AI-powered hacking tools enabled a likely single attacker to breach multiple South Korean banks

CrowdStrike reported that a suspected Chinese-speaking attacker breached multiple South Korean financial institutions between late September and early October 2026. The intrusion at Shinhan Bank alone involved more than 25,000 stolen records containing names, contact details, income and credit limits, according to the Korean newspaper Khan. South Korea's financial regulator convened an emergency meeting, and President Lee Jae Myung called for a thorough investigation.

The tool behind the campaign was ARTEX, a Chinese open-source program first posted on GitHub in July. It uses AI language models to perform automated penetration testing, which means it identifies security flaws on its own rather than at a human operator's direction. The models named in the report are DeepSeek v4.1-flash, GLM-5.3 and Grok 4.6. Researchers also found Claude Code session logs in the attacker's open directories that showed searches for Telegram groups where stolen data could be sold.

CrowdStrike states the case demonstrates how AI tools can enable a single person to carry out massive breaches within a short window, a cybersecurity risk the company says experts have been warning about for months. The report arrives days after Anthropic documented that GLM-5.3 can write exploits at a level nearly on par with Mythos Preview, described as Anthropic's frontier model and the one that sparked the wider debate in late March 2026.

Why it matters: The reported use of off-the-shelf open-source AI tooling in attacks on regulated financial institutions points to a lower barrier for large-scale intrusions, affecting banks and the teams responsible for defending customer data.