AI Is No Longer Just Advising Attackers. It’s Helping Them Attack.

Attacks on South Korean financial institutions show how agentic AI is moving from security labs into real cyber attacks. What does this mean for businesses, and why are detection and response times becoming even more critical?

Artificial intelligence is already part of the attacker’s toolkit. It can help write phishing messages, analyse data and generate code.

The South Korean case points to the next stage: AI tools are taking on parts of the work that attackers previously had to perform manually.

An AI agent in the attacker’s toolkit

On 7 October 2026, CrowdStrike published an analysis of a campaign targeting South Korean financial organisations that resulted in data theft.

Researchers examining attacker-controlled infrastructure found ARTEX, an agentic penetration-testing tool that was available as open source at the time, alongside configuration files and records of activity involving large language models. The findings are detailed in CrowdStrike’s original analysis.

Reuters reported attacks affecting at least nine South Korean banks. However, CrowdStrike noted that the precise number of organisations affected by the campaign it analysed remained unconfirmed at publication.

What makes the case significant is the role AI played. ARTEX works with large language models to support security testing. Capabilities that help security professionals identify vulnerabilities can also be used by attackers.

Following reports of misuse, the developer announced that public updates would end and the project would become closed source, as Reuters reported on 9 October 2026.

This does not mean AI is hacking banks on its own

It is essential to distinguish the evidence from the headlines. The published findings do not establish that an AI agent independently planned and executed an entire attack without human direction.

They do document the use of agentic AI tools within the attack infrastructure. The case illustrates how agentic AI is being combined with established offensive techniques.

For businesses, that development matters more than the idea of an autonomous hacker. An attacker does not need to hand over the entire operation to AI. Accelerating reconnaissance, exploring possible entry points, testing alternatives or automating repetitive tasks can already make a difference.

The economics of cyber attacks are changing

Human effort is one of the practical constraints on a cyber attack. Detailed reconnaissance, vulnerability research and testing different approaches take time and expertise. Agentic AI can speed up parts of that work.

The result may be more than a sophisticated attack. It may be a greater volume of attacks.

From an enterprise risk perspective, this could also influence target selection. Organisations that previously offered too little return for a skilled attacker may become more attractive as automation reduces the effort involved. This is a potential implication of the trend, rather than a finding about the specific targets of this campaign.

The cited analysis does not identify the Czech Republic as a target of this campaign. The broader trend is nevertheless relevant to Czech businesses.

As attacks become more automated, defence must move faster

AI in cybersecurity increases the pressure on the speed of the entire defensive process. Organisations need to understand:

• which parts of their infrastructure are exposed to the internet;
• where their most critical vulnerabilities are;
• whether signals of a developing attack are appearing around their organisation or brand;
• what is happening inside their network;
• and how quickly they can respond to unusual behaviour.

This is where Threat Intelligence, vulnerability management and network visibility come together.

An alert about a new vulnerability is only the starting point. Businesses need context: does it affect us? Are attackers exploiting it? Do we have an exposed system? Are there other signs that someone is probing our infrastructure?

AI is changing both sides of cybersecurity

The same technology can also support defenders. AI can help analyse large volumes of security events, identify anomalies, prioritise risks and automate selected response actions.

In this evolving contest, speed, context and the ability to connect information across the infrastructure are becoming increasingly important.

The ARTEX case shows how AI tools can extend an attacker’s capabilities. The practical lesson for enterprise security is clear:

If AI enables one attacker to do more in less time, defence cannot continue to rely solely on manual response.

Illustrative photograph: Stephen Leonardi / Pexels (licence). The building shown is not identified as a target of the campaign.