After ARTEX: How the PRA, FSC Korea and the ECB SSM Diverged on AI Bank Risk

In the last days of September 2026, an intruder entered some of South Korea's largest banks through the rooms nobody watches: a portal where outside loan brokers check the progress of customer applications, a mobile tool for bank staff, a sales-support system used by employees. No money was taken. What left the building was the personal data of about 68,000 people, queried out of systems built for employees and business partners rather than customers (The Wall Street Journal).

The intrusion was quickly traced to ARTEX, an open-source Chinese penetration-testing agent wired to commercial language models, and the Journal described it as one of the first AI-powered intrusions into the global financial system (WSJ). It also produced something rare: a supervisory reaction reaching from Seoul to Washington, London, Frankfurt and Sydney within weeks, aimed less at the attacker than at the banks and the people who supervise them (Cybernews Centre).

One point of timing before the comparison, because the record demands it: this story is weeks old, not years. The campaign ran from late September into early October 2026, the tool behind it was publicly identified in the first week of October, and the supervisory responses described here were, as of mid-October, weeks old at most (CrowdStrike, The Herald Business). There is no year of aftermath to review. What exists instead is rarer and more useful: the Financial Services Commission (FSC) in Seoul, the UK's Prudential Regulation Authority (PRA) and the European Central Bank's Single Supervisory Mechanism (SSM) all reacting to the same event at the same moment, and already reaching for different tools. They converged on the diagnosis. They prescribed three different cures.

What the ARTEX attack actually did

CrowdStrike dates the campaign from late September to early October 2026, and Korea's Financial Security Institute believes the attacks concentrated into a five-day window around the turn of the month, traced through server logs at the first bank to report, Shinhan (CrowdStrike, The Herald Business). When the institute shared the attacker's IP addresses with the rest of the financial sector, other banks reviewed their own access records and found intrusions they had missed. The victim list grew by the day.

Korean authorities traced the same attacker across seven financial firms, and investigators say far more institutions were probed than suffered breaches (Cybernews Centre, The Herald Business). The confirmed toll, as reported by the institute: Shinhan Bank, 25,729 people exposed through the loan-agent inquiry service; KB Kookmin, 119 records from an employee mobile work-support system; Hana Bank, 89 records from a sales-support platform called ODS; BNK Busan Bank, 11 contract workers. Woori Bank and NH NongHyup were probed without a confirmed leak. Two savings banks were under investigation, one of which, Yegaram, had already disclosed a breach on its website (The Herald Business). Within days the official count of affected people rose from under 26,000 to about 68,000 (WSJ).

No money was taken. The attacker "did not take over the systems," an institute official said, but "got in and extracted information by querying it," and the institute expects no direct losses from transfers out of accounts. The leaked records are useful raw material for voice phishing and similar scams (The Herald Business). BleepingComputer reported credit-card information among the exposed data and outages in some systems; Korea's National Police Agency opened a probe through its cyber terror unit; and investigators said an earlier hack of the Government24 portal was probably a different actor, given the timing (BleepingComputer, WSJ, The Herald Business).

How ARTEX works, and how its operator's own files cracked the case

ARTEX is not itself a language model. It is a harness: software developed in China and, at the time of the attacks, distributed as an open-source project mainly through GitHub to Chinese-speaking users, built to direct whatever model it is pointed at (The Herald Business, CrowdStrike). In this campaign, CrowdStrike found an ARTEX instance whose primary brain was DeepSeek v4.1-flash. For additional sessions through Claude Code, Anthropic's command-line agent, the operator added GLM-5.3 and Grok 4.6 (CrowdStrike).

The tradecraft outpaced the operational security. CrowdStrike located open directories on the attacker's servers holding Claude Code session histories, ARTEX configuration files and Claude memory files, enough to reconstruct the operation, which ran from a primary server in Hong Kong with the ARTEX engine on a second machine (CrowdStrike). In one session the attacker asked Claude where stolen Korean data is usually sold and for help finding Korean Telegram groups that trade in it; BleepingComputer reported that the sessions show no concrete plan to monetize the haul (CrowdStrike, BleepingComputer). In another, the attacker had Claude draft a résumé containing personal details. CrowdStrike assesses with moderate confidence that the operator is likely a Chinese-speaking, financially motivated actor, and while the résumé details probably belong to that person, the firm cautions they cannot be definitively tied to the operator; Cybernews reported that the individual identified has denied involvement (CrowdStrike, Cybernews Centre).

Two features of the attack shaped everything that followed. First, identification: ARTEX traffic carries a recognizable data signature, so Korean investigators could tell these intrusions apart from ordinary scanning. Second, persistence: two or three overlapping IP addresses were used at each bank, and when one was blocked the attacker switched, activity the institute described as still ongoing in early October. "Blocking IPs is little more than emergency first aid," the official said. The institute was also explicit about agency: the AI did not act on its own. "A hacker used the AI as a tool" (The Herald Business). After real-world attacks were confirmed, ARTEX's developer closed the project's source and stopped updating it, though derivative versions already exist (BleepingComputer).

Seoul's answer: audit every side door, on a deadline of days

South Korea responded fastest and with the most legal force. Inspectors from three agencies, the FSC, the Financial Supervisory Service and the Korea Financial Security Institute, went on site at Shinhan, KB Kookmin, Hana and BNK Busan. Roughly 500 financial firms were ordered into emergency self-assessment, with banks and card issuers given a deadline of Tuesday, October 6 and securities firms, insurers, savings banks and electronic financial providers Thursday, October 8. The FSC ordered banks and card issuers to inventory every IT asset reachable from outside their networks, close any unauthenticated path to internal data, and report back. "We need to check the entire security framework to ensure there are no gaps," FSC Chairman Lee Eok-won said (The Herald Business, Cybernews Centre, BleepingComputer).

No penalties have been announced. As of mid-October, the Korean response is investigative and corrective: find the doors, count them, close them.

The most interesting decision was quieter. Korea's network-separation rules have walled banks' internal networks off from the public internet for years, and those walls also made it hard for banks to use external AI, so the FSC had begun easing them, letting selected firms point frontier models at their own code. In first-round testing, those models analyzed millions to tens of millions of lines of source code within hours, and the FSC's declared approach became, in effect, answering AI attacks with AI defense (The Herald Business).

The second round of that program was due to be announced the day after the delay was reported, with one-year no-action letters for selected firms and an expanded pool of applicants. The FSC postponed it. The reason is uncomfortable: institutions cleared in the first round for their security capability, among them Shinhan, Hana and Woori, were among those hit. At Shinhan and Hana the hits became data breaches; at Woori an intrusion was attempted and no leak has been verified. Regulators say the incidents will not reverse the policy, because the exposed weaknesses sat in authentication and access controls on externally facing business-support systems, a gap that network separation alone does not close (The Herald Business). Yonsei University's Kwon Tae-kyung put it in one line: "the front door was well-guarded but the side door was left open." He argued for multi-factor authentication and least-privilege access applied everywhere, noting that network separation alone does not guarantee security (The Herald Business).

Seoul's prescription, in short, is hygiene: find every exposed door, sector-wide, on a clock measured in days. It is a response built for the failure that actually happened, data walking out through a side entrance.

Where this story sits

5 related pieces

Hover a story · click to read

1. No. 64 · Oct 11, 2026The ARTEX AI bank hack claim: what South Korea's record actually shows
2. No. 61 · Oct 7, 2026ARTEX AI Hit Seven South Korean Banks. Attribution Just Got Harder.
3. No. 71 · Oct 17, 2026Seven Institutions After ARTEX AI: What South Korea's Banks Changed, and What's Still a Promise
4. No. 69 · Oct 14, 2026Could AI Power the Next Major Bank Cyberattack? Lessons From South Korea
5. No. 20 · Aug 30, 2026Can the DSRB Get Startup Tech to the Battlefield Faster Than the MoD?

London's answer: plan for the day the doors fail

No British bank is known to have been touched by ARTEX, and the visible UK response is anticipatory. According to Cybernews, the Bank of England is pressing lenders on recovery, and British supervisors are encouraging the biggest banks to examine "bare metal" systems: clean, independent infrastructure that could keep operating even if the main estate were compromised (Cybernews Centre).

That emphasis is what Britain's existing rulebook would predict. Since March 2025, the UK's operational resilience regime has required regulated financial firms to set impact tolerances for their most important business services, such as payments and account access, and to show they can stay within those tolerances through severe disruption. The PRA, the Bank of England arm that supervises big banks for safety and soundness, has also run threat-led penetration testing against them for years. So the ARTEX question that fits the British frame is not whether every door is closed, but whether, when a door fails, the customer still gets paid.

One gap deserves candor. As of mid-October, the PRA has published no notice naming ARTEX, and the October deadline in this story belongs to Frankfurt, not London. The British response is visible through reporting of supervisory conversations rather than published orders. That difference in visibility is itself part of the answer: Seoul ordered in public; London asks in private.

Frankfurt's answer: an AI-cyber plan by the end of October

The ECB, through the SSM, directly supervises the euro area's largest banks. According to Cybernews, it has given lenders a deadline at the end of October for AI-cyber action plans, and it is pressing them on recovery alongside the Bank of England (Cybernews Centre).

Here too the response extends a regime that already existed. The EU's Digital Operational Resilience Act, in force since January 2025, obliges financial firms to manage ICT risk, classify and report incidents, test resilience and track the third-party technology they depend on. The ECB's attention to AI and cyber risk also predates ARTEX by years: in its 2023 supervisory annual report, ECB President Christine Lagarde wrote that "as the use of artificial intelligence becomes more widespread, supervisors will continue to scrutinise banks' digitalisation strategies and their resilience to cyberattacks" (ECB).

Frankfurt's prescription, in short, is documentation on a deadline: the banks it supervises must write down how they handle AI in the cyber domain and submit the answer.

Same diagnosis, three prescriptions

Start with what the supervisors share, because it is substantial. All three treated AI-enabled attack as a live operational problem rather than a future scenario. All three worked from the same fact pattern the Korean investigators documented: entry through the periphery of bank systems, staff tools, partner portals, vendor software, agent scaffolding, rather than the hardened core of payments and trading. And none of the three responded by banning the technology: Seoul paused an expansion of AI permissions but explicitly kept the policy (The Herald Business, Cybernews Centre).

The wider sweep tells the same story. Cybernews, citing Reuters, reported that the Federal Reserve, the OCC and the FDIC are quizzing banks on whether they run Chinese-developed technology, use AI agents in cyber defense, and can shut autonomous systems down. Cybernews also reported that Australia's APRA warned in April 2026 that frontier models would raise the probability, speed and scale of attacks on the financial system, and has since urged the major banks to share tools and intelligence with smaller lenders, while the Australian Signals Directorate has been telling enterprises that prompt injection has no fully reliable fix inside the model and that controls belong in the harness around it. Britain's AI Security Institute has found universal jailbreaks in OpenAI's GPT-5.6 Sol, often within hours, according to the same report. "The adoption of AI is often outpacing the ability to put the controls in place," Michael Woodbridge, a cybersecurity partner at Grant Thornton, told Cybernews (Cybernews Centre).

That is the shared diagnosis in one sentence: safeguards live inside models, attacks increasingly live in the software around them, and the models are porous besides.

The split appears in what each regulator assumes will fail, and what it assigns as homework:

• Korea assumes the door will be found, so it orders the doors counted and closed, everywhere, now. Its instrument is the emergency audit: 500 firms, days-long deadlines, on-site inspectors.
• The UK assumes a door will eventually fail, so it asks whether the bank can keep serving customers from clean infrastructure when it does. Its instrument is the resilience test: tolerances, recovery, bare metal.
• The ECB assumes the failure will also be poorly governed, so it demands a written plan. Its instrument is the supervisory deadline: an AI-cyber action plan by the end of October.

There is a simpler explanation for the pattern, and it fits every documented move: each regulator reached for the instrument it already had. Korea has network separation and an AI-deregulation program, so it produced inventories and a pause. Britain has an operational resilience regime, so it produced survivability questions. The euro area has DORA, so it produced plans. The same question, different homework, and the homework was assigned with the tools on hand.

What it means for your money

First, the reassurance, with boundaries. ARTEX exposed data; it did not touch deposits, and deposit insurance in Korea, the UK and the euro area continues to cover customers up to statutory limits in each jurisdiction. The customer harm from this breach is identity-shaped: 68,000 people whose personal and financial details may now feed fraud, with Korean investigators warning that the leaked data could be used for voice phishing and similar scams (WSJ, The Herald Business).

Second, the protections differ, and they differ in kind. A customer of a Korean bank now lives under a regime that has put roughly 500 financial firms under emergency self-assessment and ordered banks and card issuers to find and close their exposed doors on deadlines measured in days. A customer of a euro-area bank lives under DORA's duties plus a supervisor demanding AI-cyber plans on a deadline. A customer of a British bank lives under rules built for the day a breach succeeds: payments and account access are supposed to keep working through severe disruption. In Britain, what happens to your exposed data is a separate regime again, policed by the Information Commissioner's Office rather than the PRA. These are not three versions of one protection. They cover three different failure modes: leaked data, misgoverned AI, and dead services.

It is not established that customers in any one of the three places are safer. What the record supports is narrower and still important: the same attack produced three different supervisory asks, so the protection a bank customer receives now depends, visibly, on where their bank is supervised.

Third, the bill. Inventories, audits, inspections and action plans are not free, and they land first on the banks. Whether those costs eventually reach customers through fees is unknown; nothing in the record yet shows pass-through in any of the three jurisdictions. Korea's pause carries a different kind of cost, since it slows the deployment of the defensive AI the deregulation program was designed to unlock, a trade-off embedded in the FSC's decision to delay the second round (The Herald Business).

Fourth, repeat risk is the open flank. The Financial Security Institute noted that open-source tools like ARTEX are numerous, the operator was still switching addresses in early October, and derivative codebases were circulating after the project was closed (The Herald Business, BleepingComputer).

What the record still cannot answer

Attribution remains at moderate confidence, with reported details that cannot be definitively tied to the operator and a reported denial (CrowdStrike, Cybernews Centre). The stolen data's fate is unknown: the operator asked Claude where Korean breach data is sold, but no sale has been reported (CrowdStrike, BleepingComputer). And on cooperation, the sharing on the record ran through domestic and industry channels: the institute circulated attacker addresses to Korean firms and to police, and CrowdStrike published indicators, while across the FSC, the PRA and the SSM the visible pattern is simultaneous questioning rather than announced joint action (The Herald Business, CrowdStrike). Whether the Basel Committee or the Financial Stability Board take up AI-enabled attack as a formal theme is an open question.

The next checkpoints are already set. The FSC must decide whether and when to revive its second round. The ECB's action plans are due within weeks. London's questions continue out of sight. ARTEX did not demonstrate that AI can rob a bank. It demonstrated that when an AI-assisted attacker finally tested one, the defenses that counted were administrative: an asset list, an audit deadline, a written plan. Three supervisors saw the same event, and each reached for a different one of those. Whether any of them holds is a question the next ARTEX will answer.

Sources

• Sooyoung Rhee and Raffaele Huang, "Hackers Use Chinese AI Tool to Hit South Korean Banks, Exposing New Risk," The Wall Street Journal, October 6, 2026. https://www.wsj.com/world/asia/hackers-use-chinese-ai-tool-to-hit-south-korean-banks-exposing-new-risk-5d4d3885
• Jeong Ho-won, "Exclusive: Chinese AI tool ARTEX used in wave of bank hacks, probe finds," The Herald Business, October 3, 2026. https://biz.heraldcorp.com/article/10892497
• Park Hye-rim and Seo Sang-hyuk, "FSC delays second round of network-separation deregulation after hacks hit pilot participants," The Herald Business, October 6, 2026. https://biz.heraldcorp.com/article/10893907
• CrowdStrike Intelligence, "Unknown Threat Actor Uses AI-Driven ARTEX to Target South Korean Finance," CrowdStrike Blog, October 7, 2026. https://www.crowdstrike.com/en-us/blog/unknown-threat-actor-uses-artex-to-target-south-korean-finance/
• Bill Toulas, "Hacker used ARTEX AI and Claude agents to target South Korean banks," BleepingComputer, October 10, 2026. https://www.bleepingcomputer.com/news/security/hacker-used-artex-ai-and-claude-agents-to-target-south-korean-banks/
• Alexis Pinto, "The Back Door Is the Front Line," Cybernews Centre, October 14, 2026. https://www.cybernewscentre.com/the-back-door-is-the-front-line/
• European Central Bank, "ECB Annual Report on supervisory activities 2023," ECB Banking Supervision, 2024. https://www.bankingsupervision.europa.eu/press/other-publications/annual-report/html/ssm.ar2023~2def923d71.en.html