South Korean Banks Investigate Cyberattacks Suspected of Using Artificial Intelligence Tools

South Korean authorities are investigating a series of cyberattacks against financial institutions amid concerns that attackers may have used artificial intelligence tools to assist their operations. The incidents reportedly exposed personal information belonging to at least 68,000 people across seven or more financial institutions, prompting investigations into the methods used to access the affected systems.

According to reporting by The Record, South Korean President Lee Jae Myung said officials were examining whether AI agents had been involved in the attacks. Investigators were also looking into the possible use of ARTEX AI, a cybersecurity tool developed in China. The tool is designed for penetration testing, a process in which security specialists assess computer systems for weaknesses that could be exploited.

Authorities reportedly identified 33 internet protocol (IP) addresses associated with the incidents. The breaches first came to public attention on 30 September 2026, and the investigation has focused on how the attackers gained access to financial systems and whether the activity was coordinated.

The suspected use of AI-assisted tools has raised questions about how rapidly evolving technologies may affect the scale and speed of cyberattacks. Artificial intelligence can help automate certain technical tasks, but establishing whether a particular attack was genuinely conducted by autonomous AI agents requires detailed forensic evidence.

The identity and motives of the person or group responsible have not been conclusively established. Investigators are also working to determine the full extent of the breaches and the exact volume and type of information obtained.

The incidents underline the security challenges facing financial institutions that manage sensitive customer records and provide online services. Effective access controls, continuous monitoring, prompt vulnerability management and well-prepared incident-response procedures remain essential for identifying suspicious activity and limiting the consequences of a breach.

Further technical findings are expected to clarify the role, if any, played by AI tools in the attacks.

06-10-2026