AI attacks this week: an agentic pentesting tool used against banks in South Korea (week 41/2026)
Reporting period: 5 to 11 October 2026.
South Korea: intrusions with ARTEX and Claude Code
CrowdStrike reports a targeted campaign against financial organisations in South Korea that resulted in exfiltrated data. It ran from late September to early October. CrowdStrike cites industry reports on this. According to them, the attackers breached a service used by loan brokers at one bank and an employee mobile work-support system at another. According to CrowdStrike, the number of affected organisations is unconfirmed.
Role of AI: In open directories controlled by the attacker, CrowdStrike found Claude Code session histories, ARTEX configuration files and Claude memory files. ARTEX is a recently released open-source tool for agentic penetration testing, developed in China. According to CrowdStrike, the model behind it was mainly DeepSeek, supplemented by other models.
CrowdStrike assesses with moderate confidence that the attacker is likely a Chinese speaker and financially motivated. According to the session histories, the attacker also asked Claude where stolen Korean data is typically sold.
How well established: a technical report with direct artefacts. CrowdStrike takes the intrusions themselves from Korean reporting; we have not found a statement from the banks or from Anthropic.
PoeLLM: a botnet on exposed AI servers
Lumen's Black Lotus Labs describes the PoeLLM malware, which targets internet-facing AI services, mainly vulnerable LiteLLM and Ollama deployments. On compromised servers it installs cryptocurrency miners. Lumen names a command injection flaw in LiteLLM (CVE-2026-42271) as the likely entry point and links the actor to an Italian-speaking environment.
Role of AI: Here AI infrastructure is the target. According to Lumen, most victims run vulnerable versions of open-source AI services such as LiteLLM and Ollama.
How well established: a technical report with telemetry. Lumen gives inconsistent victim counts: more than 3,400 servers in one place, almost 2,200 in another. At peak, more than 800 servers were active per day.
Tensorlake: a worm in an SDK for AI sandboxes
On 8 October an unauthorised version of the npm package tensorlake was published through a compromised maintainer account. The vendor's advisory describes a credential-stealing worm from the Shai-Hulud family. The version was available for about one hour and 40 minutes. Tensorlake says it has seen no usage of it.
Role of AI: Tensorlake provides isolated sandboxes for running LLM-generated code. According to the vendor, the malware harvested AI tool and MCP configuration, among other things. According to StepSecurity, it wrote a Claude Code settings file into reachable repositories. That way it runs again when someone opens the project in Claude Code. If the stolen GitHub token is revoked, the vendor says it deletes the user's home directory.
How well established: confirmed by the affected vendor.
Sentence: 18 months for streaming fraud with AI music
A federal court in New York sentenced Michael Smith on 6 October to 18 months in prison, the prosecutors announced. Using as many as 10,000 bot accounts at a time, he streamed songs that were mostly AI-generated. This brought him more than 8 million US dollars in royalties. According to the prosecutors, he needed the large number of songs to get around the streaming services' fraud detection.
How well established: established by a court.
Flaws in AI tools
- MCP TypeScript SDK (GHSA-6qxp-vccf-f47h, CVE-2026-104850): the counterpart to the Python SDK flaw from week 40. A malicious MCP server could decide which authorisation server received the client's OAuth credentials. Fixed in 1.31.0 and 2.2.0.
- Ollama (CVE-2026-103663, disclosed through CERT Polska): an unauthenticated attacker could write files outside the model store. If the server can write to the program directory, as in most Ollama Docker images, the code runs as root on the next restart. Fixed in 0.35.0.
How well established: confirmed by the maintainers and the reporting body. Neither publication provides information about exploitation.
Correction to week 40: DIVD
DIVD revised its case file on 9 October. According to the new version, the attacker used AI agents only after gaining root privileges. As evidence, DIVD cites the volume of artefacts in a short time. It also cites comments in the scripts in which the agents seem to talk to each other.
According to DIVD, volunteers' DIVD email addresses were exfiltrated for certain, and possibly contact details; the investigation is ongoing. The first signals appeared in monitoring within minutes, and the first response came after 19 hours.
Zammad fixed both flaws in 7.2 and 7.2.2; according to DIVD, the 7.x branch was not affected. Our week 40 report reflected the earlier version. We have corrected it with a dated note.
What follows, in our view
- Agentic tools lower the bar. The South Korean case shows a freely available pentesting tool in the hands of an attacker whom CrowdStrike assesses with moderate confidence as likely financially motivated. We think detection and response should be designed for a higher number of simultaneous intrusion attempts.
- AI servers belong in the inventory. LiteLLM, Ollama and similar services should not be exposed to the internet and need the same patch process as other servers.
- Check developer environments. Anyone who installed tensorlake 0.5.144 should follow the vendor's guidance. Settings files for AI tools in a repository belong in every code review.
- Keep MCP components up to date. After the Python SDK, the TypeScript SDK is now affected too.
Selection and sources
We include reports in which AI was essential to the attack, as a tool, as a target or for deception. Every statement has been checked against the primary source. We distinguish whether an incident has been confirmed by the victim, an authority or the vendor, or has so far only been reported. We welcome reports of errors and make corrections visible.