At least nine South Korean banks were hit by cyberattacks last month, and the country's police are investigating. Analysing the servers involved and the AI coding tools used, the US security firm CrowdStrike says the attacks may trace to a 26-year-old man in Guangdong province, southern China — working with a Chinese-built AI agent and code written using Anthropic's Claude.
According to CrowdStrike's report, the attacker used ARTeX, a Chinese open-source penetration testing tool. Tools of that kind probe a network's defences to find weaknesses, and are ordinary equipment for security professionals. Alongside ARTeX the attacker used several large language models. No known hacking group has been linked to the attacks.
Adam Meyers, senior vice-president of CrowdStrike's counter adversary operations, said the episode shows how one individual can use AI agents to attack many organisations in a short time — and raises the question of how effective conventional corporate defences are against attacks run this way.
The headcount is the finding
Banks have been attacked before and will be again. What is different here is the number of people on the other side.
Defensive thinking is built around the resources an attacker needs. Hitting nine banks at once has historically meant an organised group: people to find the weaknesses, people to write the tooling, people to run the intrusions, and a structure to coordinate them. That requirement is itself a defence, because groups are slower to form, easier to infiltrate and easier to attribute.
An agent removes much of it. The reconnaissance, the tool adaptation and a good deal of the code can be delegated, so one competent person operates at a scale that previously needed a team. Nothing in the attack has to be novel for this to matter — the same techniques, run at many times the rate, against targets that were each defended on the assumption of a slower adversary.
Note also what the attacker reportedly used: an open-source testing tool and commercial language models. Nothing exotic, nothing stolen.
What it means for a bank in Dhaka
Bangladeshi banks are not obviously less exposed than South Korean ones, and one defensive assumption in common use here stops working against this pattern.
Smaller institutions often reason, quietly, that they are not worth a sophisticated adversary's time. That reasoning was never comfortable but it was arithmetically real: a skilled team had to choose its targets. An individual running agents does not have to choose in the same way, because the marginal cost of adding another target is small. Being unimportant stops being protective.
The practical implications are dull and well known, which is the problem with them. Multi-factor authentication on every administrative account. Patching on a schedule somebody is accountable for. Logs that are actually read, and alerting that someone acts on at 3am. None of that is new advice. What changes is the rate at which an unprotected weakness will be found.
Why this is hard to see coming
An agent-driven intrusion does not look dramatic in a log. It looks like a lot of ordinary, individually unremarkable activity: directory listings, login attempts at a reasonable rate, requests to endpoints that exist.
Detection tuned to catch a human attacker looks for the signature of someone working — bursts, pauses, mistakes, the same wrong guess repeated. An agent produces fewer of those tells, because it does not get tired or impatient, and it does not repeat a failed approach out of stubbornness.
What it does produce is volume and regularity. For most institutions the most useful single change is not a new product but answering one question: does anyone see a list, each morning, of every administrative login and every failed authentication from the previous day? If the answer is no, that is the first gap, and it is cheaper to close than anything else on the list.
The other side of the same technology — AI systems being attacked, rather than doing the attacking — is in the OpenAI agent that reached an Australian government portal and the impersonation of an Anthropic executive. On what happens when a model is embedded in critical infrastructure, see the Pentagon's eight-month removal of Claude.
