In one of the first documented cases of AI agents weaponized against real financial systems, CrowdStrike revealed on October 7 that a suspected Chinese-speaking attacker used Anthropic's Claude Code alongside ARTEX, a recently released open-source agentic penetration-testing tool developed in China, in a campaign against South Korean financial firms that ran from late September into early October 2026 and ended with actual data exfiltration.

CrowdStrike discovered the campaign through attacker-controlled servers left open to the internet, exposing Claude Code session histories, Claude memory files and ARTEX configuration files. ARTEX itself is not a model — it is a multi-agent autonomous pentest system that routes to external LLMs. Analysis showed it using DeepSeek v4.1-flash as its main backend, with GLM-5.3 and Grok 4.6 in other sessions. The attacker even asked Claude where stolen Korean bank data is typically resold, and requested help finding Korean Telegram data-sale groups.

The scale is serious: at least nine South Korean banks have been disclosed or reported as targets, and South Korean police opened an investigation. Reuters reported that the suspect may be a 26-year-old based in Guangdong province, financially motivated rather than state-directed — an assessment CrowdStrike made with moderate confidence.

The uncomfortable takeaway: off-the-shelf AI agents can now let a single person run a multi-target campaign that once required a team. As agent tool-calling grows more powerful, defending against them means treating agent frameworks as potential attack tooling, not just productivity software.

Sources