Description: An unidentified attacker reportedly used ARTEX, an AI-powered security-testing tool, alongside large language models to breach South Korean financial institutions and steal data. Compromised systems included a loan-broker inquiry service and an employee mobile work-support system. Researchers linked the activity to exposed attacker infrastructure and AI session histories. The attacker’s identity and the full number of affected institutions remained unconfirmed.
Entities
View all entitiesAlleged: Zhipu AI , xAI , Large language model developers , DeepSeek , Autumn-27 , ARTEX developers , Anthropic and AI agent system developers developed an AI system deployed by Threat actors , hackers , Cybercriminals , AI agent system deployers and Agentic threat actors, which harmed Shinhan Bank , Privacy , KB Kookmin Bank , General public of South Korea , General public , Financial institutions , Customers , Banks , Bank customers and Information security.
Alleged implicated AI systems: DeepSeek , Large language models , Grok 4.6 , Grok , GLM-5.3 , DeepSeek v4.1-flash , Claude Code , ARTEX , Anthropic large language models , AI penetration testing systems and AI agent systems
Incident Stats
Incident ID
1782
Report Count
1
Incident Date
2026-09-27
Editors
Dummy Dummy
Incident Reports
Reports Timeline
Loading...
CrowdStrike Intelligence identified infrastructure associated with a targeted campaign against South Korean financial organizations that resulted in exfiltrated data. The campaign was active from late September to early October 2026. Analys…
Variants
A "variant" is an AI incident similar to a known case—it has the same causes, harms, and AI system. Instead of listing it separately, we group it under the first reported incident. Unlike other incidents, variants do not need to have been reported outside the AIID. Learn more from the research paper.
Seen something similar?
