ARTEX AI Agent Bank Hack: South Korea Case

The problem in the ARTEX AI agent bank hack is not only that an AI agent attacked banks. It is also that the agent wrote everything down. Instructions sat in a Claude.md file, memory notes loaded into each session, and JSONL transcripts recorded each session in plain text. One open folder held the last three, and researchers followed a Hong Kong IP address to a second server.

What Was the ARTEX AI Agent Bank Hack?

The ARTEX AI agent bank hack was a series of intrusions into South Korean financial institutions between late September and early October 2026, attributed by CrowdStrike to a likely single operator using an open-source agentic penetration-testing tool. CrowdStrike published its report in the week ending October 10, 2026, and reported that the actor breached a loan-progress service at one bank and an employee mobile system at another. South Korean officials said the incident surfaced on September 30, 2026, which puts the campaign at roughly two weeks. The Register covered the case under the angle of a hacker's CV found in exposed AI logs, and Infosecurity Magazine followed with analysis.

Counts of affected banks and customers differ by source, and the difference matters. Reuters counted at least nine banks, but that counted banks that disclosed attacks or appeared in local media, not a CrowdStrike victim count. The Record, citing officials, reported at least seven institutions and at least 68,000 people with affected data. Shinhan said about 25,000 customers were affected.

CrowdStrike linked the activity to an actor tied to China with moderate confidence, based on a tool developed in China and on prompts written in Chinese. China said it had not examined the case. Adam Myers, a senior vice president at CrowdStrike, said the tooling "allows one human to target many customers in a very short period of time using the power of AI."

Two words in that assessment need separating. CrowdStrike called the actor "likely one person," which is probable, not proven. The reach claim, meaning how many targets one person can work through in a short window, is supported by the agent's architecture. The report does not explain how much the actor drove by hand and how much the tool ran alone, so no public source establishes how much skill the actor needed.

How Does the ARTEX Agent Architecture Work?

ARTEX is a Go program backed by a PostgreSQL database that plans and acts in a loop, and CrowdStrike described it as an open-source agentic penetration-testing tool developed in China. The operator supplies an objective, the planner breaks it into smaller steps called intents, and workers execute them. The design fits the reach claim: several workers run at once, and each task keeps its own exploration graph, which supports one person running many tasks in parallel.

A shared to-do list is the closest plain-language analogy. The planner pins intents on the list and refills it across multiple rounds. By default, three workers run per task, executing bash commands and HTTP requests concurrently. In Go, each worker is a goroutine, a light thread, so a slow step in one worker does not have to stall the other two.

The tool writes what it learns into two records. The asset graph stores things the tool has found: domains, IP addresses, services, and endpoints, with each node representing one thing seen. The exploration graph is per task and stores goals, intents, facts, and findings, so the tool keeps a record of what it tried round after round.

A third component, the main agent, handles chat with a human. The ARTEX repository's README calls this human in the loop: the operator can ask questions mid-task, steer work, and watch it. The README also states that scanning or attacking real online systems is prohibited, and a rule in a README does not stop anyone from running the code. The tool's own rules will not protect a target.

The loop can be stated in one sentence: the model proposes steps, workers run them, graphs store results, and the model proposes the next steps. The operator supplies the objective and access to the model. The README also notes that Anthropic OpenAI keys can be set by environment variable or in the UI with an optional proxy, which makes the model a replaceable part.

Which Models Did the Campaign Use?

CrowdStrike named DeepSeek V4.1-Flash as the main language model for this ARTEX instance, with GLM-5.3 and Grok 4.6 added for additional Claude Code sessions. That gives three model names in the report that are not Claude. The distinction matters because a Claude Code session does not always mean Claude the thinking; Claude Code is an agentic coding tool that can run on other model back ends.

Reuters added that the suspect also used Anthropic Claude in the prompts described by Reuters and CrowdStrike, the actor asked Claude directly. The reporting does not say which sessions ran on Claude models and which ran on other back ends. For defenders, one consequence follows: the model is a swappable component, so blocking a single provider will not stop a tool of this kind.

ARTEX shares that swappable design. Its README lists Anthropic OpenAI keys as configurable through environment variables or the UI with an optional proxy. A key is a secret string that lets a program call a model. The report's model list is a snapshot of one configuration, not a fixed property of the tool.

What Does Claude Code Leave on Disk?

Claude Code writes three kinds of records to disk during normal work, and each one answers a different investigative question. Instructions state what the operator wanted. Memory notes state what the agent learned. Transcripts state what happened, in order. Together they reconstruct a session from goal to result, which is useful for debugging and hazardous when strangers can read the folder.

Each Claude Code session starts with a fresh context window, meaning the text the model can see right now. The agent remembers nothing from the previous session. The documentation describes two ways to carry knowledge forward. The first is a Claude.md file that the operator writes, holding instructions such as how to run tests. Claude Code loads it at the start of every session, and the operator can read and edit it. The second is auto memory, notes Claude writes itself and that the tool loads into every session too.

Anthropic own documentation adds a warning: Claude treats both files as context, not as enforced configuration. The files guide the agent; they do not force obedience. A Claude.md file is not a security control. CrowdStrike found exactly such a file sitting in a dot-Claude folder, named Claude.md, containing a Chinese-language penetration-testing prompt that told the model how to run its tests. It sat in an open directory on one server.

The third record is the full session log. Claude Code writes each session as one JSONL file, meaning each line is one complete JSON record, inside a projects folder under .Claude in the user's home directory. A busy server can accumulate many of them. The log is plain text and anyone who can read the file can replay what the agent was asked and what it did.

By default, Claude Code deletes these logs after 30 days, and a cleanupPeriodDays setting in settings.json inside .Claude changes that. Simon Willison described this behavior in an October 2025 post on Claude Code's local logging, and the current default should be checked in Anthropic documentation. Thirty days is longer than the span CrowdStrike describes, so a campaign from late September to early October 2026 would still be on disk if the actor kept the default. The actor's actual setting is unknown.

How Did One Exposed Folder Lead to a Second Server?

Researchers first examined an exposed directory on a server tied to the attacks, according to The Register, and that directory held the Chinese-language instruction file. CrowdStrike said the same file referenced an IP address in Hong Kong. The researchers followed that reference to a second server, where open directories held Claude Code session histories, ARTEX configuration files, and Claude memory files.

The sessions found there covered late September to early October 2026 and targeted South Korean organizations. The instruction file named the second server, and that server's folders held dated sessions aimed at South Korean organizations. One exposed folder revealed a larger operation.

Each file type answers a different question for an investigator. Session histories show what the operator asked and when. Configuration files show how the tool was set up. Memory files show what the agent had learned. The contents of the configuration files are unreported, and why the folders were open, for how long, and who else read them are also unknown.

A web server or file share that serves a home directory can expose a .Claude folder as a general possibility, and nothing in the public record shows that this is what happened here. Imagine a team sharing build files from a file server whose share root is a home directory. Every dot folder in that directory is shared too, including .Claude nobody on the team chose to publish it.

The prompt that drew attention asked Claude to write a security researcher resume with bullet points about the ARTEX activity. Reuters said the prompt came from a Claude session. The prompt held personal details, and CrowdStrike said they likely belong to the actor but cannot be definitively associated from available information.

What Did the Operator Ask Claude to Do?

Reuters and CrowdStrike describe prompts in which the actor asked Claude where threat actors typically sell Korean data breach information and asked for help finding Korean Telegram sales groups. The reporting does not say when in the campaign these questions were asked, and whether Claude answered, refused, or flagged them is unknown. Nothing primary shows what Anthropic afterward.

The resume prompt is the second documented request. It asked Claude to write a security researcher resume with bullet points describing the ARTEX activity. The prompt contained personal details that CrowdStrike said likely belong to the actor, with the caveat that available information cannot definitively associate them.

CrowdStrike's own conclusion addresses the reach half of the story. The report says the activity demonstrates how AI tooling can enable a financially motivated threat actor to conduct multiple intrusions within a short time span, and assesses that adversaries will keep experimenting with AI tooling to raise their operational tempo. Operational tempo means how many actions an attacker completes in a given period.

AI gave this actor reach. The exposed folders and the resume prompt suggest it did not give the actor discipline. That reading is an inference from the public evidence, not a CrowdStrike finding.

Six Checks for Servers Running Coding Agents

The audit below is a practical checklist assembled from Anthropic documentation and CrowdStrike's findings, not a CrowdStrike publication. Each step addresses the same failure mode: an agent's working files sitting where something outside your control can read them. Run the checks in order and record what you find.

1. Find every .Claude folder. Search every home directory and project directory, including build servers and shared machines. Write down each path, because you cannot fix a folder you do not know about.

2. Close paths from web servers and file shares to home directories. Do not serve home directories. Then request the folder's path from outside your network and confirm the server refuses it. Repeat that test after each change.

3. Lower transcript retention if you do not need old logs. Confirm the current setting name and default in Anthropic documentation first, then set cleanupPeriodDays in your settings file. A shorter window leaves less for a stranger to read.

4. Treat agent logs as sensitive data. A full session log can hold anything that appeared in the session, so limit who can read the folder and where backups copy it. Give these files the same handling as your other sensitive data.

5. Read your Claude.md and memory files as if a stranger will read them. Remove internal server names and secrets, and remember that the file guides the agent rather than enforcing a rule. Tell your team these are not private notes.

6. Check where the folder travels. Backups, container images, and shared volumes can carry a .Claude folder to places you did not plan, and a copy in one forgotten place is still a copy.

ARTEX AI Agent Bank Hack FAQ

• What is the ARTEX AI agent bank hack? It is a campaign of intrusions into South Korean financial institutions between late September and early October 2026, which CrowdStrike attributed to a likely single operator using the open-source ARTEX agentic penetration-testing tool. One bank lost access to a loan-progress service and another had an employee mobile system breached. Counts of affected banks and customers differ across Reuters, The Record, and individual banks.

• Who is ARTEX and who made it? ARTEX is a Go-based agentic penetration-testing tool with a PostgreSQL database, described by CrowdStrike as developed in China. Its README documents a planner that splits an objective into intents, default workers that run bash and HTTP commands in parallel, and asset and exploration graphs that store results. CrowdStrike did not describe how this particular operator configured it.

• Which AI models were involved? CrowdStrike named DeepSeek V4.1-Flash as the main model for this ARTEX instance, with GLM-5.3 and Grok 4.6 added for additional Claude Code sessions. Reuters also reported that the suspect used Anthropic Claude. The reporting does not specify which sessions ran on which back end.

• What files does Claude Code write to disk? Claude Code writes a Claude.md file with operator instructions, auto memory notes the agent produces itself, and one JSONL transcript per session. The transcripts sit in a projects folder under .Claude in the user's home directory and default to a 30-day retention, changeable through cleanupPeriodDays in settings.json.

• How did investigators move from one server to the next? An exposed directory on one server held a Chinese-language penetration-testing prompt, and the file referenced an IP address in Hong Kong. Researchers followed that reference to a second server whose open directories held Claude Code session histories, ARTEX configuration, and memory files covering the same period.

• Was the attacker one person? CrowdStrike assessed the actor as likely one person, which is probable rather than proven. It linked the activity to an actor tied to China with moderate confidence, citing a tool developed in China and prompts written in Chinese. China said it had not examined the case.

• How many banks and customers were affected? Reuters counted at least nine banks, based on disclosures and local media, not a CrowdStrike victim count. The Record, citing officials, reported at least seven institutions and at least 68,000 people with affected data. Shinhan said about 25,000 customers were affected.

• Should agent transcripts be kept at all on a production server? Retention is a trade-off. A shorter window reduces what a stranger can read if a folder is exposed, while a longer window helps with debugging. Pick the shortest period your debugging needs and confirm the current default in Anthropic documentation before changing the setting.

• Do Claude.md and memory files enforce security rules? No. Anthropic documentation states that Claude treats both as context rather than enforced configuration, so they guide the agent without compelling it. A Claude.md file should never be the only control protecting a system.

• What is the main lesson for DevOps teams? Plan for an attacker whose tooling compresses the time between actions, and audit what your own servers publish. You cannot control how fast an attacker works, but you can control whether a home directory is reachable from a web server, a file share, a backup, or a container image.

Source video