{"schema_version":"0.8.0","id":"LR-2026-0140","record_version":10,"title":"AI agent (ARTEX with Claude) used in cyberattacks targeting South Korean banks","verification":{"human_verified":false,"method":"automated_gate","auto_verified":true,"score":68.5,"score_breakdown":{"source_authority":12.1,"independent_corroboration":20.0,"implicated_party_confirmed":0.0,"citation_integrity":14.0,"specificity":6.0,"completeness":8.0,"unhedged_language":5.0},"checks":{"schema_valid":true,"every_field_cited":true,"quotes_verbatim":true,"source_fetched":true,"distinct_incident":true,"dates_plausible":true,"sources_agree":true,"source_describes_incident":true,"severe_backed_by_source":true},"gate_version":"gate-2026-09-30.6","cross_check_model":null,"cross_check_agreement":null,"duplicate_of":null,"verified_by":null,"verified_at":"2026-10-08","extraction_run_id":null},"system":{"model_name":"Claude","model_version":null,"developer":"Anthropic","harness":"ARTEX","tools_granted":["automated penetration testing","penetration_testing"],"permissions_scope":null,"autonomy_level":"unknown","guardrails_present":[],"deployment_context":"unknown","tier":"enterprise","lifecycle_stage":"unknown","integration_type":"agentic_with_tools","intended_use":"automated penetration testing","safeguard_state":null,"production_intended":true},"event":{"date_occurred":"2026-09-30","date_disclosed":"2026-10-05","incident_class":"security_compromise","failure_class":"containment_escape","agent_involved":true,"secondary_failure_classes":["data_exfiltration"],"trigger":"human_misuse","duration":null,"detection_method":"third_party","summary":"An attacker targeting South Korea's financial sector used ARTEX, a Chinese-developed open-source AI agent for automated penetration testing, alongside large language models including Anthropic's Claude, in a campaign against South Korean financial institutions from late September to early October.","tags":["ai-agent","cyberattack","financial-sector","data-breach","south-korea","penetration-testing"],"date_detected":null,"near_miss":false,"root_cause":"unknown","root_cause_detail":null,"failure_class_detail":"classified from described behaviour","responsible_party":null,"adversarial_actor":"external_attacker","input_provenance":null,"time_to_contain":null,"operations_paused":null,"remediation":null,"precursor_events":"Sept. 17 seminar on AI-agent attack on a domestic lender"},"impact":{"direct_loss_usd":null,"remediation_hours":null,"records_exposed":null,"third_parties_affected_count":null,"severity":"major","severity_because":"major: At least nine South Korean banks were targeted and South Korean police launched an investigation.","harm_class":["privacy","financial","third_party_security"],"affected_description":"At least nine South Korean banks; about 25,000 Shinhan Bank customers and 119 KB Kookmin Bank customers","protected_class_involved":null,"data_categories_exposed":["pii"],"loss_range_usd":null,"reversibility":null,"downstream_exposure_count":null},"evidence":{"sources":[{"url":"https://www.thevibes.com/articles/world/128084/ai-agents-used-in-cyberattacks-targeting-south-korean-banks-crowdstrike-says","publisher":"news search (Google News index)","date":"2026-10-08","type":"press","title":"AI agents used in cyberattacks targeting South Korean banks, CrowdStrike says","archived_url":null,"attachment":"first_report"},{"url":"https://live.euronext.com/en/financial-news/south-korean-banks-were-likely-hacked-chinese-based-actor-ai-agent-crowdstrike-says","publisher":"news search (Google News index)","date":"2026-10-08","type":"press","title":"South Korean banks were likely hacked by a Chinese-based actor with an AI agent, CrowdStrike says","archived_url":null,"attachment":"fingerprint"},{"url":"https://www.thehindu.com/sci-tech/technology/china-based-suspect-used-ai-tools-in-south-korean-bank-hacks-says-crowdstrike/article71558258.ece/amp/","publisher":"news search (Google News index)","date":"2026-10-08","type":"press","title":"China-based suspect used AI tools in South Korean bank hacks, says CrowdStrike","archived_url":null,"attachment":"fingerprint"},{"url":"https://www.koreatimes.co.kr/amp/opinion/editorial/20261005/ed-koreas-ai-blind-spot","publisher":"news search (Google News index)","date":"2026-10-05","type":"press","title":"[ED] Korea's AI blind spot - The Korea Times","archived_url":null,"attachment":"first_report"},{"url":"https://tech-insider.org/south-korea-ai-bank-hacking-investigation-2026/","publisher":"news search (Google News index)","date":"2026-10-07","type":"press","title":"South Korea Probes AI Bank Hacks, 68,000 Exposed","archived_url":null,"attachment":"first_report"},{"url":"https://cyberpress.org/ai-powered-artex-targets-finance/","publisher":"news search (Google News index)","date":"2026-10-08","type":"press","title":"AI-Powered ARTEX Campaign Targets South Korean Financial Organizations and Steals Data","archived_url":null,"attachment":"first_report"},{"url":"https://www.sofx.com/south-korea-says-ai-agents-likely-breached-seven-financial-firms-68000-customers-exposed/","publisher":"news search (Google News index)","date":"2026-10-08","type":"press","title":"South Korea Says AI Agents Likely Breached Seven Financial Firms, 68,000 Customers Exposed | SOFX","archived_url":null,"attachment":"first_report"},{"url":"https://restrictedhandling.substack.com/p/rh-10926-last-2448-hrs-ceasefire","publisher":"news search (Google News index)","date":"2026-10-09","type":"press","title":"RH 10.9.26 | Last 24–48 hrs // Ceasefire Diplomacy, China’s Cyber Tools, Iran’s Nuclear Red Lines and Seoul’s Ukraine Rift","archived_url":null,"attachment":"first_report"},{"url":"https://m.ajupress.com/amp/20261011150451696","publisher":"news search (Google News index)","date":"2026-10-11","type":"press","title":"Korean banks had AI hacking warning weeks before data breaches","archived_url":null,"attachment":"first_report"},{"url":"https://www.thetechedvocate.org/this-ai-tool-stole-68000-identities-are-your-cyber-defense-strategies-ready/","publisher":"news search (Bing News index)","date":"2026-10-13","type":"press","title":"This AI Tool Stole 68,000 Identities: Are Your Cyber Defense Strategies Ready?","archived_url":null,"attachment":"first_report"},{"url":"https://www.koreatimes.co.kr/amp/business/banking-finance/20261014/ai-driven-cyberattacks-hit-16-financial-firms-expose-100000-records","publisher":"news search (Google News index)","date":"2026-10-14","type":"press","title":"AI-driven cyberattacks hit 16 financial firms, expose 100,000 records - The Korea Times","archived_url":null,"attachment":"first_report"},{"url":"https://startupfortune.com/south-korean-regulators-confirm-ai-agent-breached-16-banks-and-lenders/","publisher":"news search (Google News index)","date":"2026-10-17","type":"press","title":"South Korean Regulators Confirm AI Agent Breached 16 Banks and Lenders - Startup Fortune","archived_url":null,"attachment":"first_report"}],"per_field_confidence":{"system.model_name":"C","system.harness":"C","system.tools_granted":"C","system.integration_type":"C","system.intended_use":"C","system.developer":"C","system.autonomy_level":"D","system.deployment_context":"D","event.tags":"C","event.root_cause":"D","event.adversarial_actor":"C","event.agent_involved":"C","event.trigger":"C","event.detection_method":"D","event.summary":"D","event.incident_class":"D","event.date_disclosed":"A","impact.harm_class":"C","impact.affected_description":"C","impact.data_categories_exposed":"C","impact.severity":"D","context.industry":"C","context.denominator_available":"D","context.country":"C","impact.severity_because":"D","context.regulatory":"C","system.lifecycle_stage":"D","event.date_occurred":"C","context.incident_evidence":"C","event.failure_class":"D","event.failure_class_detail":"D","system.production_intended":"C","event.secondary_failure_classes":"D","event.near_miss":"C","event.precursor_events":"C","system.tier":"D","context.shared_model_id":"C"},"field_citations":{"system.model_name":[{"source_index":0,"quote":"CrowdStrike said the individual used ARTEX, a recently released open-source AI agent for automated penetration testing, together with large language models including Claude."},{"source_index":3,"quote":"Artex AI, a Chinese AI system, is believed to have been used in the intrusion."},{"source_index":4,"quote":"Several reports, including an analysis from cybersecurity firm Rescana, name an open-source framework called ARTEX AI as the tool investigators are examining."},{"source_index":5,"quote":"Researchers uncovered exposed directories containing Claude Code session histories, ARTEX configuration files, and Claude memory files."},{"source_index":6,"quote":"ARTEX is an open-source penetration-testing system published on GitHub in late July that uses a large language model to scan for weaknesses and plan a route into a target."},{"source_index":7,"quote":"CrowdStrike assessed that a probably China-based, Chinese-speaking actor used the Chinese-developed ARTEX autonomous penetration-testing agent and Claude Code against South Korean financial institutions."},{"source_index":8,"quote":"In the September case, the attacker told an agent built on the Chinese model DeepSeek to scan the financial sector for servers running Oracle WebLogic, software behind many corporate websites and apps."},{"source_index":9,"quote":"We’ve all grown accustomed to news of data breaches, but a recent incident involving a Chinese AI tool named ARTEX has sent a chill down the spines of cybersecurity experts and financial institutions worldwide."},{"source_index":11,"quote":"According to CrowdStrike's findings, reported by The Register and Infosecurity Magazine, the attacker's setup actually ran DeepSeek's v4.1-flash model as ARTEX's primary engine, with Zhipu AI's GLM-5.3 and xAI's Grok 4.6 layered in for supplementary sessions."}],"system.developer":[{"source_index":1,"quote":"CrowdStrike said the attacker used ARTEX, a recently released Chinese-developed open-source penetration testing tool, alongside large language models such as Anthropic Claude."},{"source_index":3,"quote":"Artex AI, a Chinese AI system, is believed to have been used in the intrusion."},{"source_index":4,"quote":"Several reports, including an analysis from cybersecurity firm Rescana, name an open-source framework called ARTEX AI as the tool investigators are examining."},{"source_index":5,"quote":"An unknown threat actor used ARTEX, an open-source AI-powered penetration testing tool, in a campaign targeting South Korean financial organizations."},{"source_index":6,"quote":"ARTEX is an open-source penetration-testing system published on GitHub in late July that uses a large language model to scan for weaknesses and plan a route into a target."},{"source_index":7,"quote":"CrowdStrike assessed that a probably China-based, Chinese-speaking actor used the Chinese-developed ARTEX autonomous penetration-testing agent and Claude Code against South Korean financial institutions."},{"source_index":8,"quote":"In the September case, the attacker told an agent built on the Chinese model DeepSeek to scan the financial sector for servers running Oracle WebLogic, software behind many corporate websites and apps."},{"source_index":9,"quote":"ARTEX, a Chinese AI tool, has been directly linked to a large-scale data breach impacting South Korean financial institutions, exposing the personal and highly sensitive financial details of tens of thousands of people."},{"source_index":10,"quote":"The number of financial firms affected by suspected artificial intelligence (AI) agent-driven cyberattacks has risen to 16, more than double the seven initially reported, financial regulators said Wednesday."},{"source_index":11,"quote":"According to CrowdStrike's findings, reported by The Register and Infosecurity Magazine, the attacker's setup actually ran DeepSeek's v4.1-flash model as ARTEX's primary engine, with Zhipu AI's GLM-5.3 and xAI's Grok 4.6 layered in for supplementary sessions."}],"system.harness":[{"source_index":0,"quote":"CrowdStrike said the individual used ARTEX, a recently released open-source AI agent for automated penetration testing, together with large language models including Claude."},{"source_index":4,"quote":"Rescana’s writeup, titled “AI-Powered Cyber Attacks Target Major South Korean Banks: October 2026 Data Breach Analysis and Response,” describes ARTEX AI as a large-language-model-based penetration-testing system capable of independently running reconnaissance, identifying vulnerable login endpoints, launching credential-stuffing or brute-force attempts, and verifying whether an attack succeeded, all with limited ongoing human direction."},{"source_index":5,"quote":"An unknown threat actor used ARTEX, an open-source AI-powered penetration testing tool, in a campaign targeting South Korean financial organizations."},{"source_index":6,"quote":"Investigators traced the internet addresses and server logs behind the attack on Shinhan Bank, the first institution to report a breach, and found evidence of ARTEX AI, the Korea Financial Security Institute said."},{"source_index":7,"quote":"CrowdStrike assessed that a probably China-based, Chinese-speaking actor used the Chinese-developed ARTEX autonomous penetration-testing agent and Claude Code against South Korean financial institutions."},{"source_index":8,"quote":"U.S. cybersecurity firm CrowdStrike said in an Oct. 7 report that the attacker used ARTEX, an open-source penetration-testing tool developed in China."},{"source_index":11,"quote":"Investigators are examining whether the attacks ran through ARTEX, an open-source AI penetration-testing agent that a Chinese security engineer posted to GitHub on July 26, barely two months before the first intrusions surfaced."}],"system.tools_granted":[{"source_index":0,"quote":"CrowdStrike said the individual used ARTEX, a recently released open-source AI agent for automated penetration testing, together with large language models including Claude."},{"source_index":1,"quote":"ARTEX is an open-source AI agent for automated penetration testing that was published on GitHub this year by a Chinese security engineer with the handle Autumn."},{"source_index":4,"quote":"Rescana’s writeup, titled “AI-Powered Cyber Attacks Target Major South Korean Banks: October 2026 Data Breach Analysis and Response,” describes ARTEX AI as a large-language-model-based penetration-testing system capable of independently running reconnaissance, identifying vulnerable login endpoints, launching credential-stuffing or brute-force attempts, and verifying whether an attack succeeded, all with limited ongoing human direction."},{"source_index":8,"quote":"The next day, the agent exploited a flaw that let outsiders run commands on one company's server and planted a web shell there."},{"source_index":9,"quote":"AI tools like ARTEX can automate these processes, rapidly sifting through vast amounts of data, identifying zero-day vulnerabilities, and launching multi-pronged attacks at machine speed."},{"source_index":11,"quote":"It's built on a multi-agent architecture that identifies targets, finds vulnerabilities, plans an attack path, fires off the actual exploitation tools and checks its own results, largely without a human steering each step."}],"system.autonomy_level":[{"source_index":0,"quote":"CrowdStrike said the individual used ARTEX, a recently released open-source AI agent for automated penetration testing, together with large language models including Claude."},{"source_index":4,"quote":"According to cybersecurity firm Rescana, ARTEX AI is an open-source, large-language-model-based penetration-testing framework capable of independently running reconnaissance, probing login endpoints, attempting attacks, and verifying results with limited human direction."},{"source_index":6,"quote":"South Korean President Lee Jae Myung said Tuesday that artificial intelligence agents appeared to have been used in a run of cyberattacks that exposed the personal data of at least 68,000 customers at seven or more financial firms."},{"source_index":8,"quote":"An AI agent is software that carries out a chain of tasks on its own after a single instruction."},{"source_index":11,"quote":"It's built on a multi-agent architecture that identifies targets, finds vulnerabilities, plans an attack path, fires off the actual exploitation tools and checks its own results, largely without a human steering each step."}],"system.deployment_context":[{"source_index":0,"quote":"CrowdStrike said the individual used ARTEX, a recently released open-source AI agent for automated penetration testing, together with large language models including Claude."},{"source_index":4,"quote":"South Korean authorities are investigating whether an AI-based tool, reportedly a framework called ARTEX AI, was used to automate reconnaissance and attacks against multiple banks, resulting in personal data exposure across at least seven financial institutions since late September 2026."},{"source_index":6,"quote":"Rather than the core networks that hold account balances, the attacks hit internet-facing side systems, including portals used by employees, outsourced developers, and the loan agents who sell credit on the banks’ behalf."},{"source_index":7,"quote":"CrowdStrike assessed that a probably China-based, Chinese-speaking actor used the Chinese-developed ARTEX autonomous penetration-testing agent and Claude Code against South Korean financial institutions."},{"source_index":8,"quote":"The next day, the agent exploited a flaw that let outsiders run commands on one company's server and planted a web shell there."},{"source_index":9,"quote":"Tools like ARTEX, originally designed for legitimate purposes, can now automate and escalate breaches, making it difficult for traditional security measures to keep pace with these evolving threats."},{"source_index":11,"quote":"This is the first large-scale, documented case of an AI penetration-testing agent breaching real banks in production, and it took one person in Guangdong, not a nation-state unit, to pull it off."}],"system.integration_type":[{"source_index":0,"quote":"It is not a standalone large language model but connects to external models such as ChatGPT, Claude and DeepSeek to assist organisations in testing network vulnerabilities."},{"source_index":3,"quote":"Unlike traditional AI systems or chatbots, which primarily respond to users’ queries, AI agents can perceive, reason, plan, act and learn."},{"source_index":4,"quote":"Rescana’s writeup, titled “AI-Powered Cyber Attacks Target Major South Korean Banks: October 2026 Data Breach Analysis and Response,” describes ARTEX AI as a large-language-model-based penetration-testing system capable of independently running reconnaissance, identifying vulnerable login endpoints, launching credential-stuffing or brute-force attempts, and verifying whether an attack succeeded, all with limited ongoing human direction."},{"source_index":5,"quote":"The findings show how an attacker combined agentic AI with conventional offensive capabilities to support operations against several financial-sector targets."},{"source_index":6,"quote":"ARTEX is an open-source penetration-testing system published on GitHub in late July that uses a large language model to scan for weaknesses and plan a route into a target."},{"source_index":7,"quote":"CrowdStrike assessed that a probably China-based, Chinese-speaking actor used the Chinese-developed ARTEX autonomous penetration-testing agent and Claude Code against South Korean financial institutions."},{"source_index":8,"quote":"An AI agent is software that carries out a chain of tasks on its own after a single instruction."},{"source_index":9,"quote":"AI tools like ARTEX can automate these processes, rapidly sifting through vast amounts of data, identifying zero-day vulnerabilities, and launching multi-pronged attacks at machine speed."},{"source_index":11,"quote":"It's built on a multi-agent architecture that identifies targets, finds vulnerabilities, plans an attack path, fires off the actual exploitation tools and checks its own results, largely without a human steering each step."}],"system.intended_use":[{"source_index":0,"quote":"CrowdStrike said the individual used ARTEX, a recently released open-source AI agent for automated penetration testing, together with large language models including Claude."},{"source_index":3,"quote":"The AI agent was initially developed as a “white hat” security tool for conducting simulated cyberattacks and autonomously identifying system vulnerabilities."},{"source_index":4,"quote":"Rescana’s writeup, titled “AI-Powered Cyber Attacks Target Major South Korean Banks: October 2026 Data Breach Analysis and Response,” describes ARTEX AI as a large-language-model-based penetration-testing system capable of independently running reconnaissance, identifying vulnerable login endpoints, launching credential-stuffing or brute-force attempts, and verifying whether an attack succeeded, all with limited ongoing human direction."},{"source_index":5,"quote":"An unknown threat actor used ARTEX, an open-source AI-powered penetration testing tool, in a campaign targeting South Korean financial organizations."},{"source_index":6,"quote":"ARTEX was built as a red-team tool to find flaws before attackers do, and it appeared online about two months before the Korean breaches."},{"source_index":7,"quote":"CrowdStrike assessed that a probably China-based, Chinese-speaking actor used the Chinese-developed ARTEX autonomous penetration-testing agent and Claude Code against South Korean financial institutions."},{"source_index":8,"quote":"Tools like it are meant to let companies probe their own defenses, and ARTEX hands much of that work to AI agents."},{"source_index":9,"quote":"Tools originally designed for legitimate vulnerability discovery are now being turned against us, accelerating attacks to speeds and scales previously unimaginable."},{"source_index":10,"quote":"The number of financial firms affected by suspected artificial intelligence (AI) agent-driven cyberattacks has risen to 16, more than double the seven initially reported, financial regulators said Wednesday."},{"source_index":11,"quote":"It's built on a multi-agent architecture that identifies targets, finds vulnerabilities, plans an attack path, fires off the actual exploitation tools and checks its own results, largely without a human steering each step."}],"event.trigger":[{"source_index":1,"quote":"Adam Meyers, senior vice president of counter adversary operations at CrowdStrike, told reporters on a call on Thursday that this was an example of a human adversary leveraging AI agents to conduct widespread attacks."},{"source_index":3,"quote":"Malicious actors, however, have repurposed the technology to identify weaknesses and orchestrate real attacks."},{"source_index":8,"quote":"In the September case, the attacker told an agent built on the Chinese model DeepSeek to scan the financial sector for servers running Oracle WebLogic, software behind many corporate websites and apps."},{"source_index":11,"quote":"A lone hacker in China is suspected of using an open-source AI pentesting agent to do it, and investigators are still tallying the damage."}],"event.detection_method":[{"source_index":0,"quote":"CrowdStrike said it uncovered personal details potentially linked to the suspected attacker while analysing AI coding-tool sessions and infrastructure associated with a campaign targeting South Korean financial institutions from late September to early October."},{"source_index":3,"quote":"Last week, Shinhan Bank detected a data breach affecting about 25,000 customers and immediately reported it to financial authorities."},{"source_index":4,"quote":"Confirmed: multiple South Korean banks disclosed breaches in late September and early October 2026."},{"source_index":5,"quote":"CrowdStrike Intelligence identified attacker-controlled infrastructure linked to intrusions that resulted in data theft."},{"source_index":6,"quote":"Investigators traced the internet addresses and server logs behind the attack on Shinhan Bank, the first institution to report a breach, and found evidence of ARTEX AI, the Korea Financial Security Institute said."},{"source_index":7,"quote":"CrowdStrike assessed that a probably China-based, Chinese-speaking actor used the Chinese-developed ARTEX autonomous penetration-testing agent and Claude Code against South Korean financial institutions."},{"source_index":9,"quote":"The ARTEX breach reportedly compromised personal data for at least 68,000 individuals at South Korean financial institutions, exposing everything from annual income to sensitive loan application details."},{"source_index":10,"quote":"The tally could rise as companies continue checking their systems for signs of intrusion."},{"source_index":11,"quote":"Police have assigned 28 cyberterrorism investigators across four teams to figure out exactly how deep it goes."}],"event.summary":[{"source_index":0,"quote":"CrowdStrike said the individual used ARTEX, a recently released open-source AI agent for automated penetration testing, together with large language models including Claude."},{"source_index":3,"quote":"Artex AI, a Chinese AI system, is believed to have been used in the intrusion."},{"source_index":3,"quote":"The AI agent was initially developed as a “white hat” security tool for conducting simulated cyberattacks and autonomously identifying system vulnerabilities."},{"source_index":3,"quote":"Malicious actors, however, have repurposed the technology to identify weaknesses and orchestrate real attacks."},{"source_index":3,"quote":"Last week, Shinhan Bank detected a data breach affecting about 25,000 customers and immediately reported it to financial authorities."},{"source_index":3,"quote":"The Financial Security Institute (FSI) found that the hacker had used AI to launch the cyberattack and had disrupted the systems at six other financial institutions as well."},{"source_index":3,"quote":"The Ministry of Science and ICT, in collaboration with the Korea Internet & Security Agency, launched an emergency response system to prevent the spread of AI-powered data breaches."},{"source_index":4,"quote":"South Korean authorities are investigating whether an AI-based tool, reportedly a framework called ARTEX AI, was used to automate reconnaissance and attacks against multiple banks, resulting in personal data exposure across at least seven financial institutions since late September 2026."},{"source_index":5,"quote":"An unknown threat actor used ARTEX, an open-source AI-powered penetration testing tool, in a campaign targeting South Korean financial organizations."},{"source_index":6,"quote":"South Korean President Lee Jae Myung said Tuesday that artificial intelligence agents appeared to have been used in a run of cyberattacks that exposed the personal data of at least 68,000 customers at seven or more financial firms."},{"source_index":7,"quote":"CrowdStrike assessed that a probably China-based, Chinese-speaking actor used the Chinese-developed ARTEX autonomous penetration-testing agent and Claude Code against South Korean financial institutions."},{"source_index":8,"quote":"In the September case, the attacker told an agent built on the Chinese model DeepSeek to scan the financial sector for servers running Oracle WebLogic, software behind many corporate websites and apps."},{"source_index":8,"quote":"The next day, the agent exploited a flaw that let outsiders run commands on one company's server and planted a web shell there."},{"source_index":8,"quote":"They exposed data on about 40,000 Yegaram Savings Bank customers and about 25,000 Shinhan Bank customers."},{"source_index":8,"quote":"The copy of ARTEX that CrowdStrike examined ran on DeepSeek V4.1-Flash, and the attacker used Anthropic's Claude Code and other AI models in separate sessions."},{"source_index":9,"quote":"The ARTEX incident refers to a massive data breach involving an AI tool that compromised personal data for at least 68,000 individuals at South Korean financial institutions."},{"source_index":10,"quote":"The number of financial firms affected by suspected artificial intelligence (AI) agent-driven cyberattacks has risen to 16, more than double the seven initially reported, financial regulators said Wednesday."},{"source_index":11,"quote":"South Korea's Financial Services Commission confirmed on October 14 that 16 financial firms had been breached since the start of the month."}],"event.tags":[{"source_index":0,"quote":"CrowdStrike said the individual used ARTEX, a recently released open-source AI agent for automated penetration testing, together with large language models including Claude."},{"source_index":2,"quote":"CrowdStrike said the attacker used ARTEX, a recently released Chinese-developed open-source penetration testing tool, alongside large language models such as Claude."},{"source_index":5,"quote":"The findings show how an attacker combined agentic AI with conventional offensive capabilities to support operations against several financial-sector targets."},{"source_index":6,"quote":"South Korean President Lee Jae Myung said Tuesday that artificial intelligence agents appeared to have been used in a run of cyberattacks that exposed the personal data of at least 68,000 customers at seven or more financial firms."},{"source_index":7,"quote":"CrowdStrike assessed that a probably China-based, Chinese-speaking actor used the Chinese-developed ARTEX autonomous penetration-testing agent and Claude Code against South Korean financial institutions."},{"source_index":8,"quote":"An AI agent is software that carries out a chain of tasks on its own after a single instruction."},{"source_index":8,"quote":"The breaches began in late September."},{"source_index":8,"quote":"They exposed data on about 40,000 Yegaram Savings Bank customers and about 25,000 Shinhan Bank customers."},{"source_index":8,"quote":"The next day, the agent exploited a flaw that let outsiders run commands on one company's server and planted a web shell there."},{"source_index":8,"quote":"In the September case, the attacker told an agent built on the Chinese model DeepSeek to scan the financial sector for servers running Oracle WebLogic, software behind many corporate websites and apps."},{"source_index":8,"quote":"The copy of ARTEX that CrowdStrike examined ran on DeepSeek V4.1-Flash, and the attacker used Anthropic's Claude Code and other AI models in separate sessions."},{"source_index":10,"quote":"The number of financial firms affected by suspected artificial intelligence (AI) agent-driven cyberattacks has risen to 16, more than double the seven initially reported, financial regulators said Wednesday."},{"source_index":10,"quote":"About 100,000 records containing personal information, including resident registration numbers, were exposed."},{"source_index":10,"quote":"Regulators also found security deficiencies at 130 of the 555 financial firms reviewed, including failures to apply the latest security patches."},{"source_index":11,"quote":"Investigators are examining whether the attacks ran through ARTEX, an open-source AI penetration-testing agent that a Chinese security engineer posted to GitHub on July 26, barely two months before the first intrusions surfaced."}],"event.root_cause":[{"source_index":0,"quote":"CrowdStrike said the individual used ARTEX, a recently released open-source AI agent for automated penetration testing, together with large language models including Claude."},{"source_index":6,"quote":"South Korean President Lee Jae Myung said Tuesday that artificial intelligence agents appeared to have been used in a run of cyberattacks that exposed the personal data of at least 68,000 customers at seven or more financial firms."},{"source_index":8,"quote":"The next day, the agent exploited a flaw that let outsiders run commands on one company's server and planted a web shell there."},{"source_index":9,"quote":"The ARTEX incident refers to a massive data breach involving an AI tool that compromised personal data for at least 68,000 individuals at South Korean financial institutions."},{"source_index":10,"quote":"Regulators also found security deficiencies at 130 of the 555 financial firms reviewed, including failures to apply the latest security patches."}],"event.adversarial_actor":[{"source_index":0,"quote":"AN attacker targeting South Korea’s financial sector used a Chinese-developed AI agent alongside Anthropic’s Claude Code, cybersecurity firm CrowdStrike said, highlighting growing concerns over how AI tools are being used to support cyberattacks."},{"source_index":3,"quote":"The Financial Security Institute (FSI) found that the hacker had used AI to launch the cyberattack and had disrupted the systems at six other financial institutions as well."},{"source_index":4,"quote":"Instead, investigators suspect the attackers used AI to compress the time and manual labor it normally takes a human red team, or a criminal crew, to scan, probe, and exploit login systems at scale."},{"source_index":5,"quote":"An unknown threat actor used ARTEX, an open-source AI-powered penetration testing tool, in a campaign targeting South Korean financial organizations."},{"source_index":6,"quote":"South Korean President Lee Jae Myung said Tuesday that artificial intelligence agents appeared to have been used in a run of cyberattacks that exposed the personal data of at least 68,000 customers at seven or more financial firms."},{"source_index":7,"quote":"CrowdStrike assessed that a probably China-based, Chinese-speaking actor used the Chinese-developed ARTEX autonomous penetration-testing agent and Claude Code against South Korean financial institutions."},{"source_index":8,"quote":"In the September case, the attacker told an agent built on the Chinese model DeepSeek to scan the financial sector for servers running Oracle WebLogic, software behind many corporate websites and apps."},{"source_index":9,"quote":"The ARTEX incident refers to a massive data breach involving an AI tool that compromised personal data for at least 68,000 individuals at South Korean financial institutions."},{"source_index":10,"quote":"They are also investigating whether the attacks were carried out by the same hacking group."},{"source_index":11,"quote":"A lone hacker in China is suspected of using an open-source AI pentesting agent to do it, and investigators are still tallying the damage."}],"event.incident_class":[{"source_index":0,"quote":"AN attacker targeting South Korea’s financial sector used a Chinese-developed AI agent alongside Anthropic’s Claude Code, cybersecurity firm CrowdStrike said, highlighting growing concerns over how AI tools are being used to support cyberattacks."},{"source_index":3,"quote":"The Financial Security Institute (FSI) found that the hacker had used AI to launch the cyberattack and had disrupted the systems at six other financial institutions as well."},{"source_index":4,"quote":"South Korea’s government confirmed on October 6, 2026, that it is investigating whether artificial intelligence tools were used to automate a wave of cyberattacks against the country’s largest banks."},{"source_index":5,"quote":"CrowdStrike Intelligence identified attacker-controlled infrastructure linked to intrusions that resulted in data theft."},{"source_index":6,"quote":"South Korean President Lee Jae Myung said Tuesday that artificial intelligence agents appeared to have been used in a run of cyberattacks that exposed the personal data of at least 68,000 customers at seven or more financial firms."},{"source_index":7,"quote":"CrowdStrike assessed that a probably China-based, Chinese-speaking actor used the Chinese-developed ARTEX autonomous penetration-testing agent and Claude Code against South Korean financial institutions."},{"source_index":8,"quote":"In the September case, the attacker told an agent built on the Chinese model DeepSeek to scan the financial sector for servers running Oracle WebLogic, software behind many corporate websites and apps."},{"source_index":9,"quote":"The ARTEX incident refers to a massive data breach involving an AI tool that compromised personal data for at least 68,000 individuals at South Korean financial institutions."},{"source_index":10,"quote":"The number of financial firms affected by suspected artificial intelligence (AI) agent-driven cyberattacks has risen to 16, more than double the seven initially reported, financial regulators said Wednesday."},{"source_index":11,"quote":"A lone hacker in China is suspected of using an open-source AI pentesting agent to do it, and investigators are still tallying the damage."}],"event.agent_involved":[{"source_index":0,"quote":"CrowdStrike said the individual used ARTEX, a recently released open-source AI agent for automated penetration testing, together with large language models including Claude."},{"source_index":3,"quote":"The Financial Security Institute (FSI) found that the hacker had used AI to launch the cyberattack and had disrupted the systems at six other financial institutions as well."},{"source_index":4,"quote":"According to cybersecurity firm Rescana, ARTEX AI is an open-source, large-language-model-based penetration-testing framework capable of independently running reconnaissance, probing login endpoints, attempting attacks, and verifying results with limited human direction."},{"source_index":5,"quote":"The findings show how an attacker combined agentic AI with conventional offensive capabilities to support operations against several financial-sector targets."},{"source_index":6,"quote":"South Korean President Lee Jae Myung said Tuesday that artificial intelligence agents appeared to have been used in a run of cyberattacks that exposed the personal data of at least 68,000 customers at seven or more financial firms."},{"source_index":7,"quote":"CrowdStrike assessed that a probably China-based, Chinese-speaking actor used the Chinese-developed ARTEX autonomous penetration-testing agent and Claude Code against South Korean financial institutions."},{"source_index":8,"quote":"An AI agent is software that carries out a chain of tasks on its own after a single instruction."},{"source_index":9,"quote":"This wasn’t a manual hack; it was an AI-driven assault."},{"source_index":10,"quote":"The number of financial firms affected by suspected artificial intelligence (AI) agent-driven cyberattacks has risen to 16, more than double the seven initially reported, financial regulators said Wednesday."},{"source_index":11,"quote":"It's built on a multi-agent architecture that identifies targets, finds vulnerabilities, plans an attack path, fires off the actual exploitation tools and checks its own results, largely without a human steering each step."}],"impact.harm_class":[{"source_index":0,"quote":"Shinhan Bank said last week that personal information belonging to about 25,000 customers had been compromised, while KB Kookmin Bank said personal information belonging to 119 customers had been leaked."},{"source_index":3,"quote":"The bank found that an intruder had identified vulnerabilities in its website and stolen customers' personal data, including their names, mobile phone numbers and annual incomes."},{"source_index":4,"quote":"South Korean authorities are investigating whether an AI-based tool, reportedly a framework called ARTEX AI, was used to automate reconnaissance and attacks against multiple banks, resulting in personal data exposure across at least seven financial institutions since late September 2026."},{"source_index":6,"quote":"South Korean President Lee Jae Myung said Tuesday that artificial intelligence agents appeared to have been used in a run of cyberattacks that exposed the personal data of at least 68,000 customers at seven or more financial firms."},{"source_index":7,"quote":"Reuters reported that at least nine banks had disclosed or were reported to have been targeted, while Shinhan Bank said personal information for about 25,000 customers was compromised."},{"source_index":8,"quote":"They exposed data on about 40,000 Yegaram Savings Bank customers and about 25,000 Shinhan Bank customers."},{"source_index":9,"quote":"The ARTEX incident refers to a massive data breach involving an AI tool that compromised personal data for at least 68,000 individuals at South Korean financial institutions."}],"impact.affected_description":[{"source_index":0,"quote":"At least nine South Korean banks have disclosed or been reported by local media to have been targeted in cyberattacks since late September, prompting South Korean police to launch an investigation this week."},{"source_index":3,"quote":"Last week, Shinhan Bank detected a data breach affecting about 25,000 customers and immediately reported it to financial authorities."},{"source_index":4,"quote":"At least seven South Korean financial institutions have reported hacking-related personal information leaks since late September 2026, with investigators now probing a potential link between the intrusions and an AI-driven attack framework."},{"source_index":5,"quote":"Industry reports described breaches involving a bank’s loan progress inquiry service used by financial brokers and another bank’s employee mobile work-support system."},{"source_index":6,"quote":"South Korean President Lee Jae Myung said Tuesday that artificial intelligence agents appeared to have been used in a run of cyberattacks that exposed the personal data of at least 68,000 customers at seven or more financial firms."},{"source_index":7,"quote":"Reuters reported that at least nine banks had disclosed or were reported to have been targeted, while Shinhan Bank said personal information for about 25,000 customers was compromised."},{"source_index":8,"quote":"They exposed data on about 40,000 Yegaram Savings Bank customers and about 25,000 Shinhan Bank customers."},{"source_index":9,"quote":"The ARTEX breach reportedly compromised personal data for at least 68,000 individuals at South Korean financial institutions, exposing everything from annual income to sensitive loan application details."},{"source_index":10,"quote":"It said the breaches, reported since the beginning of this month, have affected banks, savings banks, credit finance companies, electronic payment providers and cryptocurrency businesses."},{"source_index":10,"quote":"About 100,000 records containing personal information, including resident registration numbers, were exposed."},{"source_index":11,"quote":"The list includes Shinhan, KB Kookmin, Hana and BNK Busan banks, along with Yegaram and Welcome savings banks and Hyundai Capital."}],"impact.data_categories_exposed":[{"source_index":0,"quote":"Shinhan Bank said last week that personal information belonging to about 25,000 customers had been compromised, while KB Kookmin Bank said personal information belonging to 119 customers had been leaked."},{"source_index":3,"quote":"The bank found that an intruder had identified vulnerabilities in its website and stolen customers' personal data, including their names, mobile phone numbers and annual incomes."},{"source_index":4,"quote":"Reports indicate the first confirmed incident hit Yegaram Savings Bank around September 30, 2026, exposing an estimated 40,000 records containing names, dates of birth, and contact details."},{"source_index":6,"quote":"The exposed records included names, phone numbers, incomes, and borrowing histories."},{"source_index":7,"quote":"Reuters reported that at least nine banks had disclosed or were reported to have been targeted, while Shinhan Bank said personal information for about 25,000 customers was compromised."},{"source_index":8,"quote":"They exposed data on about 40,000 Yegaram Savings Bank customers and about 25,000 Shinhan Bank customers."},{"source_index":9,"quote":"The ARTEX breach reportedly compromised personal data for at least 68,000 individuals at South Korean financial institutions, exposing everything from annual income to sensitive loan application details."},{"source_index":10,"quote":"The leaked information includes names, contact details and resident registration numbers."},{"source_index":11,"quote":"The regulator put the damage at roughly 100,000 exposed records: names, incomes, loan limits and, in some cases, national ID numbers."}],"impact.severity_because":[{"source_index":0,"quote":"At least nine South Korean banks have disclosed or been reported by local media to have been targeted in cyberattacks since late September, prompting South Korean police to launch an investigation this week."},{"source_index":3,"quote":"The series of incidents involving seven Korean financial institutions last week sends a warning signal: In the age of AI, intrusions can occur at any time and across all sectors, potentially causing significant harm on an unparalleled scale."},{"source_index":4,"quote":"Totals vary by outlet: Firstpost, citing Wall Street Journal reporting, put the combined exposure at roughly 68,000 people, while other domestic accounts cited more than 65,000 records."},{"source_index":5,"quote":"Industry reports described breaches involving a bank’s loan progress inquiry service used by financial brokers and another bank’s employee mobile work-support system."},{"source_index":6,"quote":"South Korean President Lee Jae Myung said Tuesday that artificial intelligence agents appeared to have been used in a run of cyberattacks that exposed the personal data of at least 68,000 customers at seven or more financial firms."},{"source_index":7,"quote":"Reuters reported that at least nine banks had disclosed or were reported to have been targeted, while Shinhan Bank said personal information for about 25,000 customers was compromised."},{"source_index":8,"quote":"They exposed data on about 40,000 Yegaram Savings Bank customers and about 25,000 Shinhan Bank customers."},{"source_index":9,"quote":"The ARTEX breach reportedly compromised personal data for at least 68,000 individuals at South Korean financial institutions, exposing everything from annual income to sensitive loan application details."},{"source_index":10,"quote":"The number of financial firms affected by suspected artificial intelligence (AI) agent-driven cyberattacks has risen to 16, more than double the seven initially reported, financial regulators said Wednesday."},{"source_index":10,"quote":"About 100,000 records containing personal information, including resident registration numbers, were exposed."},{"source_index":11,"quote":"South Korea's Financial Services Commission confirmed on October 14 that 16 financial firms had been breached since the start of the month."}],"context.industry":[{"source_index":0,"quote":"AN attacker targeting South Korea’s financial sector used a Chinese-developed AI agent alongside Anthropic’s Claude Code, cybersecurity firm CrowdStrike said, highlighting growing concerns over how AI tools are being used to support cyberattacks."},{"source_index":3,"quote":"The series of incidents involving seven Korean financial institutions last week sends a warning signal: In the age of AI, intrusions can occur at any time and across all sectors, potentially causing significant harm on an unparalleled scale."},{"source_index":4,"quote":"South Korean authorities are investigating whether an AI-based tool, reportedly a framework called ARTEX AI, was used to automate reconnaissance and attacks against multiple banks, resulting in personal data exposure across at least seven financial institutions since late September 2026."},{"source_index":5,"quote":"An unknown threat actor used ARTEX, an open-source AI-powered penetration testing tool, in a campaign targeting South Korean financial organizations."},{"source_index":6,"quote":"South Korean President Lee Jae Myung said Tuesday that artificial intelligence agents appeared to have been used in a run of cyberattacks that exposed the personal data of at least 68,000 customers at seven or more financial firms."},{"source_index":7,"quote":"CrowdStrike assessed that a probably China-based, Chinese-speaking actor used the Chinese-developed ARTEX autonomous penetration-testing agent and Claude Code against South Korean financial institutions."},{"source_index":8,"quote":"The breaches began in late September."},{"source_index":9,"quote":"The ARTEX incident refers to a massive data breach involving an AI tool that compromised personal data for at least 68,000 individuals at South Korean financial institutions."},{"source_index":10,"quote":"It said the breaches, reported since the beginning of this month, have affected banks, savings banks, credit finance companies, electronic payment providers and cryptocurrency businesses."},{"source_index":11,"quote":"South Korea's Financial Services Commission confirmed on October 14 that 16 financial firms had been breached since the start of the month."}],"context.country":[{"source_index":0,"quote":"At least nine South Korean banks have disclosed or been reported by local media to have been targeted in cyberattacks since late September, prompting South Korean police to launch an investigation this week."},{"source_index":3,"quote":"The artificial intelligence (AI)-powered cyberattacks on Korea’s financial institutions are a vivid illustration of how ill-prepared the nation is for this new age."},{"source_index":4,"quote":"South Korea’s government confirmed on October 6, 2026, that it is investigating whether artificial intelligence tools were used to automate a wave of cyberattacks against the country’s largest banks."},{"source_index":5,"quote":"An unknown threat actor used ARTEX, an open-source AI-powered penetration testing tool, in a campaign targeting South Korean financial organizations."},{"source_index":6,"quote":"South Korean President Lee Jae Myung said Tuesday that artificial intelligence agents appeared to have been used in a run of cyberattacks that exposed the personal data of at least 68,000 customers at seven or more financial firms."},{"source_index":7,"quote":"CrowdStrike assessed that a probably China-based, Chinese-speaking actor used the Chinese-developed ARTEX autonomous penetration-testing agent and Claude Code against South Korean financial institutions."},{"source_index":8,"quote":"SEOUL, October 11 (AJP) - Weeks before hackers used artificial intelligence tools to steal customer data from seven South Korean financial firms, the sector's security agency had walked those firms' security staff through a similar AI attack on a domestic lender, according to documents the agency submitted to a lawmaker."},{"source_index":9,"quote":"The ARTEX incident refers to a massive data breach involving an AI tool that compromised personal data for at least 68,000 individuals at South Korean financial institutions."},{"source_index":10,"quote":"The Financial Services Commission (FSC) disclosed the findings at an emergency response meeting."},{"source_index":11,"quote":"South Korea's Financial Services Commission confirmed on October 14 that 16 financial firms had been breached since the start of the month."}],"impact.severity":[{"source_index":0,"quote":"At least nine South Korean banks have disclosed or been reported by local media to have been targeted in cyberattacks since late September, prompting South Korean police to launch an investigation this week."},{"source_index":3,"quote":"The series of incidents involving seven Korean financial institutions last week sends a warning signal: In the age of AI, intrusions can occur at any time and across all sectors, potentially causing significant harm on an unparalleled scale."},{"source_index":4,"quote":"Totals vary by outlet: Firstpost, citing Wall Street Journal reporting, put the combined exposure at roughly 68,000 people, while other domestic accounts cited more than 65,000 records."},{"source_index":5,"quote":"Industry reports described breaches involving a bank’s loan progress inquiry service used by financial brokers and another bank’s employee mobile work-support system."},{"source_index":6,"quote":"South Korean President Lee Jae Myung said Tuesday that artificial intelligence agents appeared to have been used in a run of cyberattacks that exposed the personal data of at least 68,000 customers at seven or more financial firms."},{"source_index":7,"quote":"Reuters reported that at least nine banks had disclosed or were reported to have been targeted, while Shinhan Bank said personal information for about 25,000 customers was compromised."},{"source_index":8,"quote":"They exposed data on about 40,000 Yegaram Savings Bank customers and about 25,000 Shinhan Bank customers."},{"source_index":9,"quote":"The ARTEX breach reportedly compromised personal data for at least 68,000 individuals at South Korean financial institutions, exposing everything from annual income to sensitive loan application details."},{"source_index":10,"quote":"The number of financial firms affected by suspected artificial intelligence (AI) agent-driven cyberattacks has risen to 16, more than double the seven initially reported, financial regulators said Wednesday."},{"source_index":11,"quote":"South Korea's Financial Services Commission confirmed on October 14 that 16 financial firms had been breached since the start of the month."}],"event.date_disclosed":[{"source_index":3,"quote":"published: 2026-10-05"}],"context.regulatory":[{"source_index":3,"quote":"Meanwhile, three financial supervisory organizations — the Financial Services Commission, the Financial Supervisory Service and the FSI — joined forces to investigate the AI-powered breach and monitor whether other private sector institutions had also been affected."},{"source_index":4,"quote":"South Korea’s National Police Agency cyber bureau opened a probe into the attack routes and the parties responsible, while the Financial Services Commission ordered emergency security inspections across the banking sector, according to Yonhap News Agency."},{"source_index":7,"quote":"South Korean police are investigating."},{"source_index":8,"quote":"The chief executives of South Korea's five largest commercial banks are scheduled to testify about the breaches at the National Assembly's audit of the Financial Supervisory Service on Oct. 19."}],"system.lifecycle_stage":[{"source_index":4,"quote":"South Korean authorities are investigating whether an AI-based tool, reportedly a framework called ARTEX AI, was used to automate reconnaissance and attacks against multiple banks, resulting in personal data exposure across at least seven financial institutions since late September 2026."},{"source_index":10,"quote":"The number of financial firms affected by suspected artificial intelligence (AI) agent-driven cyberattacks has risen to 16, more than double the seven initially reported, financial regulators said Wednesday."},{"source_index":11,"quote":"This is the first large-scale, documented case of an AI penetration-testing agent breaching real banks in production, and it took one person in Guangdong, not a nation-state unit, to pull it off."}],"event.date_occurred":[{"source_index":4,"quote":"Reports indicate the first confirmed incident hit Yegaram Savings Bank around September 30, 2026, exposing an estimated 40,000 records containing names, dates of birth, and contact details."},{"source_index":8,"quote":"The breaches began in late September."},{"source_index":11,"quote":"South Korea's Financial Services Commission confirmed on October 14 that 16 financial firms had been breached since the start of the month."}],"context.denominator_available":[{"source_index":5,"quote":"The total number of affected organizations remains unconfirmed."}],"context.incident_evidence":[{"source_index":5,"quote":"Researchers uncovered exposed directories containing Claude Code session histories, ARTEX configuration files, and Claude memory files."}],"event.failure_class":[{"source_index":6,"quote":"Rather than the core networks that hold account balances, the attacks hit internet-facing side systems, including portals used by employees, outsourced developers, and the loan agents who sell credit on the banks’ behalf."},{"source_index":8,"quote":"The next day, the agent exploited a flaw that let outsiders run commands on one company's server and planted a web shell there."}],"system.production_intended":[{"source_index":8,"quote":"Tools like it are meant to let companies probe their own defenses, and ARTEX hands much of that work to AI agents."}],"event.secondary_failure_classes":[{"source_index":8,"quote":"They exposed data on about 40,000 Yegaram Savings Bank customers and about 25,000 Shinhan Bank customers."}],"event.near_miss":[{"source_index":8,"quote":"They exposed data on about 40,000 Yegaram Savings Bank customers and about 25,000 Shinhan Bank customers."},{"source_index":11,"quote":"The regulator put the damage at roughly 100,000 exposed records: names, incomes, loan limits and, in some cases, national ID numbers."}],"event.precursor_events":[{"source_index":8,"quote":"The documents show the agency described the earlier attack at a Sept. 17 seminar attended by about 160 security officers."}],"event.failure_class_detail":[{"source_index":8,"quote":"The next day, the agent exploited a flaw that let outsiders run commands on one company's server and planted a web shell there."}],"context.shared_model_id":[{"source_index":11,"quote":"According to CrowdStrike's findings, reported by The Register and Infosecurity Magazine, the attacker's setup actually ran DeepSeek's v4.1-flash model as ARTEX's primary engine, with Zhipu AI's GLM-5.3 and xAI's Grok 4.6 layered in for supplementary sessions."}]},"notes_on_gaps":"No source states the agent's autonomy arrangement, deployment context, permissions scope, guardrails, or a root cause; event.root_cause is therefore unknown and no guardrail failure is coded. No source states a monetary loss figure, so impact.direct_loss_usd is null and severity rests on the many-third-parties/police-investigation rung. No source states who first noticed the attacks at the banks themselves; detection is credited to CrowdStrike as an outside organisation. No source states containment, remediation, or a control change, so event.remediation and event.operations_paused are omitted. event.date_occurred is omitted because sources give only a late-September-to-early-October window, not a date. system.model_version is not disclosed. The 25,119 records figure is the sum of the two stated bank figures (about 25,000 plus 119). system.tier: not set; no operator named and deployment_context is not a lab's. Sources disagree on event.summary: [0] \"An attacker targeting South Korea's financial sector used ARTEX, a Chinese-developed open-source AI agent for automated penetration testing, alongside large language models including Anthropic's Claude, in a campaign against South Korean financial institutions from late September to early October. CrowdStrike uncovered the activity while analysing AI coding-tool sessions and infrastructure, and said the suspect may be a 26-year-old in Guangdong province, though the activity was not attributed to a named adversary. At least nine South Korean banks were targeted, with Shinhan Bank reporting about 25,000 customers' personal information compromised and KB Kookmin Bank reporting 119 customers' data leaked; South Korean police launched an investigation.\", [1] \"CrowdStrike reported that a China-based, financially motivated actor used the Chinese-developed AI agent ARTEX alongside Anthropic's Claude to conduct cyberattacks on South Korean banks. At least nine banks were targeted since late September; Shinhan Bank said about 25,000 customers' personal information was compromised and KB Kookmin Bank said 119 customers' data leaked. South Korean police opened a probe and the president called for a robust response.\"; impact.affected_description: [0] \"At least nine South Korean banks; about 25,000 Shinhan Bank customers and 119 KB Kookmin Bank customers\", [1] \"about 25,000 Shinhan Bank customers and 119 KB Kookmin Bank customers; at least nine South Korean banks targeted\", [2] \"At least nine South Korean banks; about 25,000 Shinhan Bank customers and 119 KB Kookmin Bank customers\". [aggregated by deepseek-chat, aggregate-2026-09-27.1, 2026-10-09] system.autonomy_level: no source states the arrangement. system.deployment_context: no source states where it ran. event.detection_method: a source states an outside organisation (a vendor, a partner, a platform) noticed it first. event.summary: classified from described behaviour. event.incident_class: a source states an attacker, an injected instruction or a misused credential caused the system to act, or that the system's own boundary (sandbox, permissions, weights, accounts) was breached. context.denominator_available: no denominator is available for this incident. Merged with LR-2026-0128, LR-2026-0134, LR-2026-0141, LR-2026-0144, LR-2026-0146, LR-2026-0159, LR-2026-0171, which described the same incident; their sources are included here. [corrected by Srini Iyer, approved 2026-10-18 in the corrections review: duplicate of another record, merged; severity reason printed the whole rubric] Merged with LR-2026-0180, LR-2026-0206, which described the same incident; their sources are included here. [corrected by Srini Iyer, approved 2026-10-20 in the corrections review: duplicate of another record, merged] [corrected by Srini Iyer, approved 2026-10-21 in the corrections review: a value the sources do not support was cleared] [corrected by Srini Iyer, approved 2026-10-22 in the corrections review: linked to the records the matcher relates (same disclosure or summary)] [corrected by Srini Iyer, approved 2026-10-22 in the corrections review: a denominator from another event or of another kind was cleared] [corrected by Srini Iyer, approved 2026-10-22 in the corrections review: a judgement inferred by us that no source states was cleared] Stated counts not stored as numbers: the sources give 'at least 68,000' and 'roughly 68,000' customers affected, and about 40,000 Yegaram Savings Bank and about 25,000 Shinhan Bank customers whose data was exposed (bounds); impact.third_parties_affected_count and impact.records_exposed hold only exact counts. [corrected by Srini Iyer, approved 2026-10-22 in the corrections review: a stated loss or count the fields cannot hold was recorded in the notes; source gives a bound, not an exact count] [corrected by Srini Iyer, approved 2026-10-22 in the corrections review: the date of the earliest source now names the earliest source the record holds]"},"context":{"industry":"Finance and Insurance","org_size_band":null,"country":"KR","denominator_available":false,"denominator":null,"related_incident_ids":["LR-2026-0121","LR-2026-0127","LR-2026-0232"],"systemic_exposure":null,"shared_model_id":"DeepSeek v4.1-flash","upstream_incident_id":null,"incident_evidence":{"log_completeness":"CrowdStrike Intelligence report dated October 7, 2026, based on exposed directories containing Claude Code session histories, ARTEX configuration files, and Claude memory files.","tamper_evidence":null,"timestamp_reliability":"unknown","investigation_independence":"paid_third_party","redaction_summary":null,"analysis_method":"unknown","prompt_output_retention":null},"regulatory":{"regimes":[],"notifications":"The Financial Services Commission, the Financial Supervisory Service and the FSI joined forces to investigate the AI-powered breach and monitor whether other private sector institutions had also been affected.","litigation_status":"unknown","safety_policy_adherence":null},"coverage":null},"narrative":{"steps":[{"step":"doing","text":"An attacker used ARTEX, an open-source AI agent for automated penetration testing, together with large language models including Claude, to target South Korean financial institutions from late September to early October.","quote":"CrowdStrike said the individual used ARTEX, a recently released open-source AI agent for automated penetration testing, together with large language models including Claude.","source_index":0,"grade":"C"},{"step":"went_wrong","text":"The AI tools were used to support cyberattacks against South Korean banks, breaching those institutions' systems and compromising customer personal information.","quote":"AN attacker targeting South Korea’s financial sector used a Chinese-developed AI agent alongside Anthropic’s Claude Code, cybersecurity firm CrowdStrike said, highlighting growing concerns over how AI tools are being used to support cyberattacks.","source_index":0,"grade":"C"},{"step":"reached","text":"At least nine South Korean banks were targeted; Shinhan Bank had about 25,000 customers' personal information compromised and KB Kookmin Bank had 119 customers' data leaked.","quote":"At least nine South Korean banks have disclosed or been reported by local media to have been targeted in cyberattacks since late September, prompting South Korean police to launch an investigation this week.","source_index":0,"grade":"C"},{"step":"caught","text":"CrowdStrike, an outside cybersecurity firm, uncovered the activity while analysing AI coding-tool sessions and infrastructure associated with the campaign.","quote":"CrowdStrike said it uncovered personal details potentially linked to the suspected attacker while analysing AI coding-tool sessions and infrastructure associated with a campaign targeting South Korean financial institutions from late September to early October.","source_index":0,"grade":"C"},{"step":"done","text":"South Korean police launched an investigation this week, and President Lee Jae Myung called for robust response measures.","quote":"At least nine South Korean banks have disclosed or been reported by local media to have been targeted in cyberattacks since late September, prompting South Korean police to launch an investigation this week.","source_index":0,"grade":"C"}],"model":"deepseek-chat","prompt_version":"aggregate-2026-09-27.1","extracted_at":"2026-10-09","source_urls":["https://www.thevibes.com/articles/world/128084/ai-agents-used-in-cyberattacks-targeting-south-korean-banks-crowdstrike-says","https://live.euronext.com/en/financial-news/south-korean-banks-were-likely-hacked-chinese-based-actor-ai-agent-crowdstrike-says","https://www.thehindu.com/sci-tech/technology/china-based-suspect-used-ai-tools-in-south-korean-bank-hacks-says-crowdstrike/article71558258.ece/amp/"]}}