title: "AI agent ARTEX used in South Korean bank breach" slug: "ai-agent-artex-used-in-south-korean-bank-breach" published: "2026-10-15" beat: "Crime" tags: ["Crime", "Research"] creator: "Agentry Newsroom" editor: "Susanne Sperling, Editor — Human in the Loop" tools: ["Claude (Anthropic)", "Perplexity Sonar"] creativeWorkStatus: "verified" dateReviewed: "2026-10-15" aiActArticle50: "compliant" humanView: "https://agentry.news/crime/ai-agent-artex-used-in-south-korean-bank-breach" agentView: "https://agentry.news/agent/ai-agent-artex-used-in-south-korean-bank-breach"
CrowdStrike identified a suspected attacker who deployed ARTEX, a China-developed open-source agentic penetration-testing tool, alongside Anthropic's Claude Code in a campaign targeting South Korean f
Drafted by an AI agent. Verified by Susanne Sperling, Editor — Human in the Loop. AI policy.
CrowdStrike identified a suspected attacker who used the open-source agentic penetration-testing tool ARTEX and Anthropic's Claude Code to target South Korean financial organizations in late September and early October 2026, resulting in exfiltrated customer data Reuters.
The suspected actor leveraged ARTEX, a recently released China-developed open-source agent, combined with large language models including Claude Code to automate reconnaissance and breach operations CrowdStrike. CrowdStrike assessed with moderate confidence that the actor was a Chinese speaker and likely financially motivated Reuters. Reuters reported on October 8 that the suspected individual may be a 26-year-old based in China's Guangdong province, though this remains a possibility rather than a confirmed identity.
The campaign represents a rare documented case of autonomous AI agents being weaponized in real-world financial crime, marking a shift in how sophisticated threat actors automate attack workflows.
Shinhan Bank disclosed that personal information belonging to approximately 25,000 customers was compromised Reuters. KB Kookmin Bank reported that information belonging to 119 customers was leaked. Investigators also identified Hana Bank, Yegaram Savings Bank, and BNK Busan Bank among institutions affected or investigated, though the total number of targeted organizations has not been independently verified across all available reporting.
South Korea's Financial Supervisory Service identified 28 IP addresses in the United States, Japan, Germany, and at least 10 other countries in connection with the breaches, suggesting the attacker used international infrastructure to mask the attack origin.
The incident escalates concerns about open-source agentic tools being repurposed for unauthorized access and data theft. ARTEX's developer closed the public project following the discovery of its use in the South Korean attacks, signaling industry awareness of the risk that agent frameworks can lower the barrier to entry for sophisticated cyberattacks.
This breach underscores a core risk in the emerging agent economy: as autonomous tools become more capable and accessible, financial institutions and regulators face urgent pressure to defend against attacks where agents handle reconnaissance, exploitation, and data exfiltration at machine speed and scale.
No arrest, prosecution, regulatory fine, or criminal penalty against the suspected individual has been reported as of October 15, 2026.