EDITORIAL: Cyberdefense a whole society effort

Media reports about personal data breaches affecting at least 68,000 people at several South Korean financial institutions have linked the attacks to the Chinese artificial intelligence (AI) cybersecurity tool ARTEX. The stolen information included customers’ names, phone numbers, annual income and loan application details, data that could be sold to scammers or traded online in other forms, the South Korean Financial Services Commission said.

The incident has drawn significant attention in South Korea and raised concerns globally about what happens when powerful AI tools fall into the wrong hands. Reports of some AI agents — originally designed to find previously unknown software vulnerabilities and weaknesses in their own systems — hacking companies, government agencies and public infrastructure in the past few months have been in the global spotlight, as leading AI labs continued to release ever more advanced models.

However, the South Korean incident is raising eyebrows because it is one of the first confirmed uses of AI tools in large-scale financial sector breaches. It should serve as a wake-up call for Taiwan’s financial institutions, as the nation is a frequent target of similar cross-border, AI-assisted cyberattacks.

ARTEX is an open-source penetration testing program designed to connect with external large language models, such as OpenAI’s ChatGPT, Anthropic PBC’s Claude and DeepSeek’s models, to help organizations automate vulnerability discovery, analyze potential targets, find infiltration routes and deploy security tools in their networks.

US security firm CrowdStrike on Wednesday last week said that the suspect behind the attacks from late last month to early this month was likely a China-based 26-year-old who used ARTEX and Claude Code and was financially motivated. Beyond conducting cyberattacks, the suspect used Claude Code to ask where stolen data in South Korea is traded and to search for Korean Telegram data sales groups.

Considering the risks of the AI tool being misused, the Chinese developer of ARTEX — Autumn-27 — on Thursday announced on code-hosting platform GitHub that it had converted it to a closed-source project and would no longer update it. ARTEX’s GitHub page has also been removed since then, media reports said. While transitioning to a closed-source model would make it harder for new users to create code, concerns persist that it would not prevent existing users from continuing to use downloaded copies. In other words, halting development alone is unlikely to fully block ARTEX-related cyberattacks.

This incident shows a real danger, as malign actors can dramatically accelerate the speed and scale of cyberattacks against high-value targets using agentic AI tools. According to CrowdStrike, the threat actor in the South Korean case acquired infrastructure at multiple IP addresses to establish command-and-control operations, meaning the person did not perform every technical step, but relied on AI assistance to search, organize, test and repeat the process multiple times. Broadly speaking, AI could enable cyberattacks to scale up, and more seriously, enable ordinary people to conduct cyberattacks like professional cyberwarfare outfits.

Using ARTEX or other autonomous AI agents for data breaches signals a new era of accelerated, intelligent cyberwarfare that challenges traditional security controls. Taiwan, like South Korea, is highly digitalized, with financial institutions, e-commerce platforms, telecom operators, Internet portals, government agencies and third-party financial service providers that are highly interconnected.

The real vulnerability of Taiwan’s financial system might not lie in its core banking systems, but in its auxiliary infrastructure, such as internal employee systems, external software vendors, outsourced information technology services providers and mobile support portals, which often represent the weakest link in cybersecurity defenses and tend to be overlooked.

Financial institutions must guard against not only malicious IP addresses or embedded malware, but a whole set of AI-driven attack processes, as breaches by AI agents using ARTEX are active, autonomous and capable of unprecedented speed and scale. In this respect, local financial institutions must shift from periodic manual audits to continuous, automated AI-driven defense mechanisms. In short, the principle is using AI to counter AI threats.

Microsoft Corp’s latest digital defense report showed that Taiwan ranked fourth globally in terms of the severity of various cybersecurity threats in the first half of this year, behind only the US, Israel and Ukraine. Given Taiwan’s unique geopolitical position and China’s relentless cyberattacks, the issue of cybersecurity is no longer just a concept of technical defense, but a broader effort involving all walks of life.