AI Agents Turn One Hacker Into Many Attackers

A suspected hacker used an AI agent, coding tools and a Chinese-developed penetration testing program in attacks against South Korean banks. The case shows how one person can run a wider campaign while leaving investigators with a new kind of digital evidence.

At least nine South Korean banks have disclosed or were reported to have been targeted since late September. CrowdStrike says the activity likely involved a 26-year-old China-based, Chinese-speaking actor who used ARTEX, an open-source AI agent for penetration testing, along with Anthropic’s Claude Code.

The assessment remains an attribution judgment rather than a criminal finding. CrowdStrike has described its confidence as moderate, and the individual has not been publicly identified. South Korean police are investigating. China’s foreign ministry said it was not familiar with the case and repeated that China opposes and combats hacking activity.

The reported campaign still matters even with those limits. It gives security teams a clear example of what happens when an AI system handles more of the work between an initial idea and a completed intrusion. The main change concerns scale. A lone operator can ask an agent to carry out a long sequence of tasks, review results, adjust its approach and move toward another target with far less manual effort.

CrowdStrike linked infrastructure and AI coding sessions to attacks aimed at South Korean financial institutions. The company said the suspected actor used Chinese-language prompts, ARTEX and large language models, including Claude. The sessions reportedly included requests for information about where Korean breach data might be sold and how to find Korean Telegram groups involved in data sales.

CrowdStrike also found a request for a security researcher resume. The resume included a Telegram account, an age, educational details and a location in Maoming, a city in China’s Guangdong province. Investigators believe those details may belong to the attacker. A man who answered a phone number included in the report said he had no knowledge of the matter.

The reported victim impact varied. Shinhan Bank said personal information connected to about 25,000 customers was compromised. KB Kookmin Bank said information belonging to 119 customers was leaked. Those figures represent disclosed cases and may change as banks and authorities examine the activity.

The campaign has prompted a police investigation and a call from President Lee Jae Myung for a strong response. Banks now face the difficult task of determining which systems were accessed, what information left those systems and whether related attempts are still under way.

CrowdStrike says a suspected China-based, Chinese-speaking actor used the ARTEX AI penetration-testing agent, Claude Code and other large language models in a campaign targeting at least nine South Korean banks. The reported activity illustrates how AI can let one person automate and repeat complex attack tasks at greater scale, while also creating a new evidence trail in prompts, tool calls and coding-session records. The attribution remains provisional, and the case highlights the need for banks to monitor automated behavior, restrict agent access and preserve AI-related logs without creating additional privacy risks.

A conventional criminal still needs to perform several jobs during an attack: identify a target, study its exposed systems, write or adapt code, interpret errors, maintain access and move between systems. AI agents can connect those jobs into a repeatable workflow.

An agent can receive a broad goal and then break it into smaller assignments. It can generate code, inspect returned results, suggest the next step and keep records of what happened. A person remains involved, especially when an action carries a high risk of detection or requires a judgment call. The person can supervise several parallel workstreams instead of handling every command by hand.

Adam Meyers, CrowdStrike’s senior vice president of counter adversary operations, described the significance this way:

“This is significant because it allows one human to target many customers in a very short period of time using the power of AI.”

That change compresses the response window for defenders. A bank may have hours to recognize a pattern across different systems or subsidiaries. Several low-level probes that appear unrelated to individual monitoring tools can form part of one automated campaign when viewed together.

AI also helps an attacker work across language and technical barriers. An operator can ask a model to explain documentation, translate findings, draft code or organize information gathered from multiple targets. Each task may look ordinary in isolation. The combined workflow can still produce a coordinated attack.

AI-assisted attacks leave evidence in places that investigators have not traditionally treated as part of an intrusion. Server logs, malware samples, stolen files and network traffic remain important. Session histories from coding assistants and AI agents may reveal intent, task sequences and personal details as well.

In this case, CrowdStrike’s analysis reportedly included prompts sent to AI tools and infrastructure associated with the campaign. Those records helped investigators connect the use of ARTEX with the suspected operator’s language, location and possible criminal interests.

That evidence creates useful leads, but it also requires caution. A prompt can be written by an attacker, copied from another person or generated by an automated process. A location in a resume can be false. A Chinese-language tool and Chinese-language prompts can indicate a Chinese-speaking user without proving that the user operated from China or acted on behalf of any government.

Attribution depends on several pieces fitting together: infrastructure reuse, account activity, payment records, technical behavior, targeting choices and personal information. AI session logs may strengthen that picture while still leaving room for deception. Investigators will need to preserve those records and establish how they were obtained and linked to the bank incidents.

The logs also raise privacy questions. AI providers may hold sensitive prompts containing stolen data, internal network details or personal information. Banks and investigators need access to useful records without creating another repository of exposed customer information.

The next major cyber advantage will belong to whoever connects the signals fastest, not whoever writes the most sophisticated malware.

AI agents make repetitive probing and adaptation easier, so defenders need cross-system visibility and rapid correlation as much as they need stronger endpoint tools.

ARTEX was published on GitHub as an open-source AI agent for automated penetration testing. Its developer described it as a tool for personal learning, code research and local technical verification. The project also warned users against real-world testing against online systems or websites.

ARTEX is not a standalone large language model. It connects to external models such as ChatGPT, Claude and DeepSeek, allowing those systems to assist with security testing tasks. That architecture makes the tool useful for security professionals who want to automate repetitive checks. It also gives a motivated criminal a framework for organizing harmful activity.

The appearance of ARTEX in the bank campaign creates a familiar problem for defenders and software maintainers. Open tools can be published for legitimate reasons, then used outside their intended setting. A warning in a project description does not prevent misuse. Closing a project or restricting its distribution may reduce casual abuse while also limiting legitimate research and making the tool harder to inspect.

Security teams therefore have to track capabilities rather than labels. A program called a penetration testing assistant can become part of an attacker toolkit when it can discover systems, call an AI model, interpret output and continue a task. Vendor assessments need to cover those combinations, including the external AI services that the tool can access.

The reported use of ARTEX also shows why AI supply chains deserve attention. A bank may not install the tool itself, yet its systems can be tested by someone who uses it through public infrastructure, cloud services and third-party models. The exposure comes from the chain of services around the bank, not from a single application in its software inventory.

The immediate response begins with familiar security work: preserve logs, rotate exposed credentials, isolate affected systems, verify customer data access and coordinate with regulators and law enforcement. AI-assisted campaigns add several priorities.

These measures carry costs. Strict controls can slow legitimate development and make security testing less convenient. Banks need clear boundaries around production access, with faster automation allowed in isolated environments and tighter review applied when an agent reaches sensitive systems.

Cyber insurers are reviewing policies as AI agents become capable of taking actions with limited human supervision. Traditional language often centers on a hacker, an employee, a service provider or a defined cyber event. An autonomous system can sit across those categories.

The central questions are practical. Did a human direct the harmful act? Did a company configure an AI tool carelessly? Did a provider fail to block an abusive request? Did a third-party tool create the path into a bank? The answers could affect coverage, exclusions, notification duties and legal claims.

A bank may also face losses caused by a tool used by a contractor or vendor. Contracts will need clearer rules on AI use, logging, incident reporting and responsibility for generated code. Procurement teams will have to ask whether a vendor allows agents to connect to production systems and what happens when an external model retains prompts or tool outputs.

Insurance policies cannot solve the technical problem by themselves. They can, however, push organizations to document controls that are currently vague. A requirement to record AI activity, restrict agent permissions and test third-party tools gives security teams a basis for measurable improvements.

Model providers have to decide how much responsibility they carry when their systems help with security research and then appear in an attack. Blocking every request involving code or penetration testing would remove legitimate defensive uses. Ignoring repeated requests involving stolen data, criminal marketplaces or live targets would leave a predictable gap.

Useful safeguards include abuse monitoring, rate limits, stronger identity checks for high-risk capabilities and rapid channels for security investigators. Providers also need policies for retaining and sharing relevant logs. Those policies have to protect users while allowing evidence to be preserved when a serious incident is under investigation.

Governments face a related coordination problem. South Korean police, financial regulators, banks, cloud providers and AI companies may each hold only part of the evidence. Fast information sharing can help connect separate incidents, but cross-border investigations add legal and diplomatic limits.

The case also raises a question about responsible release. An open-source security agent can help defenders test systems that would otherwise receive little attention. It can also make advanced automation available to people with limited experience. Developers may respond with access controls, reduced capabilities or a move away from public releases. Each choice affects security research as well as abuse.

The South Korean bank attacks show why AI agents belong in incident planning now. The key risk comes from the agent’s ability to repeat a process across many targets while a human supervises from a distance. That pattern can produce more attempts, more varied infrastructure and a shorter gap between discovery and exploitation.

CrowdStrike’s findings remain an assessment, and the investigation may change the picture. The reported use of ARTEX, Claude Code and other AI services still offers a concrete warning. Security teams need visibility into model sessions, third-party tools and automated actions alongside ordinary network telemetry.

The banks involved will focus on customer records and system integrity. Other organizations should study the operating pattern: one person, several tools, many targets and an evidence trail spread across infrastructure owned by different companies. That combination will shape the next phase of cyber defense, insurance and software governance.