Cases › security breach › LR-2026-0140
AI agent (ARTEX with Claude) used in cyberattacks targeting South Korean banks
Whose AI: Anthropic · Claudesecurity breach
Severity major: At least nine South Korean banks were targeted and South Korean police launched an investigation.
Happened 2026-09-30 · Earliest source we hold 2026-10-05, 5 days later
An attacker targeting South Korea's financial sector used ARTEX, a Chinese-developed open-source AI agent for automated penetration testing, alongside large language models including Anthropic's Claude, in a campaign against South Korean financial institutions from late September to early October.
Risk grouping: AI used to exploit
| Who caused it | A person or organisation “CrowdStrike assessed that a probably China-based, Chinese-speaking actor used the Chinese-developed ARTEX autonomous penetration-testing agent and Claude Code against South Korean financial institutions.” source |
|---|---|
| Intended or not | Intended “Malicious actors, however, have repurposed the technology to identify weaknesses and orchestrate real attacks.” source |
| Before or after release | After release “This is the first large-scale, documented case of an AI penetration-testing agent breaching real banks in production, and it took one person in Guangdong, not a nation-state unit, to pull it off.” source |
| The AI's part | Used as a tool “Adam Meyers, senior vice president of counter adversary operations at CrowdStrike, told reporters on a call on Thursday that this was an example of a human adversary leveraging AI agents to conduct widespread attacks.” source |
The story
1 · What it was doingAn attacker used ARTEX, an open-source AI agent for automated penetration testing, together with large language models including Claude, to target South Korean financial institutions from late September to early October.
2 · What went wrongThe AI tools were used to support cyberattacks against South Korean banks, breaching those institutions' systems and compromising customer personal information.
3 · What it reached or didAt least nine South Korean banks were targeted; Shinhan Bank had about 25,000 customers' personal information compromised and KB Kookmin Bank had 119 customers' data leaked.
4 · How it was caughtCrowdStrike, an outside cybersecurity firm, uncovered the activity while analysing AI coding-tool sessions and infrastructure associated with the campaign.
5 · What was doneSouth Korean police launched an investigation this week, and President Lee Jae Myung called for robust response measures.
What the sources state
- What set it off misused by a person
Others like this
ARTEX autonomous penetration-testing agent used in attacks on South Korean financial institutions 2026-10-21
Shinhan Bank data breach with suspected AI-assisted intrusion 2026-10-05
AI agent breach of KB Kookmin Bank mobile work support system 2026-10-04
China-linked autonomous AI agent Artex used in cyberattacks on Japanese and South Korean firms 2026-10-20
Show every field, with its source and grade
The AI system
Model
Claude
C one secondary source states it
Developer
Anthropic
C one secondary source states it
Software around the model
ARTEX
C one secondary source states it
Tools it was given
automated penetration testing, penetration testing
C one secondary source states it
Whose system
company using AI
D inferred by us from the described behaviour, reason shown
How it was connected
agentic with tools
C one secondary source states it
What it was for
automated penetration testing
C one secondary source states it
Meant for live use
yes
C one secondary source states it
What happened
When it happened
2026-09-30
C one secondary source states it
Earliest source we hold
2026-10-05
A the date the source itself carries
What set it off
misused by a person
C one secondary source states it
Who caught it
an outside party
D inferred by us from the described behaviour, reason shown
Themes
AI agent, cyberattack, financial sector, data breach, South Korea, penetration testing
C one secondary source states it
Who caused it
an outside attacker
C one secondary source states it
Earlier warning signs
Sept. 17 seminar on AI-agent attack on a domestic lender
C one secondary source states it
What went wrong
security breach
D inferred by us from the described behaviour, reason shown
AI agent
an AI agent acted
C one secondary source states it
Impact
Severity
major
D inferred by us from the described behaviour, reason shown
Kind of harm
privacy, money, others' security
C one secondary source states it
Who was affected
At least nine South Korean banks; about 25,000 Shinhan Bank customers and 119 KB Kookmin Bank customers
C one secondary source states it
Kinds of data exposed
personal information
C one secondary source states it
Why this severity
At least nine South Korean banks were targeted and South Korean police launched an investigation.
D inferred by us from the described behaviour, reason shown
Context
Industry
Finance and Insurance
C one secondary source states it
Country
South Korea
C one secondary source states it
Shared model
DeepSeek v4.1-flash
C one secondary source states it
Logs kept
CrowdStrike Intelligence report dated October 7, 2026, based on exposed directories containing Claude Code session histories, ARTEX configuration files, and Claude memory files.
C one secondary source states it
Investigated
by a paid outside firm
C one secondary source states it
Notices made
The Financial Services Commission, the Financial Supervisory Service and the FSI joined forces to investigate the AI-powered breach and monitor whether other private sector institutions had also been affected.
C one secondary source states it
LR-2026-0140 · version 10 · published 2026-10-25 after automatic checks; not yet checked field by field by a person · changes to this case · JSON