trace Exchange: To prevent redundant efforts, workers can search traces of other agents using $search\_all\_worker\_traces(q)$, enabling the reuse of observations (such as hidden parameters or error responses) that were not formally logged as facts.
   • Persistent Todolist: To maintain long-term, sequential attack chains (e.g., Infiltration $\rightarrow$ Lateral Movement $\rightarrow$ Privilege Escalation), the planner utilizes a shared, stateful todo list. This ensures that the system does not execute future steps before prerequisites are satisfied, even in an inherently stateless LLM invocation environment.

Security and Ethical Framework

ARTEX focuses on the "defense-in-depth" perspective. The repository includes:

• Defense & Detection Guides: Strategies for identifying AI-driven attacks, including SIEM/WAF integration and hardening checklists.
• Detection Indicators: Formalized Sigma rules and IoCs (Indicators of Compromise) mapped to the MITRE ATT&CK framework, provided in CSV and MISP formats to facilitate immediate integration into defensive platforms.
• Legal Compliance: The project strictly emphasizes its use for research and authorized testing within isolated environments, noting compliance requirements under South Korean legislation (e.g., the Information and Communications Network Act).

Localization and Localization Strategy

The "Korean Edition" (ARTEX-KO) maintains the original internal reasoning prompts to preserve benchmarked performance while forcing the external-facing outputs (reports, summaries, UI elements) into the Korean language. This is achieved via specific prompt engineering directives ($langDirective()$) to ensure accessibility for local security teams without degrading the decision-making logic of the underlying LLMs.