Three Days After Release: How an AI Pentest Agent Walked Through the Side Doors of Korea's Banks

At a glance

• What happened: Shinhan, KB Kookmin, Hana and BNK Busan banks, Yegaram and Welcome savings banks, and Hyundai Capital all leaked customer or staff data.
• How: An AI agent called ARTEX probed side systems (a loan broker lookup page, staff apps, an agent query page) and pulled records past weak authentication.
• The tell: The attacker left Claude Code session histories and memory files in open directories. CrowdStrike read them.
• The suspect: Possibly a 26-year-old in Guangdong, China. Nobody has confirmed it.
• The lesson: AI did not invent a single vulnerability here. It made decades-old gaps exploitable in days. Fix the basics first, because that is where this attack got in.

On September 24, a GitHub user called Autumn-27 pushed a new release of ARTEX. Three days later, the attack on KB Kookmin Bank began.

Within a week, regulators had summoned bank CEOs to an emergency meeting on a public holiday, police had opened an investigation, and President Lee Jae Myung had ordered a thorough probe.

The story people will retell is the 26-year-old. The story security teams should take away is less exciting: AI did not create these holes. It made finding them cheap.

How the attack unfolded

The breaches landed in about five days, from Sunday, September 27 to Thursday, October 1, according to the Financial Security Institute. From the tool’s release to a police probe took under three weeks.

Date (2026)	What happened	Source
Jul 26	ARTEX is first published on GitHub by a developer known as Autumn-27	Kyunghyang
Sep 3	ARTEX places first of about 150 teams at a Baidu-hosted offense and defense contest	Kyunghyang
Sep 24	The latest ARTEX version is released	Kyunghyang
Sep 27	The attack on KB Kookmin Bank begins	Kyunghyang
Sep 29	Shinhan’s broker lookup site is hit from the early hours. Shinhan detects it around 9:30 a.m., but the attack runs into the next morning	Kyunghyang
Sep 30	A hacker reaches a Yegaram Savings Bank server. KB detects its own breach that night	Digital Today, Korea Herald
Oct 1	Shinhan discloses a leak of about 25,000 customers. The Financial Supervisory Service starts an on-site inspection	Korea Times
Oct 2	KB, Hana and BNK disclose breaches. The FSC orders checks of every externally accessible system. Genians researchers spot “ARTEX” on attack servers	Korea Herald, Kyunghyang
Oct 3	The Financial Security Institute traces Shinhan’s logs to ARTEX. Yegaram and Hyundai Capital disclose leaks. Police open a preliminary investigation	Herald Business, Digital Today
Oct 4	The FSC holds a sector-wide emergency meeting on a public holiday. President Lee orders a thorough investigation	Kyunghyang
Oct 7	CrowdStrike publishes its analysis of the attacker’s servers and AI session logs	CrowdStrike
Oct 8	Reuters reports the possible suspect. ARTEX’s developer takes the project closed source	Reuters, The Hacker News
Oct 11	Seoul firm Logpresso links the suspect’s Telegram account to a DDoS-for-hire community	Korea Herald

Who was hit

Woori Bank and NH Nonghyup Bank were attacked too, and lost nothing.

Institution	System breached	Data exposed
Yegaram Savings Bank	A server holding customer data	Names, birth dates, contact details
Shinhan Bank	Mobile lookup site for loan brokers	Names, phone numbers, annual income, loan limits, 66 resident registration numbers, 97 CI identifiers
Welcome Savings Bank	Not disclosed	Corporate client information
Hyundai Capital	Housing loan agent query page	Agents’ names, phones, emails, resident registration numbers
KB Kookmin Bank	Employee mobile work-support system	Names, phones, addresses, encrypted resident registration numbers
Hana Bank	Sales support system (ODS)	Resident registration numbers, names, addresses, contacts, employers
BNK Busan Bank	A webpage	Outsourced developers’ names, phones, birth dates, emails

Sources: Digital Today, Korea Herald, Kyunghyang, Herald Business. Reuters counts at least nine banks that were targeted or named in local media.

Inside the attacker’s AI workspace

The best evidence in this case came from the attacker’s own mistake: they left their AI working files where anyone could read them. CrowdStrike’s report reconstructs the setup.

• The entry point: A server at 38.244.50[.]120 ran ARTEX and served a Claude Code project file, /.claude/CLAUDE.md, on port 18899. It held a Chinese-language prompt telling the model how to pentest.
• The trail: That file named a Hong Kong server. Its open directories held Claude Code session histories, Claude memory files and ARTEX configs from late September to early October.
• The models: ARTEX ran mainly on DeepSeek v4.1-flash, likely bought through the reseller xcai[.]pro. Zhipu AI’s GLM-5.3 and Grok 4.6 powered other Claude Code sessions.
• The cover: Nine proxy IP addresses, listed in the checklist below.
• The plan for the data: The operator asked Claude where Korean breach data is usually sold, and for help finding Korean Telegram data-sale groups.

Korean investigators reached ARTEX independently. Genians found its console name in the HTML title of attack servers. The Financial Security Institute found a data signature typical of ARTEX traffic in Shinhan’s logs, and was blunt about who was responsible: “A hacker used the AI as a tool.”

CrowdStrike’s verdict: AI tooling let one financially motivated operator run several intrusions in a short span, and adversaries will likely keep experimenting with it to move faster.

The side doors

Every confirmed bank breach went through a system built for staff or partners. The Financial Security Institute said customer-facing banking had been heavily hardened, while internal and partner systems were managed less strictly.

How the Shinhan breach worked

1. A lookup page for outsiders. Freelance loan brokers used a mobile web login site to check whether loans for customers they referred were approved. It did not require a public certificate or a similar step (Kyunghyang).
2. Guess the numbers. The attacker fed the service random values until valid customer numbers came back (Kyunghyang).
3. Skip the check. Each hit unlocked a customer’s loan file, bypassing identity verification (Korea Herald).
4. Keep going. Shinhan detected the attack around 9:30 a.m. on September 29. It still ran into the early hours of the 30th (Kyunghyang).

In security terms, this is enumeration plus broken object-level authorization, the number one risk on the OWASP API Security Top 10. The server checked that a customer number existed, not whether the person asking was allowed to see it.

Early reports floated credential stuffing (Korea Times). The later account from regulators points to enumeration.

Why these systems, and why so many banks

• They were easy to miss. An FSI official said there were so many management points that banks struggled to know where their weak spots were.
• The sweep was opportunistic. Authorities read it as an AI hitting many firms at once, with the weakest falling. The attack IPs against the banks were almost identical (Kyunghyang).
• Blocking IPs did not stop it. When one address was blocked, the attacker switched to another. The FSI called IP blocking a stopgap, since the method and the weakness stayed the same.
• The data was built for scams. Names, phone numbers, income and loan limits are what a fake loan call needs. The FSI expects voice phishing rather than direct theft, and regulators warned consumers to watch for loan scams (The Hacker News).

The suspect, and how sure anyone is

What points to someone

• In one Claude Code session, the operator asked for a security researcher résumé built on the ARTEX results. It listed an age of 26, South China University of Technology, a Telegram account and Maoming in Guangdong (CrowdStrike).
• The same Telegram username appeared in sessions probing a Telegram-based NFT gift marketplace.
• On October 11, Seoul firm Logpresso reported the account had been listed in September 2024 as a moderator of GodNet, a community run by the Chinese DDoS-for-hire group Vitas (Korea Herald).

What cuts against certainty

• CrowdStrike rates its assessment moderate confidence and says it cannot definitively link the details. The date of birth first given in the prompt did not match the stated age.
• The Telegram account was deleted on October 8. A new account under the same name posted a denial, and it is unclear who runs it.
• The listed phone number’s owner says it was used without permission (Korea Herald). A man who answered it told Reuters he knew nothing about it.
• China’s foreign ministry said it opposes hacking and was not aware of the specifics (Asia Business Daily). Logpresso itself says the account links alone do not prove who carried out the hacks.

We are not repeating the handle or phone number here. For defenders, identity barely matters: anyone can download the same tool.

Why agentic AI changes the math

ARTEX is not a model. It plugs into outside models such as DeepSeek, Claude and ChatGPT and runs a penetration test with multiple AI agents. Its GitHub page said it was for learning and local testing, never live systems (Reuters, The Hacker News).

Three things about this campaign should change how security teams plan:

• Release to breach in three days. The latest ARTEX release landed September 24. The first breach began September 27. Going closed source on October 8 recalled none of the copies already downloaded.
• Sweeps cost almost nothing. One operator, a cheap “flash” model bought through a reseller, and a tool doing the tedious work at machine speed.
• Opportunistic beats targeted. When scanning every door is cheap, attackers stop choosing victims and harvest whatever is open. Woori and NH were spared because the weakness the attacker looked for was not there.

The FSI put it plainly: open-source tools like ARTEX are plentiful, and there is no way to restrict them all.

We have seen this curve before:

• GTG-1002: AI ran most of an espionage campaign on its own.
• hackerbot-claw: AI agents ran supply chain attacks against Microsoft, DataDog and Aqua Security.
• The Korean bank hacks: one operator, a whole sector, under a week.

AI did not invent a single vulnerability in this attack. It took gaps the industry has known about for decades and made them exploitable in days, by one person, for the price of an API key. The fixes are old. What is new is that you no longer have time to put them off.

How an organization could have stopped it

Start with the basics, because that is where this attack got in. Every step of the chain below is broken by a control security teams have recommended for years, and none of them is AI-specific. The proof came from the same campaign: Woori Bank and NH Nonghyup Bank were targeted too. Intrusion prevention blocked the attempts (Digital Today), and the weakness the attacker hunted for was not in their systems (Herald Business).

1. Treat every reachable system as customer-facing. Broker portals, staff apps and agent pages included. This was the FSC’s first order to the whole sector on October 2 (Korea Herald).
2. One authentication bar for every door. Phishing-resistant MFA, registered devices, and allowlists for brokers and agents who connect from known places.
3. Authorize every object. A broker should see only the applicants that broker submitted, checked on the server for every request. Unguessable IDs help, but they are not access control.
4. Detect machine tempo. Rate-limit per account and per IP, and alert on bursts of failed lookups. Shinhan saw this attack, and it still ran for most of a day.
5. Return only what the screen needs. A loan status page has no reason to send income or ID numbers. Data that is never sent cannot be stolen through that page.
6. Block the behavior, not just the address. The attacker rotated IPs as each was blocked. Share request patterns across the sector, not only IP lists.
7. Test with agents before attackers do. Point authorized agentic testing at your own perimeter on a schedule, and govern those tools carefully, as the next section explains.

Your own AI agents leave the same trail

The attacker was not caught by a firewall. Their AI workspace leaked.

• What leaked: a CLAUDE.md holding the attack prompt, plus session histories, memory files and tool configs, all in directories anyone could browse.
• What it revealed: the infrastructure, the targets, the models and the plan for the stolen data.

Now turn the lens around. The same exposure exists inside most enterprises.

• Your developers produce the same files. Coding agents write project instructions that describe internal systems, session histories that capture commands and file contents, and memory that persists between sessions. We have written about why these markdown files escape the governance code gets. An exposed agent workspace is a map of your internals.
• Your red team will run the same tools. Many teams will now point agentic pentest tools at their own perimeter, as they should. But tools like ARTEX send their reasoning to external models, in this case through a third-party reseller. An unapproved copy on one laptop ships your vulnerability findings to whatever endpoint it was set up with.
• Your AI tools are already a way in. The Vercel breach started with one employee’s AI side app, and the LiteLLM compromise reached 47,000 AI environments in 46 minutes.

Where SuperAlign fits

AI shows up on both sides of this story. Outside your walls, it amplifies old gaps, and the controls above close them. Inside your walls, it adds new ones: the agents your teams run, the files those agents write and the models they call. That inside layer is what gave this operation away.

Both are the same problem, moving faster. The difference is that most security programs can already see the first layer and cannot yet see the second. That second layer is the one SuperAlign is built for.

What you need to know	How SuperAlign answers it
Which AI agents run on our fleet?	Surface inventories coding agents like Claude Code, CLI and IDE agents, MCP servers, skills and local models on every managed device, including ones nobody declared. See AI agent and MCP security.
Should each one be allowed?	Every agent and MCP server is risk-scored, and teams approve or block it from one console.
Where are they sending data?	Surface tracks AI API traffic per device and identity and flags new AI services the moment they appear, so an unapproved pentest agent calling an LLM reseller stands out. See shadow AI discovery.
What did an agent actually do?	Session records show what an agent ran, read and sent: the same questions CrowdStrike answered from the attacker’s logs. See AI incident investigation.
Is this skill or MCP server safe to install?	ScanKernel checks AI skills and MCP servers before they reach a laptop, and AIRiskDB scores models and agents on capability, exposure and governance.

CrowdStrike rebuilt an attacker’s operation from their agent logs. The question worth asking this week: could your team do the same for its own agents, before someone else does?

What to check now

If you run a financial institution, or any business with partner or staff portals on the internet, these are worth doing this week.

• Map the side doors. List every internet-reachable app that is not your main customer channel: broker and agent portals, staff mobile apps, sales tools, vendor integrations.
• Test object access. For each one, check whether a valid record ID alone returns that record. If it does, fix authorization first.
• Hunt in the logs. Pull access logs since mid-September. Look for single IPs or sessions making many lookups with a high failure rate, especially overnight.
• Search for the indicators. Check web and WAF logs for the IPs below and for responses containing the string “ARTEX”.
• Trim the responses. Strip income, credit and national ID fields from any screen that does not need them.
• Inventory your own agents. Confirm no agent on your endpoints or servers exposes .claude/ directories, session histories or memory files, and that no unapproved pentest agent is running.

Indicators published by CrowdStrike (defanged):

Indicator	Type	Role in the campaign
38.244.50[.]120	IP address	Attacker-controlled server hosting the ARTEX instance and an open directory (port 18899)
101.53.80[.]20	IP address	Proxy used during ARTEX activity
205.214.59[.]31	IP address	Proxy used during ARTEX activity
124.155.252[.]63	IP address	Proxy used during ARTEX activity
154.201.79[.]246	IP address	Proxy used during ARTEX activity
23.248.249[.]90	IP address	Proxy used during ARTEX activity
23.158.220[.]98	IP address	Proxy used during ARTEX activity
103.248.148[.]84	IP address	Proxy used during ARTEX activity
203.160.133[.]172	IP address	Proxy used during ARTEX activity
209.209.85[.]38	IP address	Proxy used during ARTEX activity
xcai[.]pro	Domain	Likely LLM API reseller used to reach DeepSeek

CrowdStrike maps the activity to MITRE ATT&CK T1583.003 (Acquire Infrastructure: Virtual Private Server), T1588.007 (Obtain Capabilities: Artificial Intelligence) and T1090 (Proxy). The Financial Security Institute has shared attacker IPs with Korean financial firms and police. Because the attacker rotated addresses, match on behavior as well as IPs.

Agentic attack tools will keep getting cheaper and faster, and they will keep finding the systems someone forgot. The organizations that come through the next campaign will know every door they expose, and every AI agent they run.

Sources

Primary research

• CrowdStrike Counter Adversary Operations, Unknown Threat Actor Uses AI-Driven ARTEX to Target South Korean Finance, Oct 7, 2026
• OWASP, API1:2023 Broken Object Level Authorization

Korean reporting

• Kyunghyang Shinmun, Loan broker lookup site became the weak link, Oct 1, 2026
• The Korea Times, Shinhan Bank hit by data breach affecting 25,000 customers, Oct 1, 2026
• The Korea Herald, Hana, BNK report data breaches as hacking hits Korean banks, Oct 2, 2026
• The Herald Business, Chinese AI tool ARTEX used in wave of bank hacks, probe finds, Oct 3, 2026
• Digital Today, Hacking emergency spreads from banks to savings banks and capital firms, Oct 4, 2026
• Kyunghyang Shinmun, The Korean financial sector was breached by a two-month-old Chinese AI, Oct 4, 2026
• The Asia Business Daily, China on alleged 26-year-old in Guangdong behind South Korean financial sector hacks, Oct 8, 2026
• The Korea Herald, AI-powered attacks on Korean financial sectors linked to Chinese DDoS group, Oct 11, 2026

Wire and trade press

• Reuters via ThePrint, CrowdStrike says China-based suspect used AI tools in South Korean bank hacks, Oct 8, 2026 (original on Reuters)
• The Hacker News, ARTEX AI Pentesting Tool Used in Data Theft Attacks on South Korean Financial Firms, Oct 8, 2026

Other SuperAlign writing

• How SuperAlign Helps Enterprises Counter AI-Powered Threats
• When the Assembly Line Becomes the Attack Surface: Supply Chain Threats in the Age of AI Agents
• The Hidden Supply Chain Threat Hiding in Your AI Agent’s Markdown Files
• One Employee’s AI Side App Just Cost Vercel Its Customer Data
• 46 Minutes: How a Poisoned Python Package Reached 47,000 AI Environments