AI Tools Enabled Amateur Hacker to Breach South Korean Banks

CrowdStrike identified a 26-year-old resident of southern China as the likely actor behind a series of cyberattacks that compromised the financial data of at least nine major South Korean banks. The investigation revealed that the intruder utilized artificial intelligence chatbots to execute the breach and later sell the stolen information online.

The attacks occurred in the weeks preceding early November 2026. Digital traces and unsecured systems allowed investigators to determine the suspect's name, age, and location. The findings indicate that the assault on Asia's sophisticated financial sector was carried out by an amateur who relied on AI assistance rather than specialized human expertise.

This incident is part of a wider trend of AI-enabled hacking that has raised concerns among national governments and multinational corporations. Executives in the cybersecurity sector warn that while AI can help identify and fix software bugs, it currently provides a greater advantage to malicious hackers in the short term.

In October, the U.S. National Security Agency advised websites to shut down if they could not immediately patch a critical vulnerability in PHP. This programming language is used by an estimated 70 percent of websites. A research firm using AI tools discovered the flaw, prompting the urgent advisory.

Adam Meyers, senior vice president of counter adversary operations at CrowdStrike, stated that the tools have lowered the barrier to entry for attackers. He noted that non-specialists can now use these frameworks to target various systems. CrowdStrike has observed an increase in the speed at which cyberattacks move within target networks due to AI assistance.

Earlier in 2026, concerns grew that AI could trigger a chaotic era of widespread security breaches. In April, Anthropic, the maker of the Claude chatbot, restricted access to its Mythos AI model because of its proficiency in hacking. Experts subsequently used the model to find thousands of new vulnerabilities, some of which had remained dormant for decades.

The Trump administration implemented restrictions on how Anthropic and OpenAI could release their newest models with potent cybersecurity capabilities. Only a short list of government-approved firms can access the top models without filters that limit their cybersecurity analysis functions. This approach has drawn criticism from business leaders who argue that more organizations need access to top-tier models for defense.

Malte Ubl, chief technology officer of Vercel, said the delay in access cost the industry between three and five months during which proactive measures could have been taken. When OpenAI agents breached the company Hugging Face, the firm relied on free open weights models to investigate the incident because top models were inaccessible.

Recent incidents have included a report from The Washington Post that researchers at the start-up Cathedral accessed internal messages and meeting transcripts at Anthropic. Anthropic executive Logan Graham expressed concern on X that adversaries will use agents to target systems around the clock. Additionally, billions of dollars in digital assets were stolen from cryptocurrency exchange Binance last week.

Nick Carlsen, a senior investigator with TRM Labs, said the technology likely explains the increased sophistication of the North Korean group behind the Binance hack. Jason Clinton, Anthropic's deputy chief information security officer, warned on X that conditions will worsen before they improve. He noted that free open weight models from Chinese companies, including DeepSeek, now perform at levels close to Anthropic's Mythos model from April. The suspect in the South Korea attacks used both Claude and DeepSeek, according to CrowdStrike.