{"id":1404,"date":"2026-10-13T12:04:19","date_gmt":"2026-10-13T10:04:19","guid":{"rendered":"https:\/\/comsource.cz\/?p=1404"},"modified":"2026-10-13T12:04:00","modified_gmt":"2026-10-13T10:04:00","slug":"ai-is-no-longer-just-advising-attackers-its-helping-them-attack","status":"publish","type":"post","link":"https:\/\/comsource.cz\/en\/ai-is-no-longer-just-advising-attackers-its-helping-them-attack\/","title":{"rendered":"AI Is No Longer Just Advising Attackers. It\u2019s Helping Them Attack."},"content":{"rendered":"

Attacks on South Korean financial institutions show how agentic AI is moving from security labs into real cyber attacks. What does this mean for businesses, and why are detection and response times becoming even more critical?<\/strong><\/p>\n

Artificial intelligence is already part of the attacker’s toolkit. It can help write phishing messages, analyse data and generate code.<\/p>\n

The South Korean case points to the next stage: AI tools are taking on parts of the work that attackers previously had to perform manually.<\/strong><\/p>\n

An AI agent in the attacker’s toolkit<\/h2>\n

On 7 October 2026, CrowdStrike published an analysis of a campaign targeting South Korean financial organisations that resulted in data theft.<\/p>\n

Researchers examining attacker-controlled infrastructure found ARTEX, an agentic penetration-testing tool that was available as open source at the time, alongside configuration files and records of activity involving large language models<\/strong>. The findings are detailed in CrowdStrike’s original analysis<\/a>.<\/p>\n

Reuters reported attacks affecting at least nine South Korean banks. However, CrowdStrike noted that the precise number of organisations affected by the campaign it analysed remained unconfirmed at publication.<\/p>\n

What makes the case significant is the role AI played. ARTEX works with large language models to support security testing. Capabilities that help security professionals identify vulnerabilities can also be used by attackers.<\/p>\n

Following reports of misuse, the developer announced that public updates would end and the project would become closed source, as Reuters reported on 9 October 2026<\/a>.<\/p>\n

This does not mean AI is hacking banks on its own<\/h2>\n

It is essential to distinguish the evidence from the headlines. The published findings do not establish that an AI agent independently planned and executed an entire attack without human direction.<\/p>\n

They do document the use of agentic AI tools within the attack infrastructure. The case illustrates how agentic AI is being combined with established offensive techniques<\/strong>.<\/p>\n

For businesses, that development matters more than the idea of an autonomous hacker. An attacker does not need to hand over the entire operation to AI. Accelerating reconnaissance, exploring possible entry points, testing alternatives or automating repetitive tasks can already make a difference.<\/p>\n

The economics of cyber attacks are changing<\/h2>\n

Human effort is one of the practical constraints on a cyber attack. Detailed reconnaissance, vulnerability research and testing different approaches take time and expertise. Agentic AI can speed up parts of that work.<\/p>\n

The result may be more than a sophisticated attack. It may be a greater volume of attacks.<\/strong><\/p>\n

From an enterprise risk perspective, this could also influence target selection. Organisations that previously offered too little return for a skilled attacker may become more attractive as automation reduces the effort involved. This is a potential implication of the trend, rather than a finding about the specific targets of this campaign.<\/p>\n

The cited analysis does not identify the Czech Republic as a target of this campaign. The broader trend is nevertheless relevant to Czech businesses.<\/p>\n

As attacks become more automated, defence must move faster<\/h2>\n

AI in cybersecurity increases the pressure on the speed of the entire defensive process. Organisations need to understand:<\/p>\n