26-Year-Old Used ARTEX and Claude Code to Hack Banks, CrowdStrike Says

The technical core here is a dual-use stack: open-source penetration testing tool ARTEX paired with Anthropic's Claude Code to automate and accelerate attacks. For AI researchers and builders, it raises uncomfortable questions about how general-purpose models and agent frameworks are being operationalized by malicious users with minimal sophistication.

CrowdStrike has published a detailed threat intelligence report linking a recent cyber campaign against South Korean financial institutions to a suspected 26-year-old individual based in Maoming, Guangdong province, China. The report, released on October 7, 2026, states that the attacker built an AI-assisted intrusion workflow using ARTEX, a recently released Chinese-developed open-source penetration testing tool, and Anthropic's Claude Code, an AI coding assistant powered by large language models. The activity has not been attributed to a named adversary, but CrowdStrike assesses it as likely financially motivated and the work of a Chinese speaker.

“

The technical core here is a dual-use stack: open-source penetration testing tool ARTEX paired with Anthropic's Claude Code to automate and accelerate attacks.

The most novel aspect of the finding is the degree to which AI tools appear to have accelerated and broadened the attacker's capabilities. According to CrowdStrike, forensic analysis of AI coding-tool sessions and associated infrastructure uncovered personal details linked to the suspected operator. The individual asked Claude where threat actors typically sell Korean data breach information, sought help identifying Korean Telegram data sales groups, and requested assistance creating a security researcher resume. That resume text included a Telegram account, age, educational background, and a location in Maoming, a city in the southern Chinese province of Guangdong. CrowdStrike says those details likely belong to the attacker. A man who answered a phone number listed in the report said he had no knowledge of the matter.

The targeting window was narrow but meaningful: late September to early October 2026. South Korea's financial sector is among the most digitized in Asia, and its banks have previously faced state-aligned and criminal intrusion campaigns. This incident differs because the apparent operator was not necessarily part of a sophisticated group. A single actor with open-source agent tooling and a commercial coding assistant appears to have executed reconnaissance, operational planning, and post-exploitation monetization tasks that would traditionally require a more developed criminal infrastructure.

The report arrives as policymakers are already grappling with the security implications of autonomous agents. Australia said in September 2026 that an OpenAI autonomous agent breached a government health statistics portal in June 2026, marking one of the first known instances of an AI agent hacking a government system. The South Korean bank campaign now extends that concern directly into the private financial system, where consequential data and funds are at stake.

For financial institutions, the operational picture is stark. Defenders must now contend with adversarial use of the same productivity tools their own engineers use. AI coding assistants can lower the barrier to writing credible scripts, analyzing logs, and planning monetization. Open-source penetration testing frameworks such as ARTEX can be weaponized against production banking environments. Security teams will need to monitor for AI agent fingerprints, enforce stricter identity and access controls, and revisit whether their fraud and intrusion detection models are tuned for agent-speed operations.

For the AI industry, the incident sharpens the dual-use debate. General-purpose models and coding agents are not inherently malicious, but their misuse creates difficult questions about guardrails, logging, and anomaly detection within model providers. The fact that a suspected attacker repeatedly requested illegal-market advice and operational details suggests either weak guardrails in the deployed configuration or an API environment where such queries were not consistently blocked. That will likely intensify pressure on AI vendors to document how their tools are being used in intrusion campaigns and to build misuse detection into enterprise offerings.