One operator used a free pentest agent and Claude Code to breach as many as nine Korean banks
ARTEX's developer made the open-source agent closed-source on October 8 after CrowdStrike linked it to a China-based 26-year-old who breached South Korean banks. The campaign exposed roughly 68,000 customer records, Cryptobriefing reported.
The Investor · Invest desk
Exposed: bank customers' names, phone numbers, annual incomes and loan limits; Shinhan Bank, worst hit, around 25,000 customer records compromised. Tool: the attacker used Anthropic's Claude Code with ARTEX, per CrowdStrike. Response: the ARTEX developer made it closed source.
- Who's exposed exposure Bank customers Names, phone numbers, annual incomes and loan limits were exposed, claim 14
- Who's exposed exposure Shinhan Bank Worst hit, with around 25,000 customer records compromised, claim 15
- What's now possible capability Anthropic (Claude Code) The attacker used its Claude Code alongside ARTEX, according to CrowdStrike, claim 5
- Who has to decide decision ARTEX developer Responded to misuse by making ARTEX closed source; no further public versions or maintenance support, claim 8
| Who | How | Kind | Claim |
|---|---|---|---|
| Bank customers | Names, phone numbers, annual incomes and loan limits were exposed | exposure | 14 |
| Shinhan Bank | Worst hit, with around 25,000 customer records compromised | exposure | 15 |
| Anthropic (Claude Code) | The attacker used its Claude Code alongside ARTEX, according to CrowdStrike | capability | 5 |
| ARTEX developer | Responded to misuse by making ARTEX closed source; no further public versions or maintenance support | decision | 8 |
What happened
- Shinhan Bank was the worst hit, with around 25,000 customer records compromised.
- The exposed personal data included names, phone numbers, annual incomes and loan limits.
- ARTEX is not a standalone model but connects to external LLMs such as ChatGPT, Claude and DeepSeek to run its probing.
- Attack traffic was routed through IP addresses spanning more than ten countries to obscure its origin.
- ARTEX's GitHub page was taken down the same day the project went closed-source.
Why it matters
- What it costs cost The leaked data, including annual incomes and loan limits, enables highly targeted financial fraud, and the people whose records were taken carry that risk.
- What it limits constraint The developer's step is prospective: no further versions and no maintenance support. It does nothing about the open-source versions already published this year.
- Who's exposed exposure Claude Code sat in the attack chain, so whether model providers should keep their assistants out of such chains is now Anthropic's question to answer; the company has not commented.
- What's now possible capability A single operator with a downloadable tool and a commercial AI assistant breached multiple banks, which lowers the resources needed to attack a financial institution to within one person's reach.
Next story · Leadership · Oct 8
CrowdStrike traces AI-assisted attacks on South Korean banks to one possible suspect in GuangdongConfirmed6 publishers
The tool cost nothing: ARTEX was released on GitHub this year as an open-source agent to automate penetration testing [9]. CrowdStrike said the operator was a single 26-year-old based in China who ran it alongside Anthropic's Claude Code, an account carried by both Cryptobriefing and Mint [4][5][12]. The campaign took roughly two weeks [2].
The breaches reached internal banking systems, not the customer-facing portals that carry the heaviest defenses, because internal systems often assume that anyone already inside belongs there [20].
The two reports do not line up on scale. Cryptobriefing put the number of firms at between seven and nine [2]; Mint, citing disclosures and local media, said at least nine banks have been named as targets since late September, and police opened a probe this week [11]. Shinhan alone accounts for about 37 percent of the 68,000 records exposed [18].
The developer, who uses the GitHub handle Autumn-27 and is named by Cryptobriefing as the Chinese cybersecurity engineer Li Puhua [19], announced the change on the code-hosting platform on Thursday. "Given the misuse of the tool, the ARTEX project will no longer be updated and will be converted to closed source. No further versions will be released to the public nor will maintenance support be provided," the developer said [8]. He said he opposed any illegal use of the software and bore no responsibility for conduct that breaks the law [16], and that ARTEX was built for authorized security testing [3].
President Lee Jae Myung called for stronger cybersecurity measures after the incidents [7]. China's foreign ministry spokesperson Mao Ning said on Thursday that the ministry was not familiar with the case and that China consistently opposes and combats hacking [17].
What to watch
- Whether Anthropic comments on the ARTEX chain or changes Claude Code's safeguards against being wired into attacks.
- What Korean police conclude, given routing through more than ten countries complicates cross-border attribution.
- Whether forks or copies of the already-public ARTEX code resurface despite the switch to closed-source.
Information, not investment advice. This story is general information about companies and markets, drawn from cited reporting. It is not a recommendation to buy, sell or hold any security; check the cited sources before acting.
Clarity's read
What the record supports and how the coverage leans. The claims behind it follow.
Reality
- Evidence68
- Adoption
- Not scored
- Hype gap+30
- Incentives40
- Confidence62
Perspective Coverage
5 publishers- Builder
- Builder 34%
- Operator
- Operator 51%
- Investor
- Investor 15%
Claim ledger
Ranked by verification strength, evidence, and original report placement.
- [1]
ARTEX was converted to a closed-source project on October 8, 2026.
- [2]
The attacks struck between late September and early October 2026, roughly a two-week span, and breached internal systems at between seven and nine South Korean financial firms.
- [3]
ARTEX was built as an autonomous AI agent for authorized security testing.
- [4]
CrowdStrike tied the operations to a financially motivated individual in China, estimated to be a 26-year-old based in the country.
- [5]
According to CrowdStrike, the attacker used ARTEX in conjunction with Anthropic's Claude Code.
- [6]
ARTEX's GitHub page was taken down the same day the project went closed-source.
- [7]
President Lee Jae Myung publicly addressed the incidents and called for enhanced cybersecurity measures.
- [8]
The developer, using the GitHub handle Autumn-27, said on the code-hosting platform on Thursday: "Given the misuse of the tool, the ARTEX project will no longer be updated and will be converted to closed source. No further versions will be released to the public nor will maintenance support be provided."
- [9]
Released on GitHub this year, ARTEX is an open-source AI agent designed to automate penetration testing.
- [10]
ARTEX is not a standalone large language model but connects to external LLMs such as ChatGPT, Claude and DeepSeek to help organisations test for vulnerabilities.
- [11]
At least nine South Korean banks have disclosed or been reported by local media as targets of cyberattacks since late September, prompting police to launch a probe this week.
- [12]
CrowdStrike said on Wednesday the suspect behind the South Korean bank attacks was likely a China-based 26-year-old who used the ARTEX AI agent and Anthropic's Claude Code.
- [13]
Approximately 68,000 individuals had personal data exposed in the attacks.
- [14]
The exposed personal data included names, phone numbers, annual incomes and loan limits.
- [15]
Shinhan Bank bore the worst of the breach, with around 25,000 customer records compromised.
- [16]
The developer said they opposed any illegal use of the software and bore no responsibility for conduct that violates laws and regulations.
- [17]
Chinese foreign ministry spokesperson Mao Ning said on Thursday that the ministry was not familiar with the case and that China consistently opposes and combats hacking activities.
- [18]
Shinhan's roughly 25,000 records are about 37 percent of the roughly 68,000 records exposed.
- [19]
The developer uses the GitHub handle Autumn-27 and is named by Cryptobriefing as the Chinese cybersecurity engineer Li Puhua.
- [20]
The combination was effective against internal banking systems rather than public-facing applications; internal systems often rely on the assumption that anyone with access already belongs there.
- [21]
To cover tracks, traffic generated during the attacks was routed through a network of IP addresses spanning more than ten countries.
- [22]
Annual income figures and loan limits are the kind of information that enables highly targeted financial fraud.
- [23]
Anthropic has not publicly commented on the incidents.
Sources
4 independent publishers whose own reporting we read for this story.
- Chinese AI tool pulled to prevent 'misuse' after South Korea hacks | AFP.com
afp.com
1 article · October 9, 2026
- cryptobriefing.comARTEX AI agent goes closed-source after being linked to South Korean bank hacks
1 article · October 9, 2026
- economictimes.indiatimes.comARTEX AI agent: Chinese developer makes ARTEX AI agent closed-source after Korean bank hack - The Economic Times
1 article · October 8, 2026
- koreajoongangdaily.comChinese AI tool linked to Korean bank hacks halts public updates as suspect denies involvement
1 article · October 10, 2026
- livemint.comChinese developer makes ARTEX AI agent closed-source after Korean bank hack | Mint
1 article · October 8, 2026