In late September, abnormal traffic began surfacing across servers at several South Korean financial institutions, including Shinhan, KB Kookmin, and Hana Bank. Three months later, the industry got its first end-to-end look at AI-assisted attack tradecraft: a single threat actor wired an open-source Chinese agentic pentesting tool called ARTEX into four large language models — Claude Code, DeepSeek v4.1-flash, Zhipu GLM-5.3, and xAI Grok 4.6 — and ran parallel intrusions across multiple banks.

The twist is that the AI tool itself exposed the whole operation. CrowdStrike's long-form report on October 7 shows that the attacker had left complete Claude Code session histories, ARTEX configuration files, and Claude memory files on a Hong Kong-based IP and on the second box at 38.244.50[.]120. Any researcher who walked into either open directory could read the attacker's prompts, the model's replies, and the personal details the attacker had typed alongside.

Claude Code quietly wrote out the attacker’s resume

In one Claude Code session, the actor asked Claude to draft a security researcher resume that summarized the ARTEX operation as bullet points. In the same prompt they pasted their own identifying details: name YY, 26 years old (DOB 2007-09-22), phone 17820191556, Telegram @YY520CN, Maoming city in Guangdong province, undergraduate at South China University of Technology. The same Telegram handle later showed up in vulnerability work against a Telegram-based NFT gift marketplace, and again in probes against an unidentified Chinese payment platform.

In other words, Claude Code inadvertently turned the attacker's private context into a forensic log, parked it on an attacker-controlled box, and let a researcher download it in one click. From the attacker's perspective this is textbook OPSEC failure; from the defender's perspective it is a new kind of evidence — the more deeply an actor relies on an LLM, the more unstructured text they leak.

The multi-model stack is now attacker table stakes

The full tool reconstruction from CrowdStrike has one observation worth underlining: four models in parallel.

  • The ARTEX instance used DeepSeek v4.1-flash as its primary LLM backend, doing routine scanning and exploitation work.
  • Zhipu GLM-5.3 supplemented Claude Code sessions, plausibly for Chinese-language tasks.
  • xAI Grok 4.6 also appeared in Claude Code sessions, most likely as a redundant cross-vendor channel.
  • Claude Code itself carried the open-ended work — planning, post-action review, resume drafting, and the question of where on Telegram to sell the Korean data.
  • All LLM API calls flowed through the reseller xcai[.]pro, sidestepping direct-vendor payment and KYC.

This multi-model pattern needs three conditions to fall into place at once: every model has a controllable API, resellers can bridge multiple vendors, and an orchestration tool can schedule across them. By late 2026 all three are commodity services. That is exactly why CrowdStrike judges that adversaries will likely continue to experiment with implementing AI tooling in their operations.

Agentic session logs are a new forensic channel

Traditional network forensics deals in process trees, packet captures, file hashes. LLM-agent forensics adds a layer that does not exist anywhere else: every prompt and reply is persisted as a markdown file inside .claude/ or .config/ style directories. CrowdStrike pulled the attacker's Chinese-language pentesting prompt straight from http[:]//38.244.50[.]120:18899/.claude/CLAUDE.md, then downloaded session history and ARTEX configuration from the Hong Kong open directory.

The point is not that the attacker forgot to firewall the box. The point is that agentic tools default to writing context to disk. Two consequences follow on the defender side: first, any device running Claude Code, Cursor, or Codex that gets compromised now ships a high-density intelligence source in its .claude/ directory; second, when the upstream LLM provider cooperates with law enforcement, IP ranges and account bindings enable active attribution.

Implications for Chinese AI tooling going abroad

ARTEX is the only domestic element of this campaign. After the disclosure the original author Autumn-27 publicly stated that ARTEX had been misused to attack Korean banks, then closed the source and pulled the repository from GitHub. ARTEX itself had no vulnerability — the attacker simply wrote their prompts in Chinese, and that language signal let CrowdStrike make a moderate-confidence assessment that the threat actor is a Chinese-language speaker.

There is a side effect for Chinese agentic tooling going abroad: open source is not a liability shield. A tool that publicly offers LLM orchestration AND defaults to writing plaintext context to disk will eventually be linked, through forensic artefacts, back to the author community. Closing the source is not a technical answer, but it is the more stable choice on the compliance side.

So what happens next

CrowdStrike's disclosure is not the first time AI was used in an attack. It is the first time the forensic value of an AI agentic tool has been publicly verified end-to-end. For the first time researchers have a complete LLM usage log from the attacker side — that is a structural upgrade for defensive research.

For practitioners in China, three layers of implication fall out. First, when procuring agentic tools for business teams, audit the persistence paths of .claude/ style directories by default. Second, when running enterprise security monitoring, hooking LLM call logs into the SIEM is coming sooner than later. Third, for teams building agentic tools: encrypt persisted context by default, and stop writing plaintext prompts to disk — this is not just a product-experience question, it is a downstream-forensics moat.

AI-era security is shifting from intercept signatures to reconstructing the call chain. The first public sample of that shift was demonstrated, on purpose or not, by a 26-year-old in Guangdong.

Reference source: CrowdStrike report dated October 7, 2026, "Unknown Threat Actor Uses AI-Driven ARTEX to Target South Korean Finance" (https://www.crowdstrike.com/en-us/blog/unknown-threat-actor-uses-artex-to-target-south-korean-finance/); Chinese coverage at 163.com article (https://www.163.com/dy/article/L8SIV45V0550W16F.html).