Seven South Korean Banks Were Breached With an Open-Source AI Pentest Agent — Investigators Say a Human Was Still Driving It

Between 28 September and the first days of October 2026, intruders broke into at least seven South Korean financial institutions — Shinhan Bank, KB Kookmin Bank, Hana Bank, BNK Busan Bank, Yegaram Savings Bank, Welcome Savings Bank and Hyundai Capital — and walked out with the personal records of roughly 66,000 individuals, plus about 2,200 corporate records, according to figures the institutions disclosed and Korean outlets compiled. No money moved: the Financial Services Commission said the attackers took no passwords and no one-time authentication codes, and confirmed no customer had lost funds. What they took was the raw material for fraud — names, phone numbers, annual incomes, calculated borrowing limits, addresses and, at several firms, national ID numbers.

On 6 October 2026, President Lee Jae Myung told a cabinet meeting that "in some hacking incidents, signs have emerged of AI being used, causing considerable public concern and anxiety," according to Reuters, as quoted by American Banker. He did not name a model or a tool. Investigators already had one: ARTEX, an open-source autonomous penetration-testing system built to run multiple AI agents against a target. The Financial Security Institute's assessment, given to the Herald Business, is that the AI "did not act independently without human involvement."

The side doors, not the vault

None of the seven breaches reached core banking. Korean regulation requires banks' core systems to be physically separated from external networks, and the Financial Security Institute told the Herald Business that every attack it examined hit internal employee- or partner-facing systems instead. Those systems hold large volumes of customer data and, by the institute's own admission, "had been managed less rigorously" than the consumer apps.

• Shinhan Bank — a loan-progress lookup service built for loan recruiters, outside agents who refer borrowers. About 25,000 customers were affected, according to the bank's 1 October notice, which listed names, phone numbers, annual incomes and calculated borrowing limits. Korean outlets later put the figure at 25,727. Tech Times reported that 66 national ID numbers and 97 CI identifiers were also taken; those figures do not appear in the bank's notice.

• KB Kookmin Bank — an employee mobile work-support system. American Banker reported 99 customers and 20 current or former employees affected; Korean outlets reported a flat 119. Tech Times said names, phone numbers, addresses and encrypted national ID numbers were exposed, and that detection took about 43 hours.

• Hana Bank — an employee sales-support system known as ODS, exposing 89 customers: national ID numbers, names, addresses, email addresses and phone numbers, per Tech Times.

• BNK Busan Bank — web pages with "insufficient session validation," in the bank's words to Yonhap, exposing data on 11 outsourced developers.

• Yegaram Savings Bank — a server holding customer records; roughly 40,000 people, the largest single disclosed toll. The bank had already posted a notice that an unidentified hacker had gained access and caused a leak, the Herald Business reported.

• Welcome Savings Bank — more than 2,200 corporate customer records, according to the Kyunghyang Shinmun's compilation of the authorities' 4 October briefing.

• Hyundai Capital — the mortgage loan-solicitor lookup page, exposing 146 solicitors, per Tech Times and the Seoul Shinmun.

Two things about the arithmetic are worth stating plainly. The 66,000 figure is not a number any regulator published; it is the sum of seven separate institution-level disclosures, and it moved during the first week of October as firms finished their log reviews. On 3 October the Herald Business put the confirmed total at "just under 26,000," before Yegaram's roughly 40,000 was added. Tech Times, writing on 5 October, said the confirmed count had passed 65,000 and was expected to rise. The archive records the range as 65,000 to 68,000. Separately, the Financial Security Institute told the Herald Business that "far more institutions were attacked than those that ended up with actual incidents," including organisations outside banking — a statement that has not been quantified.

How a page title became an attribution

The ARTEX link did not come from the attackers' confession. It came from a string in a web page header. On 2 October, Moon Jong-hyun, head of the Genians Security Center, posted that web servers used in attacks on multiple Korean targets carried the HTML title "ARTEX-自主渗透测试控制台" — roughly "ARTEX autonomous penetration-testing console" — according to the Kyunghyang Shinmun. That was circumstantial: a tool's name in a page title shows a server ran the tool, not that the tool did the stealing.

The Financial Security Institute then did the part that mattered. An institute official told the Herald Business that investigators traced the attack IPs and server logs from Shinhan Bank — the first institution to report — and found evidence pointing to ARTEX, and that traffic from the tool carries "a specific data signature common" to it, which is how the attackers were identified across victims. Institute president Park Sang-won told reporters that the attack IPs were "almost the same for the banks, and a bit different for the savings banks," and cautioned that this does not establish who was behind it: "ARTEX is open-source and publicly available worldwide," he said. "Attack IPs can be routed through various places, so the IPs alone cannot identify the attacker." IPs from eight countries were used, according to the Kyunghyang Shinmun.

CrowdStrike's independent reconstruction, published on 7 October, went further than any Korean outlet. Its Counter Adversary Operations team found open directories on attacker-controlled servers — one at 38.244.50[.]120, which hosted an ARTEX instance and a C​laude Code configuration file containing a Chinese-language pentesting prompt, and a Hong Kong address that held C​laude Code session histories, ARTEX configuration files and C​laude memory files. The directories were never locked. CrowdStrike read the operation's working notes.

The configuration those notes exposed is specific: the ARTEX instance used DeepSeek v4.1-flash as its primary model backend, with GLM-5.3 from Z​hipu AI and Grok 4.6 added for other C​laude Code sessions, and the operator likely reached D​eepSeek through a reseller CrowdStrike names as xcai[.]pro. That is a different picture from ARTEX's own documentation: American Banker noted that the tool's GitHub page describes it as running on models from A​nthropic or O​penAI. The tool does not ship a model; it ships a harness, and whoever operates it supplies the intelligence.

CrowdStrike also caught the operator doing something other than intrusion. In the sessions it recovered, the user asked C​laude where threat actors typically sell Korean breach data and for help finding Korean Telegram groups that sell it. In another, the user asked C​laude to draft a security-researcher résumé listing the results of the ARTEX work. CrowdStrike said the personal details in that prompt "likely belong to the threat actor" but that "currently available information cannot definitively associate these details with the threat actor." Security Affairs, which covered the report, went further and argued those details should not be repeated in a news article at all. They are not repeated here.

What ARTEX actually is

ARTEX is a large-language-model-driven, multi-agent autonomous penetration-testing system, released on GitHub under the developer handle Autumn-27. According to the Kyunghyang Shinmun's reading of its repository, it was published on 26 July 2026, took first place among about 150 teams at a cyber offense-and-defence competition hosted by B​aidu on 3 September, and shipped its latest version on 24 September — three days before the first Korean intrusion the paper dates to 27 September. It was built for authorised security testing, the kind banks buy: find the holes before someone else does.

After the campaign became public, Autumn-27 took it closed source. "ARTEX was originally designed for the purpose of learning and research," the developer said in a statement reported by The Hacker News. "In view of the reality of tool abuse, the ARTEX project will no longer be updated and will be converted to a closed source. There will be no release of any version or maintenance support in the future." Closing the repository does not recall the copies already downloaded, and the Financial Security Institute's point to the Herald Business was that ARTEX is not special: "There are a great many open-source AI tools like ARTEX. There is currently no way to restrict everything being developed and distributed around the world."

What is established, and what is not

This is where the record rewards a careful reader, because the confident parts and the uncertain parts sit close together.

Established: seven named institutions suffered data breaches between late September and early October 2026; the intruders reached auxiliary systems rather than core banking; the disclosed losses total roughly 66,000 individual records plus about 2,200 corporate ones; the Financial Security Institute traced Shinhan's logs and found ARTEX; CrowdStrike independently found ARTEX infrastructure, configuration files and LLM session histories on attacker-controlled servers; and the institute's assessment is that a human directed the tool.

Not established: who did it. CrowdStrike did not attribute the campaign to any named adversary and assessed with only moderate confidence that the operator is a Chinese speaker who is financially motivated — a judgement it based on the use of a Chinese-developed tool and Chinese-language prompts, both of which are weak signals for nationality. The Kyunghyang Shinmun quoted Park Chun-sik of Ajou University making the obvious point that sophisticated groups route through multiple countries precisely to break that inference. It is also not established that ARTEX was used in all seven breaches, only that it was identified in the attacks on the banks and that the savings banks were attacked in a similar way.

Contested at the edges: how the Shinhan intrusion worked. Yonhap described credential stuffing; the Dong-A Ilbo, working from an incident report Shinhan gave a lawmaker, described enumeration — feeding random customer numbers into the lookup service until some returned data — over about 30 hours from 28 September. What is not in dispute is the outcome: a mobile-phone verification step was got around, and no account has explained how. Shinhan's notice says only that an "unauthorized outsider" reached some services "through abnormal means."

Not formally confirmed by a regulator: the ARTEX attribution itself. The Financial Security Institute's finding reached the public through an official speaking to the Herald Business, and American Banker noted flatly that "no regulator has publicly named ARTEX as being involved in the attack." That distinction matters less than it sounds — the institute is the sector's cyber agency and its president discussed the case with reporters — but it is the difference between an agency finding and an agency notice, and the record keeps it.

What changed afterwards

The regulatory response was fast and, by Korean standards, unusually broad. The Financial Services Commission held emergency meetings on Friday 2 October and Sunday 4 October, and ordered financial firms to inventory every internet-facing system "regardless of whether they are customer-facing," with gaps to be fixed by 8 October, according to Yonhap. It told firms that personal credit data must not be "unnecessarily stored or viewable" in systems used by employees and by "outside personnel such as loan recruiters and outsourcing contractors," which it called "the cause of the recent intrusions." Police opened a formal investigation, and the Financial Security Institute began drafting a recommendation that firms audit all internal employee-facing systems among their external access points.

The commission's consumer alert, issued on 6 October, said the attackers had not obtained passwords or one-time codes and that no customer had lost money, but warned that the stolen income and loan data made convincing fake loan offers easy to construct. The director of the Financial Security Institute expected the same: "The attacker did not take over the systems — they got in and extracted information by querying it," the official told the Herald Business. "The leaked personal data could be used for voice phishing and similar scams, but we do not expect funds to be directly transferred out of accounts."

The most consequential change is one the record states and the Korean coverage complicates. Regulators had been loosening network separation — the rule that keeps banks' business systems physically isolated from external networks — to let firms run AI security tooling. A first group of firms was admitted, and a second round was to be selected from 75 applicants, capped at 15, on 7 October. The Tracker reported on 21 October that the commission postponed that selection, citing staff pulled into incident response, and that no resumption date has been set; it also reported that the commission insists it has not abandoned the policy itself. That nuance is consistent with what Financial Services Commission Chairman Lee Eok-won told a parliamentary audit on 8 October, as reported by Yonhap: that to stop AI-driven attacks "you end up having to use AI," and that the commission was examining "staged and effective ways" to change the separation rules. The second round slipped; the direction of policy did not visibly reverse.

Accountability moved too. The Tracker reported that the Financial Supervisory Service governor, Lee Chan-jin, told the same audit on 19 October that this case could become the first in which a chief executive's internal-control responsibility is formally examined over a cyber incident, and that the service is weighing stronger accountability for CISOs and CEOs. Neither the banks nor the regulator has published a root-cause report.

How the archive files it

The record is an incident — a realised event, not a forecast — dated 6 October 2026, the day the president acknowledged the AI signal and the day the commission's consumer alert went out. Severity is critical; the type tags are WEAPON and EXFIL, meaning a tool repurposed as an attack instrument and data taken out. Real harm is recorded as true, AI involvement is confirmed, and the confidence grade is A — well documented, with primary sources that agree. The record is not flagged as disputed.

That grade is worth reading precisely. It says the event and its shape are well attested: the breaches, the systems, the counts, the tool, the human direction. It does not say the operator has been identified, because nobody has identified the operator, and it does not convert an institute's finding into a regulator's notice. The one thing this case establishes beyond its own numbers is narrower and more useful: an open-source agent built for authorised testing was pointed at seven financial firms, it lowered the skill required to run a multi-target campaign in under a week, and the thing that stopped it was not a clever model but an institute noticing a page title and a bank reading its own logs.

This record sits alongside the other documented AI incidents in the AI incident archive, where each entry carries its own sources, severity, confidence grade and disputed flag.