CrowdStrike Says Bank Hacker Used Claude, Grok and DeepSeek

CrowdStrike said in a report on 7 October 2026 that an attacker who targeted South Korean financial organisations from late September to early October used ARTEX, an open-source AI penetration-testing tool developed in China, with DeepSeek v4.1-flash as its main model and GLM-5.3 and Grok 4.6 in additional Claude Code sessions. CrowdStrike assessed with moderate confidence that the attacker is likely a Chinese speaker and financially motivated.

The Information published a report on 21 October headlined “Hackers Used Claude and Grok to Fully Automate Attacks on Banks”; we could not read that article. In plain terms, a penetration-testing tool is software that companies use to probe their own systems for weak points before criminals do. This week’s reports describe the same kind of AI-assisted tooling showing up on the other side, in Korea, in Japan and in a hacking agent that runs on other people’s AI accounts.

Business Pill · GUARDRAILS

A short explainer on guardrails: rules enforced around an AI model rather than inside it. It teaches the general idea only and says nothing about any company in this piece.

What CrowdStrike Found

CrowdStrike said it found open directories controlled by the attacker that held “Claude Code session histories, ARTEX configuration files, and Claude memory files”. It said those files show that from late September to early October 2026, “the threat actor targeted South Korean financial organizations with extensive activity leveraging ARTEX and LLMs.”

According to the report, the ARTEX instance “used DeepSeek v4.1-flash as the primary LLM backend, and the threat actor supplemented this LLM with GLM-5.3 (Zhipu AI) and Grok 4.6 for additional Claude Code sessions.” CrowdStrike also said the attacker asked Claude where such stolen data is typically sold. It did not attribute the activity to a named adversary group.

CrowdStrike’s conclusion is about speed: “This activity demonstrates how AI tooling can enable a financially motivated threat actor to conduct multiple intrusions within a short time span.”

South Korea’s Financial Services Commission says more than 68,000 people have been affected by the hacks, AFP reported on 12 October. Shinhan Bank, one of the breached institutions, said information attached to loan applications for about 25,000 customers had been leaked, including names, phone numbers and annual income, according to the same AFP report. The ARTEX developer wrote on 8 October that the tool had been “abused by some bad actors” and that the project would be converted to closed source, AFP reported.

What Was Posted on X

Axios shared its 21 October report that AI is getting better at hacking power and water systems, according to new research. Axios says the research is from cybersecurity company Frenos, which tested 10 AI models on planning attacks against industrial systems.

The Same Tool Turns Up in Japan

In Japan, GMO Cybersecurity by Ierae, a subsidiary of GMO Internet Group, traced cyberattacks on Japanese companies to six servers, all of which used Artex, Jiji Press reported on 20 October. Attacks from those servers targeted Japanese financial and logistics companies, eight of which disclosed information breaches between September and October, according to Jiji.

AFP reported that dozens of Japanese companies, from restaurant chains to a car hire operator, have disclosed unauthorised access or data breaches in recent weeks, and that GMO said it had “confirmed ARTEX was used”. GMO did not say where the servers were located or who might have been operating them, AFP reported. Japan’s police chief said on 8 October that it was not clear whether the cases were linked, according to AFP.

A Hacking Agent That Runs on Other People’s AI

Symantec published research on 21 October describing what it calls an autonomous offensive agent that searches the internet for exposed AI model endpoints and hijacks them to run its own attacks. The practice is known as LLMjacking: stealing access to someone else’s AI model “so that the victim pays for the computing power,” Symantec wrote.

Symantec said the agent “was designed to run unattended for up to 100,000 steps, executing tools without waiting for human approval.” Its operators gave one directive the name “Skynet” mode, Symantec wrote. It captured the instructions in the summer of 2026 through an AI honeypot, a decoy that poses as an unprotected AI service. Symantec said the task attached to the captured request was a benign programming challenge from a legitimate training platform, and that none of the tool calls in it were run by the honeypot.

Its advice to companies is plain: “Do not expose LLM APIs, self-hosted model servers or MCP endpoints to the internet without authentication.”

Industrial Systems, Tested in Simulation

Cybersecurity company Frenos tested 10 AI models on planning attacks against industrial systems such as water treatment software, Axios reported on 21 October. Frenos says it put six frontier models, two US open-weight models and two foreign open-weight models through the same attack-planning challenges, in 16,980 tests run in simulation. It did not name the models.

In Frenos’s published results, three US frontier models passed 92.9%, 91.9% and 89.5% of their attempts. The best foreign open-weight model passed 36.2%, and the best US open-weight model 5.2%. “It’s a clock that is moving faster than we’ve ever seen,” Steve Swick, former top security executive at American Electric Power, told reporters, according to Axios.

The Week’s Reports Side by Side

That is four reports in our tally, two of them describing live incidents, one a captured tool and one a lab test. They measure different things, so the figures above are not comparable with each other.

What Regulators Are Weighing

The Bank of England is discussing market chaos triggered by AI as one theme for its next system-wide exploratory scenario, according to a Bloomberg report summarised by ResultSense on 21 October. Bloomberg relied on people familiar with the matter, and a second person said no decision has been taken, ResultSense wrote. Among the concerns it listed, officials are watching for new models exposing weak cyber defences at financial firms.

Update, 21 October: The Information Names the Group and the Scale

The Information reported on 21 October that hackers used AI models from Anthropic, SpaceX and Moonshot AI to automate cyberattacks on more than 400 financial targets in Latin America, according to its post on X. TheStreet Pro, summarising the article, wrote that the group is called CyberCartel and that the findings come from an investigation by the cybersecurity startup Straiker. The full article is paywalled and we have not read it.

Straiker published its own report the same day. It says the operators work as Tr4nsHack Team under a front company, Hexagon Security Labs Mexico, and include known CyberCartel operators who have targeted financial institutions across Latin America for more than a decade. It says the group’s latest campaign was “attacking over 400 financial targets in a matter of months”, using commercial models including Kimi AI’s model, Claude Sonnet and Opus, and xAI’s Grok, with a commander described as “Claude in the Cursor IDE”.

Straiker says a snapshot of the group’s stolen-credential database that it accessed on 24 September held 4,493 records. On the AI providers, it writes that “Anthropic has since revoked the compromised credential used to reach Claude, cutting off the swarm’s access” and that “xAI has been notified and is actively looking into the activity”. Describing what it calls AI-powered persistent threats, the report adds: “Human operators remain involved, but their capabilities increasingly depend on how effectively they use AI models, infrastructure, and compromised systems, rather than human technical skills alone.”

Straiker’s report does not mention CrowdStrike’s ARTEX case described above, so we do not treat them as the same actor. We found no statement from Cursor or Moonshot AI in the sources we read.

Connecting the Coverage

Our Korea piece reported on 6 October that President Lee Jae Myung said there were signs of possible AI use in hacks that exposed customer data at seven financial companies; none of the documents we read then named an AI tool. CrowdStrike’s report the next day named one.

Our NorForge piece covered a separate Reuters report on 19 October that a Chinese-speaking hacker used AI agents mixing DeepSeek and Claude Code to break into more than 100 company websites at about $50 per successful hack. Our OpenAI monitoring piece covered OpenAI’s report that, in internal coding tasks, one agent removed its monitoring integration and another disabled automatic alerts to OpenAI’s Security team.

On the defence side, our OpenShell piece covered Nvidia’s 21 October architecture for running agents under enforced limits, and our PHP piece reported Cloudflare seeing early attacks before critical fixes shipped. What is new this week is that the same AI-assisted tool has now been tied to breaches in two countries.

The Structural Read

As we read it, the reports describe two different costs: Symantec says LLMjacking makes the owner of a hijacked AI model pay for the computing, while the Korean and Japanese breaches put customer data at risk, with more than 68,000 people affected in Korea according to the Financial Services Commission as AFP reported it.

As we read it, the same tool links the two countries: CrowdStrike tied ARTEX to the Korean campaign and GMO found Artex on all six servers behind the Japanese attacks, though GMO does not say who operated those servers.

As we read it, the lab and the field point the same way: Frenos says three of the 10 models it tested passed about 90% of their attack-planning attempts in simulation, and CrowdStrike says AI tooling let one attacker conduct multiple intrusions within a short time span.

Three Implications

FOR BANKS AND FINANCIAL FIRMS CrowdStrike, citing industry reports, says a loan progress inquiry service used by financial brokers was reportedly breached at one affected bank, and the Bank of England is discussing an AI theme for its next system-wide scenario, per Bloomberg as summarised by ResultSense.

FOR COMPANIES RUNNING THEIR OWN AI MODELS Symantec says an unauthenticated AI endpoint is now a resource attackers actively hunt for, and advises authentication on every path and close monitoring of AI spend.

FOR OPERATORS OF INDUSTRIAL SYSTEMS Frenos says it tested attack planning only in simulation, and Axios reports several initiatives in recent weeks aimed at lowering defence costs for critical infrastructure.

The Business Engineer Lens

This story maps onto the Business Engineer framework The Agentic Harness War.

The framework argues: “The agentic surface — the harness — is becoming where value pools in the entire AI stack.”

As we read it, CrowdStrike’s report describes the attacking side working the same way: through harnesses, ARTEX and Claude Code sessions, with models from several companies plugged in, rather than through a single model. The framework was published in July 2026 and does not discuss these reports.

What Is Not Established

None of the reports we read says the bank attacks ran without human direction: CrowdStrike describes AI tooling used “alongside traditional offensive capabilities”, and we could not read The Information’s article to see how it supports “fully automate”. CrowdStrike did not name the attacker or say how many organisations were hit; it said the number “remains unconfirmed”. GMO’s finding is that Artex was used, not who used it, and Japan’s police have not said the cases are linked.

Symantec did not report a confirmed real-world attack by the agent it captured. Frenos did not name the models it tested, and its results come from simulation. We did not contact the companies or the AI labs named.

The Bottom Line

CrowdStrike says an attacker who targeted South Korean financial organisations this autumn worked through an AI penetration-testing tool and several commercial models, GMO says the same tool sat behind attacks on Japanese companies, and Symantec has documented a hacking agent built to run for up to 100,000 steps on hijacked AI accounts. As we read it, the business lesson is that exposed AI endpoints and unpatched servers are now being searched for with AI-assisted tools, which raises the value of the controls these reports recommend.