South Korean officials link bank breaches to AI hacking tool

South Korean officials believe AI agents were used to break into the systems of several banks, according to a report published by The Record on 6 October 2026. The report said the personal data of at least 68,000 people was exposed in breaches of at least seven financial institutions, and that officials believe a Chinese cybersecurity tool was used to carry out the intrusions.

The account is brief and leaves most of the detail unresolved. The report does not name the financial institutions affected, the specific tool said to have been used, or the people behind the attacks. It does not say when the breaches took place, how long the attackers had access, or what categories of personal data were exposed beyond describing it as personal data of at least 68,000 people. No vendor has been identified as the maker of a compromised product, and no software flaw has been disclosed.

What is described is a case of tool misuse rather than a defect in a particular agent platform. Cybersecurity tools are routinely dual-use: software built to find weaknesses in a network can be pointed at someone else's network with little modification. The claim here, as reported, is that an AI-powered tool of that kind was turned on South Korean banks. Officials' belief that this happened is, on the evidence published so far, an assessment rather than a demonstrated technical finding, and the report attributes it to officials without setting out the basis for it.

Readers should treat the figures as provisional. Breach counts and affected-person totals commonly move as investigations proceed, and the report itself uses "at least" for both the number of institutions and the number of people. There is no indication in the source of whether regulators have opened a formal inquiry, whether the institutions have notified customers, or whether any funds were taken.

The case matters because it is one of the few publicly reported instances in which a national authority has tied a financial-sector intrusion to agentic tooling, as opposed to conventional intrusion software operated by hand. If that assessment holds, it would suggest attackers are using automation to work through multiple targets in a way that defenders will need to account for. For now, the public record consists of a single report, and the technical specifics that would allow banks elsewhere to check their own systems have not been released. The Agentic Times will update this story if the institutions, the regulator or the toolmaker respond.