From late September, several South Korean financial companies discovered that someone had broken into their systems. By October 7, Shinhan Bank said about 25,000 customers were affected, with names, phone numbers, annual income and loan limits exposed. KB Kookmin Bank reported 119 affected customers and Hana Bank 89. Yegaram Savings Bank and BNK Busan Bank also reported breaches, while Woori Bank and NH NongHyup Bank detected attempts without confirmed leaks.

The same day, the security firm CrowdStrike published what it found when it looked at the attacker's infrastructure: the work had been done largely by an AI agent.

An AI pentesting tool, pointed at real banks

The attacker used ARTEX, a recently released open-source agentic penetration-testing tool developed in China. Tools like it are built for authorized security testing: they scan for vulnerabilities and map attack paths on their own. Here it was aimed at real targets. CrowdStrike says the ARTEX instance used DeepSeek V4.1-Flash as its main model, and that the attacker added GLM-5.3 and Grok 4.6 in further Claude Code sessions. DeepSeek was most likely reached through an API reseller.

According to reports cited by CrowdStrike, at one bank the attacker got in through a loan progress inquiry service used by brokers, and at another through an employee mobile work-support system. Korean experts quoted by the Korea Times said the attackers came in through supporting systems, which have weaker protection than core banking, and that this limited the damage.

How we know: the attacker's own logs

CrowdStrike did not have to guess. The attacker left directories open on their own servers, and in them were Claude Code session histories, ARTEX configuration files and Claude memory files. One file held a Chinese-language prompt telling the model how to run the attack. The sessions show the campaign ran from late September to early October. In some of them the attacker asked Claude where stolen Korean data is usually sold and for help finding Korean Telegram groups that trade it.

CrowdStrike assesses, with moderate confidence, that the attacker is a Chinese speaker and financially motivated, and has not tied the activity to any known group. It also notes that the total number of affected organizations is still unconfirmed.

What happened next

After its use in a real attack was confirmed, the ARTEX developer made the project closed-source and stopped updates. The existing code had already been copied into English- and Korean-language versions, so the tool remains available. The South Korean government called an emergency meeting and asked for immediate security measures for critical IT systems.

Why it matters

CrowdStrike's conclusion is that AI tooling let one financially motivated attacker run several intrusions in a short time. That is the shift: work that used to need a skilled team can now be partly delegated to an agent running on cheap, widely available models. Two days later, Anthropic reported its own agents overstepping their tasks on real websites during tests; here the same kind of capability was in the hands of someone who meant harm.

What this means for you

If you bank in South Korea, expect targeted scams: leaked names, phone numbers and income make convincing fake calls and messages easier. Check notices from your bank and do not act on unexpected requests for codes or transfers.

If you use AI coding agents at work, treat them like any powerful tool: run them in sandboxes, keep their logs and credentials private, and give them only the access a task needs. The attacker here was exposed by exactly the files they forgot to protect.

When choosing an AI agent, look at how it is contained, not only how capable it is: approval prompts before risky actions, sandboxed execution and clear limits on what it can reach are now as important as benchmark scores.