South Korean Banks Hit by an Autonomous AI Pentesting Agent, and CrowdStrike Found It Because the Operator Left the Sessions Open

The discovery of an open directory at a Hong Kong-based IP address provided the first concrete evidence of a new class of cyber threat: the use of an autonomous AI pentesting agent in a live financial-sector intrusion. CrowdStrike Intelligence identified a campaign active from late September to early October 2026, during which an operator leveraged a tool called ARTEX to probe the digital perimeters of at least nine South Korean financial institutions. ARTEX, an open-source agentic AI pentesting tool developed in China by an individual known as Autumn-27, represents a shift in how threat actors approach reconnaissance.

Source: Forkast