One Hacker, an Army of Bots: How an AI Agent Cracked Open South Korea's Banks

I have written up a lot of bank breaches over the years, and they usually come with a cast list: a crew, a malware family, a months-long timeline. This one has a cast of one. In a report published Wednesday, CrowdStrike says a single operator, probably sitting in southern China, worked through South Korea's financial sector between late September and early October with a rented server, an open-source hacking agent and a handful of AI models doing the legwork. The damage is still being counted. Reuters reports that at least nine South Korean banks have either disclosed attacks or been named in local coverage since late September. Shinhan Bank put its exposure at roughly 25,000 customers, KB Kookmin Bank at 119, and Tech Insider, citing Yonhap, adds Yegaram Savings Bank at about 40,000, with Hana Bank also named. Police opened an investigation this week and President Lee Jae-myung has called for a robust response. A caution worth keeping in view: CrowdStrike says the true victim count is unconfirmed, and not every breach in that cluster has been publicly tied to this one actor. What cracked the case was not clever forensics so much as sloppy housekeeping. The server running the attacker's tooling had an open directory, and in it sat a Claude Code project file holding Chinese-language instructions for how the model should run a penetration test. That file pointed to a second, Hong Kong-based address, where researchers found more unlocked folders: Claude Code session histories, configuration files and saved memory notes. CrowdStrike did not have to guess at the playbook. It read it. The centerpiece is ARTEX, an AI agent for automated penetration testing that a Chinese security engineer using the handle Autumn posted to GitHub this year. ARTEX is not a model. It is a harness that plugs into outside language models and points them at a target, and its own project page says it is meant for learning and local testing, not live systems. According to CrowdStrike, this operator's instance ran mainly on DeepSeek v4.1-flash, likely bought through an API reseller, with GLM-5.3 and Grok 4.6 brought in for additional Claude Code sessions. Tech Insider's read is the right one: the models were treated as interchangeable parts. The entry points were ordinary. Industry reports cited by CrowdStrike say one bank was breached through a loan-status lookup service used by brokers, another through a mobile work-support system for staff. The motive looks ordinary too. The recovered sessions show the operator asking Claude where stolen Korean data is typically sold and for help locating Korean data-trading groups on Telegram. That is someone shopping for a buyer, not a spy filing a report. Then there is the résumé. In one session the operator asked Claude to draft a security-researcher CV, complete with bullet points describing the ARTEX work, and supplied personal details: age 26, a university in Guangdong, a home base in the city of Maoming. CrowdStrike says those details likely belong to the attacker but cannot be definitively tied to them, and a birth date offered earlier in the same session implied someone closer to 19. A man who answered the phone number listed told Reuters he knew nothing about it. The firm's formal judgment is narrower than the headlines: the actor is "likely a Chinese speaker and financially motivated," held at moderate confidence, with no named group and no state link. China's foreign ministry said it was unfamiliar with the case and opposes hacking; Anthropic and South Korean police had not responded to Reuters. So why does this matter beyond Seoul? Adam Meyers, who runs CrowdStrike's counter-adversary team, told reporters the significance is leverage: AI agents let one person go after many organizations in very little time. For years, "AI in cybercrime" meant better phishing emails. Here the automation sits deeper, in finding weaknesses and helping exploit them, with a human steering and approving rather than typing every command. Nobody should read this as a machine deciding to rob a bank. Read it as a team's worth of labor collapsing into one operator. For defenders, the uncomfortable part is that nothing here is exotic. The agent is free, the models are a subscription away, and the internet-facing services that were once too tedious to bother attacking are now cheap to probe at machine speed. South Korean regulators had already ordered security checks across the sector, and Tech Insider argues banks should start hunting for agent artifacts, such as configuration and session files, alongside classic malware signatures. I would add one more item to the list: assume the next operator will remember to lock the directory.