A server in the attack path of South Korea's bank breaches sat with its directories open to the internet. Inside were Claude Code session logs, ARTEX configuration files, AI memory files, a Chinese-language prompt document explaining how to run a penetration test, and a list of nine proxy IP addresses. CrowdStrike's threat intelligence unit published its read on that material on October 7, and the finding is blunt: a single financially motivated operator chained together several AI tools to break into seven Korean financial firms and reach roughly 66,000 customers between late September and early October.
The company's analysts did not find the evidence through malware fragments or server forensics alone. The attacker's own instructions were sitting in a folder that anyone with a browser could have read, because a large language model has to be told what to do in writing. AI made the intrusion faster, and it also turned the attacker's planning into a document that investigators could simply open.
That is why this story matters now. Korea's National Assembly has summoned the heads of the five biggest commercial banks to an annual audit on October 19, police are still working out whether one person or a group was behind the wave, and the banks have not yet explained publicly how peripheral systems carried the damage. Three days before CrowdStrike's report went out, Japan's National Cybersecurity Office told companies to treat cyber defence as a management problem rather than an IT one. Two governments are now in the same week asking the same question about AI-assisted intrusion.
What ARTEX actually does
ARTEX is an open-source AI penetration-testing agent built in China, published by a developer using the GitHub account Autumn-27. It runs autonomously: the agents look for and exploit weaknesses in specific services without a human walking them through each step. CrowdStrike's analysis found ARTEX running mainly on DeepSeek v4.1-flash, accessed through a reseller, with Zhipu AI's GLM-5.3 and xAI's Grok 4.6 wired in as helper models during other sessions.
Anthropic's Claude Code appears too, run by the attacker on their own infrastructure. Anthropic's systems were not breached; the attacker used the coding agent the way anyone else would, as a tool on a rented machine. Anthropic declined to comment publicly on how much of the intrusion itself leaned on Claude models, and that gap is real: the logs show Claude Code sessions running alongside other models, so nobody outside CrowdStrike can say which model did which piece of the job.
After the report came out, the ARTEX developer made the repository private and stopped public releases, citing misuse. Closing the source is a reasonable reaction and also an incomplete one. Copies already downloaded under the open licence keep running, and the point of an autonomous pentest agent is that the operator who has a working copy does not need the author's blessing. Security Affairs reported the shutdown; the practical effect on copycats is close to zero.
The chain-of-command question is the one that has no clean answer yet. ARTEX's developer published a tool for people who are authorised to test systems. The DeepSeek, GLM and Grok models were reached through normal commercial or reseller access. Claude Code was used inside its terms of service, on the customer's own machine. Every link in the chain was a legitimate product, and the output was 66,000 exposed customers. Regulators in Seoul and Tokyo are both now looking at where, if anywhere, responsibility attaches.
The systems that fell were the boring ones
None of this landed on a core banking platform. At one bank the intruder got into a loan-status lookup service used by outside loan brokers. At another it was a mobile work app for employees. These are exactly the systems that get described as internal tooling, funded last, patched rarely, and treated as outside the perimeter because they are not the product.
CrowdStrike's assessment is that the AI tooling let one operator break into many targets in a short window. The timing supports that. Four banks were attacked in near-simultaneous fashion from the same IP address, which is not the pattern of a patient, methodical crew working one target at a time. It is the pattern of an agent loop firing at scale while the operator watches.
The logs also show what happened after the intrusions. The attacker asked Claude where stolen Korean data is usually sold, and how to find Korean-language Telegram groups that trade in it. The same Telegram account showed up in sessions probing a Chinese payment platform and a Telegram-based NFT gift exchange, which suggests the monetisation side was being explored in parallel rather than after the fact. The operator was not just inside the bank's network; they were already shopping the merchandise.
Korea's financial regulator and the affected firms put the figure at about 66,000 customers across seven companies. Foreign reporting has only partial bank-by-bank numbers, with Shinhan alone cited at roughly 25,000. The gap between the two counts is a reporting artifact, not a sign the breach shrank, but it means the full picture will not be public for a while.
The resume prompt
The strangest item in the exposed folders is a request for the AI to write a "security researcher" resume highlighting achievements with ARTEX. The prompt contained a name given as "YY", a degree from South China University of Technology, a home in Maoming in Guangdong, an age of 26, and a Telegram handle.
CrowdStrike treats those details as likely belonging to the attacker, with moderate confidence, and stops short of confirming identity. The stated age conflicts with a birth date entered earlier in the same session, September 2007. The Telegram handle appears in other attack sessions. No named group has been attached to the operation.
It is easy to read this as a criminal who could not help boasting. The more useful reading is that an operator running a dozen parallel AI sessions loses track of which one is the job and which one is the personal errand. The folder was open for the same reason the resume request existed in the first place: everything lived in one place, and nothing was cleaned up.
Where this leaves banks in the region
Japan's National Cybersecurity Office issued its notice on October 9, asking firms holding large amounts of personal data to tighten defences quickly, and it named three routes in: exploited web vulnerabilities, supply-chain compromise, and weak data management. The Liberal Democratic Party's cybersecurity headquarters met the same day, and its head, former digital minister Masaaki Taira, called the situation "an emergency in cyberspace." Seoul Economic Daily, quoting Kyodo, put it as "saturation attacks", the idea that AI lets an adversary repeat the same assault automatically at volume.
Bloomberg's summary of the Japanese move was blunter: security checks matter now because AI tools have lowered the barrier to large-scale hacking. That is the same conclusion as CrowdStrike's, reached from the government side.
The uncomfortable part is that none of this requires a new class of attack. A stolen set of credentials, a broker lookup service with no monitoring, and a mobile staff app that trusted its internal network were enough. The AI replaced the labour, not the technique. Banks that have spent the last decade hardening the core ledger while leaving the loan-status portal on the old TLS cipher suite have not been caught out by a novel threat; they have been caught out by arithmetic.
Whether Korea's parliamentary audit on October 19 produces a public account of how the peripheral systems were reached is the next thing to watch. Police have not said whether the investigation is proceeding against a named individual. Anthropic launched its Cyber Mission programme the same week to defend power grids and water systems, which reads as an effort to be on the right side of this argument before regulators finish writing it.
More desk coverage of intrusion and breach response is in our cybersecurity section.