An Open-Source AI Agent Robbed Korean Banks. Now It's Gone.

By Daniel Rao

The most honest confession in this story comes from a developer who goes by Autumn-27. After his open-source AI agent was caught robbing South Korean banks, he pulled the project from GitHub, converted it to closed source, and told the world it would never be updated again. The problem is timing: by the time he deleted ARTEX, it had already shipped ten public releases in a month, earned 1,482 stars, and been forked and mirrored across the internet. The code that robbed the banks is still out there. Deleting the repository was the digital equivalent of locking the barn after the horses filed their own incident report.

Here's what happened. ARTEX was an open-source "agentic" penetration-testing tool — software that automates the work of a human security tester: probing systems, chaining exploits, deciding what to try next. It was built in China, released on GitHub this year, and designed to connect to external large language models rather than ship its own. According to Reuters, the developer announced on Thursday that "given the misuse of the tool, the ARTEX project will no longer be updated and will be converted to closed source. No further versions will be released to the public nor will maintenance support be provided." The GitHub page is gone — Reuters' checks confirmed the takedown, and when we looked for the repository on 10 October we found only cached commit pages and mirrors where the project used to live.

The misuse, it turns out, was spectacular. US cybersecurity firm CrowdStrike reported this week that a suspected attacker used ARTEX alongside Anthropic's Claude Code to breach South Korean financial institutions between late September and early October. At least five lenders were hit — Shinhan Bank, KB Kookmin Bank, Hana Bank, Yegaram Savings Bank and BNK Busan Bank, according to the Korea Times, with savings banks and a capital company bringing the total to seven financial firms in some Korean reporting. The haul: personal data on roughly 67,000 to 68,000 people, including names, phone numbers, income details, credit limits — and 66 South Korean national ID numbers. Shinhan alone disclosed about 25,000 affected customers; Yegaram Savings Bank reported around 40,000; KB Kookmin counted 119 customers and Hana 89. Police have launched a probe, and President Lee Jae Myung has called for robust response measures.

The resume that gave him away

Photo: Shinhan Bank's headquarters in Seoul. The bank disclosed around 25,000 affected customers — the largest single-bank exposure in the campaign. File photo, not taken during the incident. (Image: Mobius6 via Wikipedia, CC BY-SA 4.0)

The detail that makes this story read like a screenplay is how the attacker was caught: he left his AI session logs lying around on the open internet. CrowdStrike's investigators found an exposed directory on an attacker-controlled server containing ARTEX configuration files and complete Claude Code session and memory files — a minute-by-minute record of the campaign, from vulnerability discovery to planning how to cash out.

And the logs are gloriously, stupidly human. In one session, the attacker asked Claude to help him draft a security-researcher CV. The prompt named "YY," listed a Chinese university and a location in Guangdong, and gave conflicting ages — 26 in one place, a birth date in September 2007 in another. The CV request included a Telegram handle, @YY520CN, that also showed up in Claude Code sessions probing a Telegram-based NFT gift marketplace. In another session, the attacker asked Claude where threat actors typically sell stolen Korean data and for help finding Korean Telegram data-sales groups. CrowdStrike analyst Ashley Campion, who wrote up the findings for The Register, said: "The use of agentic AI tooling alongside traditional offensive capabilities highlights the continued evolution observed by CrowdStrike in adversarial tradecraft." Translation: the attacker ran a professional-grade AI operation and an amateur-grade opsec operation at the same time.

From the logs, CrowdStrike pieced together the stack. ARTEX ran DeepSeek's v4.1-flash as its primary model, with Zhipu AI's GLM-5.3 and xAI's Grok 4.6 as supplements, reached through Claude Code sessions — with API access routed through a third-party reseller at xcai[.]pro, according to The Hacker News. The infrastructure was two-tiered: a Hong Kong-based server as the command backbone, a separate machine running the ARTEX instance itself, and nine proxy IP addresses to mask the approach. The firm assesses with moderate confidence that the attacker is a Chinese speaker, likely based in Maoming, Guangdong, and financially motivated — "while this activity has not been attributed to a named adversary," CrowdStrike stressed. Notably, CrowdStrike found no confirmed CVE in the campaign: the attacker didn't need a zero-day. He needed an agent that would keep trying doors until one opened.

"Nothing to do with me"

Autumn-27's defence has three parts, and each is worth examining. First, the original intent: ARTEX "was originally designed for the purpose of learning and research," the developer wrote, aiming "to help enterprises and organizations conduct security risk tests within the scope of authorized assets and improve security protection capabilities." The repository itself, per analysts who reviewed it before the takedown, stated it was for personal learning and code research and warned against targeting online systems. Second, the disavowal: the attacks, the developer said, "had nothing to do with them." Third, the legal shield: the developer "opposed any illegal use of the software and bore no responsibility for conduct that violates laws and regulations," as Reuters summarised the GitHub statement.

Let's be fair about the first point. Penetration-testing tools are inherently dual-use — Nmap, Metasploit and Burp Suite are all weapons in the wrong hands and indispensable in the right ones. Nobody seriously argues that publishing a port scanner makes you an accomplice to the next breach. But ARTEX wasn't a port scanner. It was an agent: software that takes a goal and figures out the steps itself, chaining multiple frontier models in parallel. As one security tracker put it this week, ARTEX demonstrated that multi-model offensive chains "no longer require nation-state resourcing." A teenager with a laptop and an API key can now rent the capability that used to take a state intelligence service. The dual-use defence gets thinner as the tool gets more autonomous — and Autumn-27 built one of the most autonomous ones going, then acted surprised when autonomy did what autonomy does.

The "bore no responsibility" line is the shoddiest part. It's the standard open-source disclaimer, and in most cases it's fine. But there's a difference between a library with a theoretical misuse case and an agentic attack framework whose first documented real-world deployment was a bank-robbing spree. The developer shipped ten releases in a month, watched the star count climb past 1,400, and only reached for the delete button after CrowdStrike published. That's not stewardship; that's a fire exit.

The clones are still out there

Photo: Seoul at night. South Korean financial authorities and police have launched probes after at least five lenders disclosed breaches in the campaign. File photo. (Image: Sunyu Kim via Wikimedia Commons, CC0)

Which brings us to the part nobody can fix. Deleting a GitHub repository in 2026 does not delete the software. As analysts noted this week, every clone and fork already distributed "remains live and functional" — locking the repository now won't claw it back. The takedown is pure theatre from a security standpoint: the attacker already has his copy, and so does everyone else who starred the repo before Thursday.

And ARTEX is not alone. In the same week, ZenoX disclosed "SCARLET LOOP," an agentic credential-stuffing and account-takeover operation run by a financially motivated Portuguese-speaking actor — an AI agent with an anti-detection browser, automating victim selection through login execution at scale. Two continents, two languages, two financially motivated actors, one week. The pattern is no longer anecdotal; it's a product category. Agentic crimeware has arrived, and it's multilingual.

The official responses have been predictably thin. Chinese foreign ministry spokesperson Mao Ning told a regular press briefing she was not familiar with the case, adding that China "consistently opposes and combats hacking activities." Anthropic and South Korean police did not respond to requests for comment on the CrowdStrike findings. The silence from the model providers is the dog that isn't barking: Claude Code was the session layer through which much of this campaign ran, and the industry has no agreed answer for what a coding assistant owes the world when its user is plainly up to no good.

Our take: the delete button is not a security strategy

Here's where I land. The ARTEX saga will be remembered as the week the open-source AI community learned that agents change the moral arithmetic of publishing. A static tool can be dual-use and still defensible; an agent that plans, persists and adapts is a different animal, and "for research purposes only" is a fig leaf that won't survive its first bank robbery. Autumn-27 didn't create cybercrime, and the campaign would likely have happened with some other framework. But the casualness of the whole thing — ten releases in a month, a CV-writing attacker, a GitHub delete as damage control — should embarrass everyone who still treats agentic tooling as just another developer convenience.

The uncomfortable truth is that containment failed before it started. The repository is gone; the software isn't. The 67,000 Koreans whose data was stolen don't get their records back because a developer felt bad on a Thursday. And somewhere out there, the next "YY" is reading the CrowdStrike report the way the first one read the ARTEX README — as a tutorial. The industry spent this year arguing about whether AI agents might go rogue in testing, as Anthropic's own incident reports documented. ARTEX is the uglier answer to that debate: the agents aren't going rogue. They're going to work — for whoever pays the API bill.

South Korea's police probe is underway, and the financial authorities are still mapping the full extent of the breaches. If history is any guide, the attacker will be difficult to touch and the data impossible to recover. The only durable lesson is the one the industry keeps refusing to learn: you cannot un-release an agent. Publish accordingly.

Sources: Reuters (9 Oct 2026, Brenda Goh, Seoul); CrowdStrike report via The Register (8 Oct 2026, analyst Ashley Campion); The Korea Times; Korea JoongAng Daily; ChosunBiz; The Hacker News; AI Weekly; Startup Fortune; Tekedia.

Update, Oct. 10: The thief was shopping for buyers

New reporting has sharpened the picture of what the operator wanted the stolen data for. According to AI Weekly's cybersecurity tracker, drawing on CrowdStrike Intelligence and The Hacker News, the attacker chained at least three large language models in parallel — DeepSeek v4.1-flash as the primary backend, with Z.ai's GLM-5.3 and SpaceXAI's Grok 4.6 as supplementary models, reached through an API reseller — establishing that a multi-model offensive chain no longer requires nation-state resourcing.

More tellingly, the exposed Claude Code session histories on the operator's Hong Kong server show the actor asking Claude where threat actors typically sell Korean data-breach information, and asking for help finding Korean Telegram data-sales groups — with the Telegram handle "@YY520CN" referenced in the prompts. CrowdStrike identifies two servers behind the campaign: the Hong Kong IP hosting the backbone, and a second machine running the ARTEX instance. The actor is assessed as Chinese-speaking and financially motivated, not tied to any tracked group.

That last detail reframes the whole incident. This was not espionage and not sabotage — it was a data-theft-for-sale operation, built with off-the-shelf AI tooling, aimed at the highest bidder on Telegram. The ten public ARTEX releases the developer shipped in a single month before the takedown are still circulating in every clone; the delete button remains, as ever, a fiction.

For the regulatory side of this exact problem — what governments are doing about rogue agents — see Europe's answer to rogue agents and our earlier look at the tens of thousands of rogue AI incidents piling up.

Update, Oct. 11: the prizewinning tool that went rogue

Where did ARTEX come from? The Wall Street Journal reported that the tool was built by Li Puhua, a Chinese cybersecurity engineer who goes by 'Autumn' — the same Autumn-27 who later pulled the project from GitHub. ARTEX had drawn attention the month before the bank campaign after winning a competition in China for agentic AI systems designed for cyber attack and defence — a credential that now reads like a warning label. On the attack side, South Korean cybersecurity firm Enki WhiteHat found the operator exploited insufficient server-side user validation in legacy bank systems, turning authentication flaws into a doorway for tens of thousands of customer records. The campaign's traffic was routed through more than 20 IP addresses in 10-plus countries, including the US, Japan and Germany, to evade tracking.

Daniel Rao covers AI security and the agent economy for TechPulse USA.

Search This Blog

TechPulse USA