The Decoder · 10/8/2026, 17:24:17
AI-Powered Penetration Tool ARTEX Enables Single Attacker to Breach Multiple South Korean Banks
CrowdStrike reports that a suspected Chinese-speaking attacker used the open-source AI penetration tool ARTEX to breach multiple South Korean financial institutions between late September and early October 2026, stealing over 25,000 sensitive records from Shinhan Bank alone. The incident highlights how LLM-driven automated attack tools (powered by models like DeepSeek v4.1-flash and GLM-5.3) significantly lower the barrier for cybercrime, enabling a single individual to execute massive data breaches in a short timeframe.
SOURCE COVERAGEOriginal coverage
Crowdstrike reports on an infrastructure hack in South Korea. A suspected Chinese-speaking attacker hit multiple South Korean financial institutions between late September and early October 2026, stealing large amounts of data. At Shinhan Bank alone, more than 25,000 records with names, contact details, income, and credit limits were stolen, according to Korean newspaper Khan. South Korea's financial regulator held an emergency meeting. President Lee Jae Myung called for a thorough investigation.
The attacker used ARTEX, a Chinese open-source tool first posted on GitHub in July that uses AI language models for automated penetration testing, meaning it finds security flaws on its own. The models behind it were DeepSeek v4.1-flash, GLM-5.3, and Grok 4.6. Researchers found Claude Code session logs on the attacker's open directories, showing searches for Telegram groups to sell stolen data.
Crowdstrike says the case shows how AI tools can let a single person pull off massive breaches in a short window, the kind of cybersecurity risk experts have been warning about for months. Just days earlier, Anthropic documented that GLM-5.3 can write exploits nearly on par with Mythos Preview, Anthropic's frontier model and the one that sparked the entire debate in late March 2026.