Media reports about personal data breaches affecting at least 68,000 people at several South Korean financial institutions have linked the attacks to the Chinese artificial intelligence (AI) cybersecurity tool ARTEX. The stolen information included customers’ names, phone numbers, annual income and loan application details, data that could be sold to scammers or traded online in other forms, the South Korean Financial Services Commission said.
The incident has drawn significant attention in South Korea and raised concerns globally about what happens when powerful AI tools fall into the wrong hands. Reports of some AI agents — originally designed to find previously unknown software vulnerabilities and weaknesses in their own systems — hacking companies, government agencies and public infrastructure in the past few months have been in the global spotlight, as leading AI labs continued to release ever more advanced models.
However, the South Korean incident is raising eyebrows because it is one of the first confirmed uses of AI tools in large-scale financial sector breaches. It should serve as a wake-up call for Taiwan’s financial institutions, as the nation is a frequent target of similar cross-border, AI-assisted cyberattacks.
ARTEX is an open-source penetration testing program designed to connect with external large language models, such as OpenAI’s ChatGPT, Anthropic PBC’s Claude and DeepSeek’s models, to help organizations automate vulnerability discovery, analyze potential targets, find infiltration routes and deploy security tools in their networks.
US security firm CrowdStrike on Wednesday last week said that the suspect behind the attacks from late last month to early this month was likely a China-based 26-year-old who used ARTEX and Claude Code and was financially motivated. Beyond conducting cyberattacks, the suspect used Claude Code to ask where stolen data in South Korea is traded and to search for Korean Telegram data sales groups.
Considering the risks of the AI tool being misused, the Chinese developer of ARTEX — Autumn-27 — on Thursday announced on code-hosting platform GitHub that it had converted it to a closed-source project and would no longer update it. ARTEX’s GitHub page has also been removed since then, media reports said. While transitioning to a closed-source model would make it harder for new users to create code, concerns persist that it would not prevent existing users from continuing to use downloaded copies. In other words, halting development alone is unlikely to fully block ARTEX-related cyberattacks.
This incident shows a real danger, as malign actors can dramatically accelerate the speed and scale of cyberattacks against high-value targets using agentic AI tools. According to CrowdStrike, the threat actor in the South Korean case acquired infrastructure at multiple IP addresses to establish command-and-control operations, meaning the person did not perform every technical step, but relied on AI assistance to search, organize, test and repeat the process multiple times. Broadly speaking, AI could enable cyberattacks to scale up, and more seriously, enable ordinary people to conduct cyberattacks like professional cyberwarfare outfits.
Using ARTEX or other autonomous AI agents for data breaches signals a new era of accelerated, intelligent cyberwarfare that challenges traditional security controls. Taiwan, like South Korea, is highly digitalized, with financial institutions, e-commerce platforms, telecom operators, Internet portals, government agencies and third-party financial service providers that are highly interconnected.
The real vulnerability of Taiwan’s financial system might not lie in its core banking systems, but in its auxiliary infrastructure, such as internal employee systems, external software vendors, outsourced information technology services providers and mobile support portals, which often represent the weakest link in cybersecurity defenses and tend to be overlooked.
Financial institutions must guard against not only malicious IP addresses or embedded malware, but a whole set of AI-driven attack processes, as breaches by AI agents using ARTEX are active, autonomous and capable of unprecedented speed and scale. In this respect, local financial institutions must shift from periodic manual audits to continuous, automated AI-driven defense mechanisms. In short, the principle is using AI to counter AI threats.
Microsoft Corp’s latest digital defense report showed that Taiwan ranked fourth globally in terms of the severity of various cybersecurity threats in the first half of this year, behind only the US, Israel and Ukraine. Given Taiwan’s unique geopolitical position and China’s relentless cyberattacks, the issue of cybersecurity is no longer just a concept of technical defense, but a broader effort involving all walks of life.
The FBI on Sunday arrested Wanying “Heather” Chang (張婉瑩) on suspicion of surveiling the family of the son of President William Lai (賴清德) on behalf of China, an example of “transnational repression” to suppress dissent in Taiwan and abroad. Zhang, a 34-year old realtor in California, was arrested on charges of working as an unregistered agent for China. She and an accomplice were accused of taking photos and videos of Lai’s son and his family, and sending information about their whereabouts and license plates to Chinese officials. “The information could be used by China to gain leverage over the Taiwanese president
On Oct. 10, 1911, gunfire in Wuchang (武昌) shattered the stillness of late-Qing China. What began as a regional uprising quickly ignited a chain reaction across the empire, toppling a dynastic order that had endured for more than two millennia and ushering in one of Asia’s first republics — the Republic of China (ROC). From that moment, the 10th day of the 10th month became a date of epochal significance, not merely in Chinese history, but in the broader arc of Asia’s encounter with modernity. Yet today, as Taiwan marks Double Ten National Day, the holiday’s meaning has undergone a transformation
A few days ago, we left our breakfast midway to catch a glimpse of the fighter jets in formation. It was a spectacular sight. We knew it was part of practice drills for Double Ten National Day celebrations and reminded us of the Annual Republic day celebration in India. While channel surfing, I came across a news debate about immigration laws, where an academic asked a fellow panelist: “Why should we be interested in your point of view when you don’t even belong here?” That got me thinking. Was our enthusiasm about the upcoming Double Ten celebrations unwarranted? Was this
National Tsing Hua University (NTHU) president John Kao (高為元) was invited for a job interview in Hawaii just three days after being confirmed in May for a second term at NTHU. Academic and industrial leaders requested his resignation. In the US, university presidents serve at the pleasure of the university’s board of trustees or board of regents. Unless an employment contract explicitly protects them, they can be terminated at any time without cause under at-will employment doctrines. If the board finds out a president is interviewing elsewhere, it can legally terminate their presidency simply by citing a “loss of confidence” in their
RSS