The AI Hacking Tool Was Used Against Korean Banks. Its Creator Just Pulled It Offline.

Rating as of October 9, 2026: 7/10 · Pay Attention

The picture is getting clearer, and it's less "hacking army" and more "one person with very good tools."

What changed

This is a follow-up to our post on the South Korean bank hacks. Two things changed.

We know more about who and how. The security company CrowdStrike published an analysis of the campaign, which ran from late September to early October [1]. It found the attacker's servers left open, including session histories from Anthropic's Claude Code and the configuration for an ARTEX instance [1]. According to CrowdStrike [1][2]:

• The activity hasn't been attributed to any named group. CrowdStrike assesses, with moderate confidence, that the attacker is likely a single Chinese-speaking, financially motivated individual.
• ARTEX was run with several AI models behind it, and the attacker also used Claude Code.
• At one bank, the attacker reportedly got into a loan inquiry service used by brokers. At another, an employee mobile work system.
• The attacker also asked Claude where stolen Korean data is typically sold.

Reporting now puts the number of targeted banks at at least nine, though the exact number affected isn't confirmed [3].

The tool is gone. ARTEX's developer posted on GitHub that the tool was "abused by some bad actors" and that "the Artex project will no longer be updated and will be converted to closed-source. No further versions will be released to the public" [3][4]. The developer said using it for attacks was "entirely contrary to" their intentions [4].

South Korea's Financial Services Commission says more than 68,000 people have been affected. Shinhan Bank says information from about 25,000 customers' loan applications leaked, including names, phone numbers and annual income [4].

Why it matters

The new details point to the same lesson as the online retailer campaign last month. AI didn't go rogue here. It let one person do work that used to take a team, against several major banks, in a short period.

The developer's response is also a first, as far as I know: a real-world attack caused the creator of an AI hacking tool to withdraw it from public access. That's the right instinct. It also has limits, because copies that were already downloaded don't disappear.

What you can probably ignore

"A Chinese state hacking operation used AI against Korea." CrowdStrike explicitly hasn't attributed it to any government or named group [1].

"Pulling ARTEX solves the problem." It stops new public versions. It doesn't recall existing copies, and similar tools exist.

Why it earned this rating

On the side of a higher number:

• Stronger evidence that AI tools did a large share of the work [1][2].
• Real harm to tens of thousands of people [4].

On the side of a lower number:

• No money is known to have been stolen, and core banking systems appear intact.
• A human selected the targets and directed the campaign [1].
• The tool's public distribution has stopped [4].

The new evidence firms up the AI's role, and the developer's response lowers future risk a bit. Those roughly cancel out, so I'm keeping it at a 7.

What I'm watching next

• Whether police identify and charge anyone.
• Whether AI companies respond, since a mainstream AI coding tool was part of the attack.
• Copies of ARTEX turning up in other campaigns.

Bunker Check

Current rating: 7/10 · Pay Attention

Direction: Holding

Could move higher if: Similar AI-assisted bank attacks appear elsewhere, or the leaked data leads to large-scale fraud.

Could move lower if: The damage proves smaller than reported.

The shovel stays put. The side door, however, is getting a much better lock.

Sources

1. CrowdStrike, "Unknown Threat Actor Uses AI-Driven ARTEX to Target South Korean Finance," October 7, 2026 (primary source). https://www.crowdstrike.com/en-us/blog/unknown-threat-actor-uses-artex-to-target-south-korean-finance/
2. CNA (Reuters report), "CrowdStrike says China-based suspect used AI tools in South Korean bank hacks," October 8, 2026. https://www.channelnewsasia.com/business/crowdstrike-says-china-based-suspect-used-ai-tools-in-south-korean-bank-hacks-6441386
3. U.S. News (Reuters report), "Chinese Developer Makes ARTEX AI Agent Closed-Source After Korean Bank Hack," October 8, 2026. https://money.usnews.com/investing/news/articles/2026-10-08/chinese-developer-makes-artex-ai-agent-closed-source-after-korean-bank-hack
4. AFP, "Chinese AI tool pulled to prevent 'misuse' after South Korea hacks," October 2026. https://www.afp.com/en/chinese-ai-tool-pulled-prevent-misuse-after-south-korea-hacks