South Korean Banks Were Hacked Using Chinese AI Agent, Researchers Say

The perpetrator of a recent hack of South Korean financial institutions that resulted in data leaks used an open-source Chinese AI agent called Artex and Chinese large language models, according to a report published this week by cybersecurity firm CrowdStrike.

The analysis of the incident shows how rapidly evolving autonomous AI agents and highly capable Chinese open-source models could enable hackers to execute large-scale cyberattacks that previously required vast resources. The campaign that began late last month targeted South Korea’s major banks and exposed personal information of about 68,000 customers, according to local media reports.

Artex is an open-source AI agent and security tool developed by Chinese engineer Li Puhua. The session histories for Claude Code and Artex linked to the hacking reveal that the attacker used Chinese models such as DeepSeek’s V4.1-Flash and Z.ai’s GLM-5.3, according to CrowdStrike. The records for Artex also showed Chinese-language prompts.

“This activity demonstrates how AI tooling can enable a financially motivated threat actor to conduct multiple intrusions within a short time span,” CrowdStrike said.