Can AI Crack Your Bank’s Security? South Korea’s Hacks Offer a Clue

Yes, but in automating the process. AI didn’t crack sophisticated bank security in South Korea’s recent breaches, it automated and chained together much more mundane attack steps, like finding weak authentication on overlooked internal tools, that used to require a coordinated human team. Even that claim isn’t fully confirmed: South Korean officials have only said “signs have emerged” of AI involvement in breaches that hit several banks, including Shinhan Bank, Yegaram Savings Bank, KB Kookmin, and Hana, between late September and early October 2026, exposing somewhere between 65,000 and 68,000 people’s records. CrowdStrike attributes the likely use of an AI agentic pentesting tool and Anthropic’s Claude Code with moderate confidence, not certainty.

How the Attack Actually Worked, Step by Step

Security researchers describe ARTEX as a multi-agent system: a harness hands an AI model the current task state and prior results, and the model decides the next action. The reported setup ran DeepSeek v4.1-flash as its primary model, with GLM-5.3 and Grok 4.6 brought in as supplementary reasoning models for specific steps. Claude Code appears to have operated separately, functioning more like a human operator’s assistant than part of the automated attack chain itself.

The actual campaign moved through four stages:

• Reconnaissance. The AI agents targeted peripheral, internet-facing web applications rather than core banking systems, things like customer inquiry portals and employee mobile backend tools, systems that are often lower priority for security teams precisely because they aren’t the “crown jewels.”
• Vulnerability discovery and exploitation. At Shinhan Bank, the entry point was reportedly a loan-broker lookup service with weak or bypassable authentication. At another institution, it was an employee mobile work-support system. In both cases, the flaw wasn’t exotic, it was the kind of thing a thorough manual security audit would likely have caught eventually, except AI let the attacker find and exploit it fast, at scale, across multiple targets at once.
• Data theft. Once inside, the agents pulled customer records: names, contact details, loan information, and in some cases income and credit data.
• Monetization. This is the detail that makes the AI angle concrete rather than theoretical. Investigators reportedly found Claude Code session logs in an exposed directory showing the operator asked Claude where stolen Korean data typically gets sold and for help locating Telegram groups that trade breach data. That’s not a sophisticated AI exploit, it’s someone using a mainstream consumer AI assistant for the unglamorous business side of a crime, the exact same way millions of people use it for ordinary tasks every day.

One detail says a lot about how this happened at all: ARTEX’s code reportedly included a default blocklist meant to stop it from being pointed at government and university domains, but that blocklist didn’t cover financial institutions. A tool built with some ethical guardrails still had a gap wide enough to drive a bank-targeting campaign through.

Why This Isn’t as Settled as It Sounds

Despite weeks of reporting, official attribution remains genuinely unconfirmed. South Korea’s President Lee Jae-myung said only that “signs have emerged” of AI involvement, and the Financial Services Commission’s chairman said authorities “cannot rule out” AI-enabled attacks, neither is a confirmed finding. CrowdStrike’s own assessment is attributed with “moderate confidence,” not certainty, and the specific link between ARTEX and the highest-profile breach, at Shinhan, rests on a text string found in server logs, not confirmed proof the tool was actually used there. Anthropic has not issued a public statement specifically confirming Claude Code’s role in this campaign.

That ambiguity matters more than it might seem. A cybersecurity firm (Rescana) that reviewed the activity put it plainly: the attack techniques themselves, credential stuffing, reconnaissance of weak endpoints, aren’t new. What may be new is that AI let someone chain them together with far less manual effort than before. That’s a meaningfully different claim than “AI hacked the banks,” and it’s the more accurate one.

This Isn’t an Isolated Incident

This fits a pattern Anthropic itself has already documented. In November 2025, the company disclosed that Chinese state-linked hackers had used Claude Code to automate an espionage campaign, a separate, earlier case of the same tool being weaponized by China-linked actors. Industry-wide, a 2026 research report from TrendAI Security, surveying 46 financial-sector CISOs, found an 89 percent year-over-year increase in AI-enabled attacks, with 67 percent of respondents reporting attackers actively working to undermine incident response in real time. Named cases from that same report include the Lazarus Group’s shift from direct bank attacks to a $2.02 billion cryptocurrency theft in 2025, and a campaign called BananaRAT that hit 16 separate financial institutions and crypto exchanges.

A separate, geographically distinct case adds weight to the trend: Indian non-banking financial companies reportedly lost roughly ₹300 crore, about $36 million, over a two-month period ending in late October 2026, with AI’s specific role there also still under investigation. AI-enabled financial crime has already shown up closer to home for ordinary consumers too, this isn’t a problem confined to bank back-end systems.

What Banks Are Actually Doing About It

The response from regulators and security researchers converges on a few concrete measures, not just “use more AI”:

• Zero trust, applied consistently. Verify every access request, from any identity, device, or integration, against policy, rather than assuming internal tools are automatically safe because they’re not customer-facing.
• Shrink the patching window. Because AI-driven tools can test large sets of stolen credentials within hours, traditional patch cycles measured in weeks are too slow. Recommended measures include virtual patching, shielding a known flaw before an official fix ships.
• AI-assisted detection, not AI alone. The European Central Bank’s own 2026 guidance to banks calls for enhanced monitoring and AI-enabled defensive capability, paired explicitly with ordinary patching discipline and resilience testing, not AI as a silver bullet on its own.
• Budget follows the threat. KB Kookmin reportedly plans to raise its 2027 cybersecurity budget to above ₩100 billion, up from ₩86.07 billion, a direct, measurable response to this specific wave of breaches.

This is a different kind of AI story than the coding agent vulnerabilities and sandbox escapes already covered on this site, it’s not a flaw in an AI tool itself, it’s AI tools being turned into the delivery mechanism for attacks on completely unrelated infrastructure, which means the fix has to happen on the target’s side, not the AI vendor’s.

What You Can Actually Do If You Bank With an Affected Institution

• Change any reused password, especially if you’ve used your banking password anywhere else. Credential-stuffing attacks specifically rely on password reuse across sites.
• Turn on multifactor authentication wherever your bank offers it. This is the single most effective thing an individual can do against automated account-takeover attempts.
• Be suspicious of any message offering to “check if your data was leaked” or help you “secure your account.” Scammers routinely exploit real breach news with fake follow-up messages pointing to malicious sites.
• Watch your own transaction alerts closely for a while after any breach notice, especially new loan applications, new account openings, or unusually large transfers, exactly the activity regulators have told affected institutions to monitor for.

Frequently Asked Questions

Did AI really hack South Korean banks?

That’s not confirmed. South Korean officials have said only that “signs have emerged” of AI involvement, and CrowdStrike’s attribution is made with moderate confidence, not certainty. What is documented is that an AI agentic pentesting tool and Anthropic’s Claude Code were both present in server logs tied to the attack.

What AI tools were actually used?

Reports describe an open-source agentic pentesting framework called ARTEX, running primarily on DeepSeek with GLM-5.3 and Grok 4.6 for supplementary reasoning, alongside separate use of Anthropic’s Claude Code by the human operator.

How many people were affected?

Current figures range from about 65,000 to 68,000 people across several institutions, with totals still being reconciled since banks are cross-checking overlapping records.

Did AI invent a new kind of bank hack?

No. Security researchers who reviewed the activity say the underlying techniques, credential stuffing and reconnaissance of weak endpoints, are not new. What may be new is AI chaining them together with far less manual effort than a human team would need.

What should I do if my bank was affected?

Change any reused passwords, turn on multifactor authentication, ignore unsolicited messages offering to check or protect your data, and watch your transaction alerts closely for unfamiliar loan applications, new accounts, or large transfers.

What are banks doing to prevent this from happening again?

Regulators and researchers are recommending zero-trust verification of every access request, faster patching cycles including virtual patching, and AI-assisted detection paired with normal security discipline, not AI as a standalone fix. Some banks are also significantly increasing cybersecurity budgets in direct response.