New to this? Read it in simple words
- CrowdStrike says an attacker used an AI hacking tool against South Korean banks.
- Data on more than 68,000 people leaked from at least seven firms.
- The tool, ARTEX, had been free for anyone to download.
- Its developer stopped public updates after the attacks.
- AI agent
- An AI that takes actions on its own to reach a goal, not only answers questions.
- Security testing
- Attacking your own systems, with permission, to find weak spots before criminals do.
- Closed-source
- Software whose code is kept private, so others cannot download or change it.
Since late September, several South Korean banks and savings banks have reported stolen customer data. On October 7, the security company CrowdStrike published its analysis of the attacks.
What CrowdStrike found
CrowdStrike says an unknown attacker used ARTEX, together with AI models, against South Korean financial organisations from late September to early October. It says data was taken, but it does not name the victims.
The ARTEX setup ran mainly on a DeepSeek model, with GLM and Grok models as well, CrowdStrike says. The attacker also used Claude Code. CrowdStrike thinks, with moderate confidence, that the attacker was a Chinese speaker who was after money.
The attacker was “not terribly sophisticated” but effective, Adam Meyers of CrowdStrike told Reuters.
From CrowdStrike’s analysis and reports by Reuters, AFP, The Record and Korea JoongAng Daily; the attacker is unknown.
The banks and the government
South Korea’s Financial Services Commission says data on more than 68,000 people leaked from at least seven firms, AFP reports. At Shinhan Bank, about 25,000 customers had their names, phone numbers, incomes and loan details taken.
The government says ARTEX was highly likely used. President Lee Jae-myung said AI makes hacking possible “even without specialized skills”. Police opened a formal case on October 6.
Regulators have also ordered financial firms to check their own security, Reuters reports.
The tool goes closed
ARTEX was an open-source project on GitHub, so anyone could download and run it. It uses several AI models as a team to probe systems for weak spots, a job that security testers do with permission.
On October 8, its developer wrote that, because of the misuse, the project would no longer be updated and would become closed-source. The developer said the misuse goes against what the tool was made for.
The reports describe the attacks as misuse of the tool by someone else.
Sources
Every fact in this story comes from the sources below. Open them to check our work.
- 1Primary source · October 7, 2026Unknown Threat Actor Uses AI-Driven ARTEX to Target South Korean Finance CrowdStrike
- 2Research · October 9, 2026South Korea and Japan are buffeted by hacks as AI lowers bar for cybercriminals Reuters, via NBC News
- 3Research · October 9, 2026Chinese AI tool pulled over ‘misuse’ fears after South Korea hacks AFP, via TRT World
- 4Research · October 6, 2026South Korean officials believe AI agents were used to hack several banks The Record
- 5
The link to ARTEX and the details of the attack are CrowdStrike’s findings, which South Korea’s government shares. The attacker has not been identified.
An open-source AI agent was used to hack South Korean financial firms, leaking data on more than 68,000 people. How we rate the mood