The alarm first grew as details emerged in recent weeks of attacks on several South Korean banks, exposing the personal credit information of thousands of customers. Authorities opened an investigation but initially offered little indication of who might be responsible.¹

President Lee Jae Myung then raised the stakes on Tuesday, telling his cabinet that “signs have emerged” that AI models had been used in some attacks, creating “considerable public concern and anxiety.” He ordered officials to establish the facts “swiftly and clearly” and commit the personnel and resources needed to limit damage.¹

On Wednesday, CrowdStrike supplied a more specific—though still qualified—account. The cybersecurity firm said a hacker ran a targeted campaign against South Korean financial institutions between September and October, using the Chinese-developed open-source tool ARTEX alongside AI tools including Anthropic’s Claude Code.²

CrowdStrike said the actor likely spoke Chinese and appeared financially motivated, but stressed that it had not attributed the operation to a particular adversary and held only “moderate confidence” in that assessment. Its conclusion rested on the use of ARTEX and Chinese-language prompts. The firm said the suspected attacker asked Claude where stolen South Korean data is commonly sold and also sought help creating a purported security-researcher résumé.²

That gap between warning and proof defines the case. Police declined to comment on CrowdStrike’s findings while their inquiry continued. Yet the allegations land awkwardly for an economy riding the AI surge: government figures showed September semiconductor exports reached a record $60.3 billion, more than triple the level a year earlier.²