Hackers Use Chinese AI to Breach South Korean Banks
Left 50%
Center 0%
Right 50%
1 left · 0 center · 1 right
What happened
South Korean investigators said hackers used Artex, an open-source AI agent built by Chinese cybersecurity engineer Li Puhua, to breach at least seven financial firms, including Hana Bank, KB Kookmin Bank, and Shinhan Bank, and steal personal data belonging to about 68,000 people, including some customers' annual income and personal-loan limits. Seoul officials first detected the attacks last week, and on Tuesday South Korea's National Police Agency opened a formal investigation through its cyber terror unit, tracing the intrusions to more than two dozen internet addresses across roughly a dozen countries, including the United States, Japan, and Germany; no culprits have been identified. Artex is not an AI model itself but draws on existing models including Anthropic's Claude Opus, OpenAI's ChatGPT, and China's DeepSeek; Li designed it to help organizations find network vulnerabilities, and officials have not said which underlying models were used in the bank breaches. At a cabinet meeting Tuesday, President Lee Jae Myung said signs had "emerged of AI being used, causing considerable public concern and anxiety," and told banks to implement necessary defensive measures immediately. After the reports surfaced, Artex's developer updated the tool's user guidelines to prohibit unauthorized intrusions, data theft, and other malicious use.
Sourcing check · Fully on the record · 2 articles
2 of 2 articles cite a named source for the story. It was on the record from the first report.
What these terms mean and how they're counted
- On the record · names a source 2 of 2
- On the record means the article cites a source by name for the story's main claim: a person, or an institution speaking officially, such as a company statement or a named agency's spokesperson. The opposite is an unnamed source. The count is how many of the counted articles cite at least one such source; the names are everyone named across them, each once however the articles spell it. Here: South Korea’s National Police Agency, Mun Chong-hyun, President Lee Jae Myung and South Korean President Lee Jae Myung
- Primary evidence · cites a document or data 0 of 2
- Primary evidence means the article cites a record you could check yourself: a court filing or ruling, a dataset or report, a recording or transcript, an official statement or press release, market data. A quote is not a document. The count is how many articles cite one. Here: None cited.
- Credits another outlet 0 of 2
- The article says the story comes from another outlet's reporting (“first reported by Reuters”). Those articles relay the story; they are not independent confirmation. Here: Each article presents its own reporting.
- Unnamed sources 0 of 2
- The main claim is attributed to people who are not identified: “people familiar with the matter”, “officials said”. The count is how many articles do this.
- How it developed
- When the first report landed and whether it named anyone; when the first named source and the first document appeared. Here: First report Oct 6, 16:51 UTC by Breitbart, naming its source.
- Not counted 0
- Opinion, analysis and video pieces, and articles too short to assess. Every count above is out of the counted articles. An article republished under a new headline is one article.
This is about who is cited, not whether the story is true. Each source below says what it names. How we count
Omitted — what each side leaves out
Unpacked
Left-leaning coverage never tells readers that investigators named a Chinese-made agent or how many customers were hit, so the incident reads as a president's hunch about generic AI. Right-leaning coverage is more complete: it reports that officials tied the bank breaches to Artex and that personal data of 68,000 people was stolen. Lee Jae Myung's line that signs "emerged of AI being used" is the only AI detail The Hill supplies, with no product name and no Chinese origin.
Left-leaning coverage opens on the president's belief and on "considerable public concern and anxiety." Right-leaning coverage opens on a Chinese-made agent and stolen records, and only later reaches the cabinet meeting.
Who actually ran the attacks, and whether any government stood behind the Chinese-built tool, goes unasked.
Bottom line
You can finish The Hill's piece and never learn the tool was called Artex or that 68,000 people's data was stolen — facts Breitbart puts in the opening line.
The receipts — 4 facts one side's coverage lacks
- Investigators say hackers used a Chinese-made AI agent called Artex
- At least seven financial firms were breached
- Artex was designed to help organizations find network vulnerabilities, not to enable attacks
- Hana Bank, KB Kookmin Bank, and Shinhan were among the banks named as hit
The Left View
The Hill frames the story around Lee's cabinet remarks: he said he believes AI models were used to hack several commercial banks and called for an investigation, stressing public concern and anxiety. The coverage stays on that domestic political and public-safety angle—presidential alarm, named lenders, and a demand for inquiry—without developing a China-origin or great-power technology-race frame.
The Right View
Breitbart frames the breaches as hackers misusing a "Chinese-made AI agent" and as an episode in "the AI race between America and China," which it says is "made more complex through the introduction of agentic AI." It highlights that Artex won a September contest sponsored by Chinese tech companies as the top agentic AI system for both offensive and defensive cybersecurity, cites Seoul analyst Mun Chong-hyun's expectation that AI-agent attacks "will grow in number worldwide," and groups this case with Anthropic's earlier allegation that state-sponsored Chinese hackers used its technology—an allegation China denied, accusing the United States of using cybersecurity claims to smear it.
Our Take (balanced)
Left-leaning coverage's strongest argument is that the government itself has treated the hacks as AI-enabled attacks on major banks that produced public anxiety and, in Lee's cabinet remarks, require investigation and immediate defensive measures. Right-leaning coverage's strongest argument is that investigators have tied the intrusions to a Chinese-built agent already awarded in China for offensive as well as defensive work, which it presents as evidence that agentic Chinese cybersecurity tools are appearing in real financial-sector breaches. The central unresolved tension is whether this is primarily a dual-use AI-misuse and banking-security story—given that Artex also calls U.S. models, officials have not named which models were used, and the operators remain unidentified—or a China-origin chapter in a great-power AI race.
2 sources
More stories
The week's bottom lines, in your inbox
One email a week: the five stories that mattered and what they actually mean. Free.