Safety Tools Turned Into Weapons — Analysis and Lessons from the ARTEX AI Incident That Breached 9 Banks in South Korea

From late September to early October 2026, 9 South Korean financial institutions suffered successive customer data breaches, with at least 65,000 pieces of personal information and credit data reportedly stolen so far. The South Korean government has launched a round-the-clock cybersecurity state of emergency, and the president has ordered a full investigation.

According to CrowdStrike's report, the core tool of this cyberattack is ARTEX, an open-source AI penetration testing agent powered by multiple large models including DeepSeek, Claude Code, and Grok. It is very likely that this large-scale attack was carried out under the command of only one human hacker. After the incident was disclosed, the Chinese developer of ARTEX announced on October 8 that the project will be changed from open source to closed source due to the abuse of the tool, and stated that it will not bear any responsibility for such acts.

This crisis is no ordinary hacking incident. It confirms that the widespread concerns about systemic vulnerability in the cybersecurity field in recent months are no longer hypothetical — the speed and scale at which artificial intelligence accelerates vulnerability discovery and potential exploitation are no longer only presented in the subjunctive mood in reports. The fact that a wide range of South Korean banks were hacked by only one non-top hacker has become a real-world manifestation of this shifting trend.

This is not just a comprehensive failure of the financial system, but a complete imbalance of attack and defense costs. Therefore, both the developers of attack tools and the financial institutions that are the targets of attacks have reason to draw new warnings from this incident.

I. What is "new" about this cyber incident?

To understand the legal implications of this incident, we must first see its essential difference from traditional cyberattacks. These differences are not only reflected in technical details, but are fundamental variables that determine how responsibilities are allocated and how defense lines are redrawn.

1. The tool can "think", and the threshold is reduced to "being able to ask questions"

ARTEX is designed as an AI-based autonomous penetration system, originally intended to help companies and institutions conduct cybersecurity tests and risk investigations. It was designed by Chinese cybersecurity engineers, first launched on GitHub in July 2026, and won the championship in Baidu's "agent+" offensive and defensive challenge in August.

However, its capabilities have not only been recognized in competitions, but also made great contributions to the South Korean bank attack incident only one month later.

Cooperating with other large models, ARTEX automates the entire attack and forms a closed loop: It is not as simple as a single scan, nor as simple as a model writing a piece of malicious code. Instead, it coordinates multiple models to divide work and cooperate according to cost, language and tasks, and determines the next round of actions based on the results of the previous round, greatly lowering the technical threshold for the operator — he only needs to know how to deploy the tool to the South Korean bank portal accessible to the Internet, set the task to point to the target, and then wait.

CrowdStrike gave a "moderate confidence" assessment, stating that the human operator may not be a top hacker. But ARTEX amplifies a junior personnel into a multi-target penetration team, achieving results in just a few days that used to take a professional penetration team several weeks to complete.

2. Attack peripheral systems instead of core systems — a rational choice under the "bucket effect"

It is worth noting that the most critical clearing network and accounting database of banks with the most robust firewalls have not been directly breached. All the disclosed damaged assets are concentrated in peripheral auxiliary systems, such as intermediary query systems, employee-friendly office support systems, sales support systems and outsourced personnel databases.

The attacker, or the tool itself, "rationally" chose interfaces with lower protection standards, blank behavior detection but high data value, and used AI's tireless multi-round attempts to completely expose these peripheral weaknesses. The attack method itself is only the old credential stuffing, but the adaptive capability brought by AI — adjusting the rate according to defense feedback, changing proxies, and summarizing which type of portal returns valid records — also gives this old method new lethality.

Therefore, what the ARTEX incident demonstrates is not the highest technical means, but the most efficient and most economical decision made after fully understanding the "security level gap" of the overall system.

3. Dual-use of security tools: from champion to hacking software in only a few weeks

ARTEX was originally not a hacking program, but an open-source agent for authorized penetration testing: it does not generate large model capabilities itself, but connects external dialogue models to sort out assets, scan vulnerabilities, write exploit codes and verify results according to the user's instructions. Its original design intention was to help enterprises find vulnerabilities and conduct red team drills.

The problem lies precisely here — any defense tool that can "plan autonomously, call models autonomously, and act on external networks autonomously" is in turn most suitable for being used by unauthorized persons to attack targets. The same architecture does not need to be rewritten. Only by changing the target, changing the prompt words, and turning off the authorization verification, can it be transformed from a "security assistant" to an "invasion assembly line". ARTEX was an open-source "compliance research project" in July, won the championship in August, and became a "bank intrusion tool" in September. This "weaponization" cycle has been compressed to only a few weeks.

What deserves more attention from legal professionals is the developer's reaction after the incident.

The combination of the software developer's "rapid closure of source code + disclaimer" is uncommon in previous cybersecurity cases. The essential "dual-use nature" of ARTEX as an open-source agent penetration tool, as well as the huge risk consequences to the entire South Korean national financial system, put the developer in a state of "panic" with uncertain responsibilities. Therefore, they carried out "severance" in the most extreme way, completely removing resources from the public domain.

II. Regulatory Framework and Regulatory Difficulties: How to Regulate Cross-border AI Attacks?

Difficulty 1: Compliance Defects of Victims

The post-incident handling by South Korea's Financial Supervisory Service and Korea Financial Security Institute seems to focus on the banks themselves.

Although the scope of this attack is unprecedented in South Korea, not all banks and all systems have suffered the same degree of damage. Investigators said that at least two other banking institutions successfully withstood the same attack and no data loss was confirmed.

In contrast, the banks that were successfully hacked and had their information stolen exposed flaws in their cybersecurity management and technology. Shinhan Bank suffered the most serious losses: attackers stole the names, phone numbers, annual income data and loan limits of about 25,000 customers, as well as 66 national ID numbers and 97 CI identifiers used for online identity verification. This result may be due to certain problems in the identity verification of its loan portal.

The second-phase reform of the Electronic Financial Transactions Act being promoted in South Korea focuses on strengthening the accountability of CEOs and boards of directors for cybersecurity, and the fine system is written into the law. This means that the logic of supervision is: even if the attack method is unprecedented, the basic protection obligation of infrastructure operators is not reduced accordingly. The compliance defects of the victims and the illegal responsibilities of the attackers are two independent issues, but they are often confused in public opinion and litigation.

However, for the loss of most financial institutions' peripheral systems in the ARTEX incident, should the threshold of duty of care be raised in accordance with "reasonable technical measures in the AI era"?

Difficulty 2: Signal from FTC Investigation: Model Vendors Are Not Neutral Pipes

At the same time as the South Korean bank incident — the end of September 2026 — the U.S. Federal Trade Commission (FTC) launched an investigation into Anthropic and OpenAI, focusing on whether their large models are used to generate fraudulent, misleading and infringing content. One of the key issues of the investigation is whether these agents are allowed to access, detect or compromise third-party websites and systems? The FTC's investigation was also triggered by the HuggingFace leak incident caused by agents. It sends a signal that regulators are beginning to ask "whether vendors have fulfilled their reasonable duty of care when model capabilities are weaponized".

If this logic extends to the ARTEX incident, it will become: the application programming interfaces of DeepSeek, GLM, Grok and Claude Code are used for autonomous penetration, whether the vendors know it, can block it, and have retained session logs for law enforcement.

Furthermore, we will have to face a problem of legal status transformation: when the model application programming interface is used for attacks, is the vendor a neutral pipe or a subject capable of reasonable interception?

Difficulty 3: The global distribution of attack infrastructure makes national affiliation meaningless

CrowdStrike's report reveals a key fact: among the attack infrastructures identified by investigators, the United States accounts for 65.7% of IP addresses, China 14.8%, Hong Kong 10.9%, and the rest are scattered in other countries and regions. The attacker used a Hong Kong master control server, a U.S. cloud host, and multi-country proxy nodes. The tool itself is open to the public, and anyone can download, modify and deploy the code on GitHub. The IP addresses are distributed all over the world, which means that you cannot infer the attacker's nationality or national background from "which country has more IP addresses".

It is reported that the Financial Security Research Institute shared the identified foreign attacker IP addresses with the cloud service providers hosting these IPs, and required these operators to block malicious traffic at the infrastructure level. But whether this regulatory measure is strong and effective remains to be verified.

This is not the traditional narrative of "hackers from a certain country invading banks in another country", but a cross-border attack "launched by a globally distributed infrastructure, armed with open-source tools, and empowered by models from multiple countries". The legal significance of national affiliation has been severely weakened in such incidents, and cross-border law enforcement is also full of many uncertainties.

Difficulty 4: Responsibilities of Open Source Developers

The responsibilities of open-source developers usually need to be comprehensively determined in combination with license agreements, rights restrictions, security compliance measures and the degree of information disclosure. In principle, free open-source software and commercial services should be treated differently.

ARTEX has a strict disclaimer marked in its GitHub repository, prohibiting use against unauthorized systems. However, there is a huge gap between intention and actual effect. In legal practice, a simple "as is" disclaimer cannot automatically exempt all responsibilities.

But if regulators want to set such responsibility boundaries for open-source software developers, they have to face a problem and contradiction: should open-source agents be subject to release review like commercial service software? Strictly controlling security-related open-source software may damage legitimate red team testing, while complete laissez-faire will lead to the situation where "the software becomes hacking software just a few weeks after its release".

III. Conclusion: Two Lessons

This incident leaves different lessons for two types of subjects, but the underlying logic is interlinked.

For financial institutions: your security level depends on your weakest interface.

The attack logic of AI agents is efficiency-driven — it does not pick the most famous target, but only picks the easiest entry to break through. This means that cybersecurity follows not the "average intensity" or "maximum intensity", but the "bucket effect" — the lowest point is the height of the fence: as long as the authentication or rate limit of one interface of the loan intermediary portal, employee mobile system, or outsourced personnel database is weaker than that of the core department and peers, you may become the attacker's choice.

In an era when AI can probe hundreds of targets at the same time, cybersecurity not only needs to protect all entrances as core portals, but also needs to compare with neighboring banks. If your guardrail is an inch lower than that of your peers, you will take the blow for the entire industry.

For large model vendors: capabilities can be open source, but responsibilities cannot.

What model vendors provide is a machine that can plan autonomously, call tools and change strategies. The usage policy is written on the website, and attackers will of course ignore it. The real compliance bottom line is not "we prohibit illegal use", but "whether we have made illegal use sufficiently difficult at the product level" — target whitelist, authorization verification, manual approval of dangerous actions, and full-link logs. Without active defense technologies and compliance actions, the disclaimer is just a line of text. Closing the source code can cut off future risks, but it cannot cut off the versions that have been spread out and the damage consequences that have occurred.

This article is from the WeChat official account "Internet Law Review", author: Zhang Ying, authorized to be released by 36Kr.