AI-powered hacking tools enabled a likely single attacker to breach multiple South Korean banks

Crowdstrike reports on an infrastructure hack in South Korea. A suspected Chinese-speaking attacker hit multiple South Korean financial institutions between late September and early October 2026, stealing large amounts of data. At Shinhan Bank alone, more than 25,000 records with names, contact details, income, and credit limits were stolen, according to Korean newspaper Khan. South Korea's financial regulator held an emergency meeting. President Lee Jae Myung called for a thorough investigation.

The attacker used ARTEX, a Chinese open-source tool first posted on GitHub in July that uses AI language models for automated penetration testing, meaning it finds security flaws on its own. The models behind it were DeepSeek v4.1-flash, GLM-5.3, and Grok 4.6. Researchers found Claude Code session logs on the attacker's open directories, showing searches for Telegram groups to sell stolen data.

Crowdstrike says the case shows how AI tools can let a single person pull off massive breaches in a short window, the kind of cybersecurity risk experts have been warning about for months. Just days earlier, Anthropic documented that GLM-5.3 can write exploits nearly on par with Mythos Preview, Anthropic's frontier model and the one that sparked the entire debate in late March 2026.