The Resume Was Fake, the Breach Was Not: Inside the First Well-Documented Agentic AI Bank Heist
On October 7, 2026, CrowdStrike published a report with an unusually specific finding: a single attacker, working alone, used an open-source AI pentesting framework chained to several large language models, including Anthropic’s Claude Code, to breach multiple South Korean financial institutions over roughly two weeks in late September and early October. CrowdStrike assesses with moderate confidence that the actor is a Chinese speaking, financially motivated individual. It has not attributed the activity to a named group or to any government.
For CISOs, the headline is not the nationality of the attacker. It is the shape of the operation. One person, using commodity AI tooling, appears to have done work that would normally require a small team and a meaningful amount of time. That is worth sitting with for a moment, because it is exactly the scenario a major financial regulator warned about five months earlier.
What actually happened
The attacker used a tool called ARTEX, an open source, China developed agentic penetration testing framework published on GitHub earlier this year. ARTEX does not run on its own intelligence. It is built to connect to external large language models and use them to drive reconnaissance and exploitation. In this campaign, CrowdStrike’s forensic work, recovered from an open directory the attacker left exposed, showed the instance primarily used DeepSeek v4.1 flash as its backend model, supplemented by GLM 5.3 and Grok 4.6, accessed through Claude Code sessions.
The targets included South Korean financial institutions. Shinhan Bank disclosed that the personal information of approximately 25,000 customers was compromised. KB Kookmin Bank disclosed a smaller leak affecting 119 customers. Other institutions, including Yegaram Savings Bank, were named in the wider wave of disclosures that followed, with South Korean authorities putting the overall number of exposed records somewhere in the range of 65,000 to 68,000 across the disclosures made so far. Not every bank named in that wider wave has been directly confirmed by CrowdStrike as part of this specific campaign, and the tally is an evolving government estimate rather than a single reconciled figure. At one targeted bank, the entry point was a loan progress enquiry service used by financial brokers. At another, it was an employee mobile work support system, the kind of internal tooling that rarely gets the same scrutiny as a public facing application.
What makes the case worth a closer look is what CrowdStrike recovered from the attacker’s own session logs. Beyond the technical work, the attacker used Claude for business logistics: asking where stolen Korean data could be sold, and which Telegram groups trade in it. In one recovered session, the attacker asked Claude to draft a fake security researcher resume, which CrowdStrike believes contains the attacker’s own real personal details, including an age of 26 and an education listed at a university in Guangdong, China. An AI agent was doing reconnaissance, writing exploitation steps, and apparently helping plan the resale of stolen data, inside the same workflow.
CrowdStrike’s Adam Meyers, who leads the firm’s counter adversary operations, put it plainly: the case shows how a single human adversary can use AI agents to target many victims in a very short period of time. Agentic AI, in his words, is letting attackers move faster.
This is the second documented case in a year, not the first warning
It is tempting to treat this as an isolated, strange story out of Korea. It is not. In November 2025, Anthropic disclosed that it had detected a suspected Chinese state sponsored group misusing Claude Code to run a campaign the company described as 80 to 90 percent automated, against roughly 30 organizations spanning technology, financial services, chemical manufacturing, and government, succeeding against a handful of them. Anthropic called it the first documented case of a state actor largely automating a cyber operation with AI, noting the tool made thousands of requests per second, a pace no human operator could match, and that operators had learned to split malicious tasks into smaller pieces to avoid triggering the model’s own safeguards.
The South Korea campaign is the same basic pattern playing out again, but without a state apparatus behind it. One individual, using an open source framework and a handful of commercially available AI models, appears to have reached several financial institutions in a matter of weeks.
Regulators were already anticipating this. On May 21, 2026, the New York State Department of Financial Services issued two pieces of guidance to every entity it regulates, including banks and insurers. One addressed the current heightened threat environment directly. The other, a Frontier AI advisory, warned specifically that increasingly capable AI models can amplify the potency, scale, and speed at which vulnerabilities are found and exploited, and that exploitation timelines are likely to compress faster than typical patch cycles can keep up with. The advisory does not change the underlying legal requirements of New York’s cybersecurity regulation, but examiners are expected to treat it as a benchmark, and it is addressed directly to the CISO function, asking that security leaders be able to explain how they are accounting for AI specific risk.
Five months after that advisory, CrowdStrike documented close to the exact scenario it described, not from a frontier model purpose built for offense, but from an attacker stitching together an open source framework and several off the shelf AI coding assistants.
What this means for your program
Stop treating “AI threat actors” as a future problem. This was not a nation state with a dedicated AI research team. It was reportedly one person. The barrier to running an AI assisted, multi-target intrusion campaign against financial infrastructure has dropped to the point where an individual can attempt it. Your threat model should already reflect that, not a version of it scheduled for next year’s planning cycle.
Ask whether your red team is testing against this exact pattern. Adversarial simulation built around a human operator working through a checklist is not the same exercise as adversarial simulation that accounts for an attacker using agentic tooling to scale reconnaissance and exploitation across many targets at once. If your last red team engagement did not account for AI assisted attacker tradecraft, it tested yesterday’s adversary, not this one.
Look hard at internal and partner facing systems, not just the public perimeter. Both entry points CrowdStrike described, a broker facing loan inquiry portal and an internal employee mobile tool, are the kind of systems that often sit outside the scope of an annual external penetration test. Internal network and application testing, and a fresh look at thick client and partner facing tooling, deserve the same attention as the systems facing the open internet.
Treat this as a live example for your NYDFS or equivalent regulatory conversation. If your institution is subject to NYDFS oversight, or a comparable regime elsewhere, this incident is a concrete, recent example you can point to when documenting how your organization is responding to the Frontier AI advisory’s concerns. If you have not yet run the gap analysis the advisory invites, this is a reasonable prompt to start one.
Revisit how you are testing generative AI and LLM integrations themselves. The attacker in this case used commercial AI tools as a force multiplier. The inverse question matters just as much for your own environment: if your organization has deployed AI agents or LLM backed tools internally, have they been tested the way this attacker tested a bank’s defenses, for the kind of misuse, jailbreaking, and overreach that lets a tool do far more than its intended job?
This is the work we do for financial services clients every day: red team and adversarial simulation engagements built around how attackers are actually operating right now, continuous penetration testing and vulnerability management that does not wait a year between looks at the environment, and generative AI and LLM security testing for the agents and assistants your own teams are adopting. The attacker behind the South Korea campaign did not need a nation state budget to reach multiple banks in a matter of weeks. That is the part of this story worth taking seriously, regardless of where your institution sits on the map.
