Nine South Korean financial institutions agentic AI attack

What happened

Between late September and early October 2026, a human operator utilized the autonomous pentesting agent ARTEX to conduct unauthorized reconnaissance and breach the digital perimeters of at least nine South Korean financial institutions. CrowdStrike Intelligence identified the campaign, noting that the incident represents the first publicly attributed use of AI-powered pentesting tools in a real-world financial sector breach. The ARTEX tool, originally developed in China for legitimate security research, was repurposed by an operator to identify vulnerabilities in systems such as loan progress inquiry platforms and mobile work-support systems.

The attack was not an isolated autonomous event but a human-led orchestration using a stack of multiple large language models. The ARTEX instance utilized DeepSeek v4.1-flash as its primary backend, supplemented by Z.ai GLM-5.3 and SpaceXAI Grok 4.6, with the operator further integrating Anthropic’s Claude Code into the workflow. This configuration allowed the operator to scale reconnaissance efforts significantly. The campaign was ultimately exposed due to an operational security failure: the operator left open directories on a Hong Kong-based server, which contained configuration files, memory files, and Claude Code session histories. These logs revealed that the operator had sought advice from the AI on how to sell stolen data and locate relevant Telegram groups for illicit transactions.

The impact of the breach was substantial, with Shinhan Bank reporting that approximately 25,000 customer records—including names, phone numbers, annual income, and loan limits—were compromised. In response to the incident, the South Korean Financial Services Commission held an emergency meeting, and the government initiated a formal investigation. While attribution remains at a moderate confidence level, authorities are investigating a suspect in Guangdong province, China, who operates under the handle ‘YY520CN.’ Following the disclosure of the misuse, the developer of ARTEX, known as Autumn-27, converted the project to closed source on October 8, 2026, citing the reality of its abuse. This incident underscores how AI-driven tools, when repurposed, can serve as force multipliers for human adversaries, turning security-focused automation into a potent attack surface.