CrowdStrike says a China-based actor used an AI penetration-testing agent, paired with Anthropic’s Claude Code and several large language models, to break into South Korean financial institutions over roughly two weeks in late September and early October 2026. The firm’s intrusion analysis, published on its blog, ties the campaign to a tool called ARTEX, an open-source, China-developed agentic pentesting framework that CrowdStrike says the attacker used to find weaknesses in exposed banking services and move toward exfiltrating data.
Reuters was first to carry the story under the headline “South Korean banks were likely hacked by a China-based actor with an AI agent, CrowdStrike says,” and the news has since been picked up by The Economic Times, Fox Business, and The Straits Times. South Korean outlet Yonhap added additional detail, reporting that CrowdStrike assessed with “moderate confidence” that the attacker is a Chinese speaker who was likely financially motivated, rather than a state-directed operator.
This disclosure builds directly on an admission South Korea’s own government made days earlier, when officials confirmed they were probing AI use in a wave of bank hacks whose stolen data, Deutsche Welle reported, potentially affected 68,000 customers. CrowdStrike’s report is the first to put a specific tool name, ARTEX, and a specific AI coding assistant behind that general suspicion.
Don't miss new tech stories on Google
Add Tech Insider once in the Google app and our stories appear in your news suggestions.
What CrowdStrike Actually Found
According to CrowdStrike’s write-up, the attacker left behind an open directory on infrastructure tied to the intrusion. Inside that directory, CrowdStrike’s researchers found Claude Code session histories, ARTEX configuration files, and Claude memory files. In the company’s own words, that material provided “direct insight into the threat actor’s operational methodology and tooling.” That is an unusually clean forensic break: instead of inferring tradecraft from malware samples alone, CrowdStrike says it could watch, after the fact, how the attacker actually used AI tools during the operation.
CrowdStrike describes ARTEX as “a recently released open-source agentic penetration testing (pentesting) tool developed in China,” used here “alongside large language models (LLMs).” Yonhap’s reporting adds a layer of specificity that CrowdStrike’s own post does not spell out in full: the LLM doing most of the heavy lifting was reportedly DeepSeek v4.1-flash, a fast, low-cost model that has been benchmarked against rivals like Claude Haiku 5.5, supplemented by GLM-5.3 and Grok 4.6, all accessed through Claude Code sessions rather than through a single dedicated interface. That detail matters, because it shows an attacker treating large language models as interchangeable utility infrastructure, swapping between a Chinese model, a US-based coding harness, and other general-purpose systems as the task demanded, rather than depending on one AI vendor’s product.
CrowdStrike also pointed to a specific piece of attacker infrastructure in its report: the IP address 38.244.50[.]120, which hosted an ARTEX instance and an open directory containing a Claude Code markdown document at the path /.claude/CLAUDE.md. That file is the kind of project-context note any developer using Claude Code would create to steer the assistant’s behavior across a session, and its presence on attacker-controlled infrastructure is part of what let researchers reconstruct the operator’s workflow.
Who Got Hit, and How Badly
Press reporting around the CrowdStrike findings names several South Korean financial institutions caught up in the broader wave of breaches that this campaign is tied to, including Shinhan Bank, KB Kookmin Bank, Hana Bank, and Yegaram Savings Bank. Not every one of those institutions has been clearly linked, in public reporting, to the specific ARTEX-and-Claude-Code campaign CrowdStrike describes. Some reporting treats them as part of a wider cluster of 2026 South Korean financial-sector incidents that investigators are still working to separate and attribute. What is on the record: Shinhan Bank disclosed a breach affecting roughly 25,000 people, and Yegaram Savings Bank disclosed one affecting about 40,000 people, according to reports cited by Yonhap. KB Kookmin Bank reported data exposure involving 119 customers, and Hana Bank disclosed a leak affecting 89 people, according to Chosun Biz.
CrowdStrike’s own language is deliberately narrow on scale and victim count: the company says the activity targeted South Korean financial organizations and “resulted in exfiltrated data,” without publishing a final tally of how many institutions were compromised or how many records left the network. Secondary reporting has floated a figure of roughly seven financial firms touched by the broader campaign, but that number has not been confirmed directly by CrowdStrike in its public post, so it should be read as a reported estimate rather than a verified count.
South Korean financial authorities and investigators have opened probes into the incidents, per Reuters and Yonhap, and the Financial Services Commission (FSC) said 16 financial firms were hit by suspected AI-agent attacks, though neither the FSC nor the Financial Supervisory Service has issued a detailed public statement confirming the CrowdStrike attribution, denying it, or laying out a remediation timeline. Regulators had already ordered security checks across the banking sector after four separate breaches surfaced in the same window, a response that predates CrowdStrike’s technical findings and will likely be revised once they are fully absorbed. None of the named banks has published a detailed account of the intrusion vector, which means the technical chain between “AI agent scans for weaknesses” and “customer data leaves the bank” is still CrowdStrike’s reconstruction, not a bank-confirmed narrative.
Why an AI Pentesting Agent Changes the Math
Penetration testing tools, the kind security teams use to find their own weaknesses before attackers do, have existed for decades. What is new here is agentic behavior: a tool that can be pointed at a target, run its own reconnaissance loop, decide which weaknesses look exploitable, and move to the next step largely on its own, with a human checking in periodically rather than typing every command. CrowdStrike frames ARTEX exactly that way, as “a recently released open-source agentic penetration testing (pentesting) tool,” distinct from older automated scanners that just run a fixed battery of checks and hand a report back to a human. Tech Times reported that ARTEX could autonomously perform 4 stages: reconnaissance, discovery, attack, verification.
Layer Claude Code on top of that, and the attacker gets something closer to a junior security engineer who never sleeps: a coding assistant that can write custom exploitation scripts, adapt them when the first attempt fails, and keep a running memory of what has already been tried against a given target. CrowdStrike’s discovery of Claude memory files alongside ARTEX configs suggests the attacker was using Claude Code’s session continuity, not just one-off code generation, to carry context across what was likely a multi-day operation against each target.
That is a meaningfully different threat model from the one most security teams planned around a year ago, when “AI and cybercrime” mostly meant better phishing emails and faster malware obfuscation. This campaign, as CrowdStrike describes it, used AI tooling deeper in the kill chain: for vulnerability discovery and exploitation support, not just the social-engineering front end. It does not mean an AI agent independently decided to rob a bank. A human operator was directing ARTEX and Claude Code, reviewing output, and presumably deciding what to exfiltrate. But the labor that used to require a skilled team now appears to have been compressed, in this case, to something closer to one operator working with AI-assisted tooling.
A Profile, Not a Name: The 26-Year-Old Question
The Economic Times ran with the detail that the suspect behind the South Korea bank hacks “may be” a 26-year-old based in China, a framing CrowdStrike itself keeps carefully hedged. The company’s assessment, per Yonhap’s reporting, is that the actor is likely a Chinese speaker and “likely financially motivated,” reached with moderate confidence based on the use of the Chinese-developed ARTEX tool and observed Chinese-language prompts in the recovered session data. CrowdStrike has not named a specific individual, has not confirmed a nationality through identity documents or arrest, and has not linked the activity to a known threat-actor group with an established designation.
That distinction matters for how this story should be read. “Likely a Chinese speaker, likely financially motivated, moderate confidence” is an intelligence assessment built from technical artifacts, language patterns in prompts, and tool provenance. It is not a legal finding, an indictment, or proof of state sponsorship. CrowdStrike’s own phrasing avoids tying the actor to the Chinese government, describing financial motivation rather than espionage as the likely driver. Readers should treat the “26-year-old” detail the same way: as a profile characteristic surfaced in reporting, not a confirmed identity.
How This Compares to Other 2026 AI-Misuse Cases
This is not the first time in 2026 that a major AI lab or security vendor has had to explain its tools showing up inside an active attack. Anthropic has previously disclosed cases where its Claude models were abused in espionage-linked operations, and it has built out detection and account-banning processes specifically because its coding tools keep surfacing in attacker toolchains. The South Korean banking campaign fits that same pattern: a mainstream, legitimate AI product being pulled into an intrusion not because it was built for crime, but because it is a capable general-purpose coding and reasoning tool that lowers the skill floor for writing working exploit code. It also echoes an earlier 2026 finding that GLM-5.3, one of the models reportedly used in this campaign, could be prompted to write exploit code while bypassing its own safety guardrails, a vulnerability researchers warned would eventually surface in a live intrusion.
The table below lines up what is distinct about this campaign against the more familiar AI-enabled attack patterns security teams have been tracking through 2026.
| Comparison point | South Korea bank campaign (ARTEX + Claude Code) | Typical 2026 AI-assisted attack pattern |
|---|---|---|
| Primary AI role | Vulnerability discovery and exploitation support via an agentic pentest tool | Phishing content generation, malware obfuscation, translation |
| Tooling observed | ARTEX (agentic pentesting framework), Claude Code, DeepSeek v4.1-flash, GLM-5.3, Grok 4.6 | Single chatbot interface for drafting lures or code snippets |
| Evidence source | Recovered Claude Code session histories and ARTEX configs from an open directory | Malware samples, phishing kit analysis, infrastructure takedowns |
| Attribution confidence | Moderate confidence, Chinese-speaking, financially motivated | Varies; often tied to known criminal or state-linked clusters |
| Target sector | South Korean banks and savings institutions | Broad, often opportunistic across sectors |
| Disclosed by | CrowdStrike, independently corroborated by Yonhap and Reuters | Varies by vendor (Anthropic, Microsoft, Google) |
The common thread across these disclosures is that AI vendors and security firms are now routinely finding their own products inside the forensic record of live attacks. That is a shift from 2024 and early 2025, when most “AI and cybersecurity” coverage was speculative. By late 2026, it is documentary: session logs, config files, and memory artifacts recovered from attacker infrastructure.
South Korea’s Rough 2026 for Financial-Sector Security
This disclosure lands at the end of a difficult stretch for South Korean financial-sector security. The late-September-to-early-October window CrowdStrike describes overlaps with a cluster of breach disclosures from Shinhan Bank, KB Kookmin Bank, Hana Bank, and Yegaram Savings Bank, though public reporting has not cleanly separated which of those incidents trace back to the specific actor and tooling CrowdStrike profiled versus which belong to other, unrelated intrusions happening in the same window. South Korean authorities and investigators have opened inquiries into the broader pattern, according to Yonhap and Reuters, but neither the FSC nor the FSS has published a consolidated public accounting of which institutions were affected or what remediation steps have been mandated, and the Korea Times reported about 100,000 personal records exposed.
That ambiguity is itself a data point. When a security vendor’s technical disclosure runs ahead of the affected sector’s regulatory response, it usually means investigators are still working through attribution and scope internally before committing to a public number. It also follows a pattern seen elsewhere in South Korea’s financial sector this year, including the Hyundai Capital breach that exposed data tied to 146 loan agents, where the full scope only became clear well after the initial disclosure. Readers should expect the picture to firm up over the coming weeks as the FSC, FSS, or individual banks issue their own statements, and treat any current victim count as provisional.
The Open-Directory Mistake That Exposed the Attacker’s Playbook
One detail in CrowdStrike’s report deserves more attention than it has gotten in the wire coverage: the attacker’s own operational security failure is what made this disclosure possible. An open, unauthenticated directory on infrastructure at 38.244.50[.]120 left ARTEX configuration files, Claude Code session histories, and Claude memory files sitting in plain view. CrowdStrike did not need to reverse-engineer a binary or crack an encrypted command-and-control channel. It found a misconfigured web server exposing the attacker’s own working notes.
That is a recurring irony in intrusion research: attackers who are sophisticated enough to chain an agentic pentesting tool with multiple large language models still make basic infrastructure mistakes, like leaving a directory listing enabled on a server hosting live attack tooling. It is also a reminder for defenders that attacker AI usage leaves a different kind of forensic trail than traditional malware. A Claude Code markdown file at /.claude/CLAUDE.md is not a binary signature any antivirus engine was built to catch. Finding it required someone to notice an exposed directory and recognize what the file formats meant.
What Banks and Security Teams Should Take From This
For financial-sector security teams, the practical lesson is less about banning AI coding tools and more about updating what “normal” attacker behavior looks like. A vulnerability scan that used to take a human team days to run against an exposed banking service can now be compressed by an agentic tool working semi-autonomously. Exposed services that security teams judged low-priority because exploiting them required sustained manual effort may now be reachable faster by an attacker leaning on the same category of coding assistant their own developers use.
That argues for two concrete shifts: first, treating internet-facing services with the assumption that reconnaissance and initial exploitation attempts can now arrive at AI-agent speed rather than human-manual speed, and second, building detection that looks for the kind of artifacts CrowdStrike found, agentic tool configs, AI session logs, memory files, on infrastructure that touches the organization’s perimeter, rather than only hunting for classic malware signatures.
Market and Industry Reaction
The disclosure adds to a 2026 narrative that has been building for months: AI security vendors and AI model providers are increasingly the ones surfacing misuse of their own products, rather than discovering it secondhand from a breached customer. That has commercial implications on both sides. For CrowdStrike and competing threat-intel vendors, demonstrating the ability to pull a coherent attacker narrative out of recovered AI session logs is a selling point for enterprise threat-hunting contracts, particularly in a sector like South Korean banking that is now visibly under pressure. CrowdStrike said on October 7, 2026 that its AI Detection and Response (AIDR) business had grown more than 79-fold in three quarters since launch, and it identified Falcon Guardian as the product securing AI agents at execution time. For AI model providers, including Anthropic, DeepSeek’s operators, and others whose models reportedly appear in the toolchain, the story reinforces an uncomfortable reality: usage-based API access makes it hard to fully gate who runs an agentic workflow against a bank’s infrastructure, regardless of the provider’s own misuse policies.
None of the companies named in connection with the tooling, including Anthropic, have been reported as providing direct support to the attacker. The models and coding tools were used by an outside party against terms of service, which is the same pattern Anthropic has described in its own past disclosures about Claude being abused in intrusion operations. The episode arrives as regulators scrutinize this exact seam: the FTC has opened a probe into how OpenAI, Anthropic, and other AI agent providers police misuse of their platforms, and a documented case of a bank-targeting criminal campaign running through Claude Code is the kind of evidence that inquiry is likely to examine.
Historical Context: From Scanners to Agents
Automated vulnerability scanning is not new. Tools like Nmap and Nessus have automated reconnaissance for two decades, and criminal groups have used off-the-shelf exploitation frameworks for almost as long. What has changed by late 2026 is the layer above that automation: instead of a human selecting which scanner to run and interpreting its output, an agentic tool like ARTEX can chain discovery, triage, and exploitation attempts with less moment-to-moment human direction, and a coding assistant like Claude Code can generate or adapt exploit code on demand rather than requiring the attacker to already know how to write it.
That progression mirrors what happened on the defensive side first: security teams have spent the last two years adopting AI-assisted triage and automated remediation to keep pace with alert volume. This campaign is a reminder that the same underlying capability shift, AI agents that can execute multi-step technical tasks with limited supervision, cuts both ways, and attackers are not waiting for the technology to mature before putting it to use.
Data Snapshot: The Campaign at a Glance
| Detail | What is reported |
|---|---|
| Disclosed by | CrowdStrike |
| Campaign window | Late September to early October 2026 |
| Primary tool | ARTEX (China-developed agentic pentesting tool) |
| AI coding assistant involved | Anthropic’s Claude Code |
| LLMs reportedly used through Claude Code sessions | DeepSeek v4.1-flash, GLM-5.3, Grok 4.6 (per Yonhap) |
| Attacker profile | Likely Chinese-speaking, likely financially motivated (moderate confidence) |
| Named institutions in related reporting | Shinhan Bank, KB Kookmin Bank, Hana Bank, Yegaram Savings Bank |
| Shinhan Bank disclosed impact | Approximately 25,000 people affected |
| Yegaram Savings Bank disclosed impact | Approximately 40,000 people affected |
| Confirmed CVE | None identified in CrowdStrike’s public reporting |
| Key forensic evidence | Open directory on attacker IP 38.244.50[.]120 containing ARTEX configs and Claude Code session/memory files |
What CrowdStrike and Industry Voices Are Saying
CrowdStrike’s own language in its disclosure is unusually precise about what the evidence does and does not show. The company says that while the activity “has not been attributed to a named adversary, the threat actor is likely a Chinese speaker and financially motivated,” a framing Reuters carried directly from the firm’s assessment. CrowdStrike adds that this judgment “is made with moderate confidence based on the use of the Chinese-developed tool ARTEX and observed Chinese-language prompts,” according to Yonhap’s coverage of the disclosure.
On the tooling itself, CrowdStrike’s blog states plainly that “in this activity, the threat actor leveraged ARTEX, a recently released open-source agentic penetration testing (pentesting) tool developed in China, alongside large language models (LLMs).” The company also describes exactly what its researchers recovered once they located the attacker’s exposed infrastructure: “Analysis of threat actor-controlled open directories uncovered Claude Code session histories, ARTEX configuration files, and Claude memory files, providing direct insight into the threat actor’s operational methodology and tooling.” CrowdStrike’s report further pins the infrastructure down to a specific address, noting that “the IP address 38.244.50[.]120 was associated with the activity described and hosted an ARTEX instance and open directory containing a Claude Code markdown document at http[:]//38.244.50[.]120:18899/.claude/CLAUDE.md.” All five statements come directly from CrowdStrike’s published blog post and Yonhap’s sourced reporting on it.
Predictions: Where This Goes From Here
A few things look likely to follow from this disclosure. First, expect South Korea’s Financial Services Commission and Financial Supervisory Service to face pressure to issue a consolidated public statement on scope and remediation, given that four separate institutions have now been named in connection with the broader breach wave, even if not all four are confirmed to trace to the same actor. Second, expect AI vendors, Anthropic in particular, to face renewed scrutiny over how agentic coding tools get misused once sold through standard API access, since Claude Code’s presence in the forensic record here echoes patterns the company has disclosed before.
Third, expect other threat-intel vendors to publish their own findings on ARTEX specifically, since an agentic pentesting tool with documented real-world criminal use, which its developer has reportedly since converted to closed source, is the kind of artifact competing firms will want to fingerprint and track independently. Fourth, expect South Korean banks broadly, not just the four named here, to accelerate reviews of internet-facing services, given how directly this campaign appears to have targeted exposed banking infrastructure. Fifth, expect continued ambiguity for some time on the exact victim count and financial impact, since published counts still differ, from 7 institutions in Dong-A Ilbo to at least 9 banks in Reuters and 16 firms from the FSC, and neither CrowdStrike nor South Korean regulators have published a final, reconciled figure.
The Bottom Line
What CrowdStrike has actually confirmed is narrower than some of the wire-service framing suggests: a likely Chinese-speaking, financially motivated actor used an agentic pentesting tool and multiple AI coding and reasoning models to target South Korean financial organizations, resulting in exfiltrated data, with moderate-confidence attribution and no named individual, no confirmed nationality, and no established link to a state actor. What is not in question is the forensic trail CrowdStrike recovered: real Claude Code sessions, real ARTEX configuration files, and a real exposed server that let researchers reconstruct how the operation actually ran. That combination, a criminal workflow built on mainstream AI tooling and caught through an attacker’s own operational security mistake, is likely to be a template other security vendors reference for the rest of 2026.
FAQ
Did an AI agent hack South Korean banks on its own?
No. CrowdStrike’s reporting describes a human operator using an agentic pentesting tool, ARTEX, alongside Claude Code and other LLMs as components of the intrusion. The evidence shows AI-assisted tooling embedded in the attack workflow, not an autonomous AI-run operation.
Which banks were affected?
Reporting around the disclosure names Shinhan Bank, KB Kookmin Bank, Hana Bank, and Yegaram Savings Bank in connection with the broader wave of incidents. Shinhan Bank disclosed impact to roughly 25,000 people and Yegaram Savings Bank to roughly 40,000 people, according to Yonhap’s reporting. CrowdStrike’s own post does not publish a consolidated victim count.
What is ARTEX?
CrowdStrike describes ARTEX as a recently released, open-source, agentic penetration-testing tool developed in China, used in this campaign to help discover and exploit weaknesses in exposed services.
Was Claude Code or Anthropic responsible for the attack?
No. CrowdStrike’s findings show the attacker used Claude Code, Anthropic’s coding assistant, as a tool during the operation, alongside other LLMs including DeepSeek v4.1-flash, GLM-5.3, and Grok 4.6. Anthropic has previously disclosed and acted against similar misuse of its models in other intrusion cases.
Is the attacker confirmed to be a specific 26-year-old in China?
No. That detail reflects a profile characteristic in some reporting, not a confirmed identity. CrowdStrike’s own assessment is a moderate-confidence judgment that the actor is likely a Chinese speaker and likely financially motivated, without naming an individual or confirming nationality through any legal process.
Has the Chinese government been linked to this attack?
No. CrowdStrike’s reporting ties the tooling’s origin to China and assesses the operator is likely a Chinese speaker, but it characterizes the motive as financial rather than state-directed espionage, and does not attribute the activity to the Chinese government.
What should other financial institutions do in response?
Security teams should assume reconnaissance and exploitation of exposed services can now move at AI-agent speed, and should build detection for agentic tool artifacts, such as unusual coding-assistant session files or configuration data, on infrastructure touching their perimeter, not only for traditional malware signatures.
Has CrowdStrike identified a CVE tied to this campaign?
No specific CVE has been identified in CrowdStrike’s public reporting on this campaign.
