AI attacks this week: Arrest in Seoul after break-ins at about 60 companies using AI (week 44/2026)

Reporting period: 26 October to 1 November 2026.

South Korea: arrest after break-ins with an AI attack tool

The cyber investigation unit of the Seoul police announced on 26 October that it had referred a 32-year-old to prosecutors and is holding him in custody. This is according to Korean media such as Dailysecu and ZDNet Korea. Six other suspects are under investigation without detention. Between September 2025 and October 2026 the group allegedly broke into the networks of about 90 companies, including tutoring schools, clinics, golf courses, universities and funeral service providers. According to the police it stole about 8.2 million records of personal data and internal documents. 38 companies received extortion emails demanding a total of 360 million won; so far one is known to have paid.

From 31 August to 13 October, the police say, he broke into about 60 companies using AI, that is, in 44 days. Investigators established that he used ARTEX, an open-source tool in which AI agents run a penetration test largely on their own. He combined it with a coding agent. The police conclude that break-ins on this scale no longer require a professional hacking group. They say it is the first arrest in South Korea for large-scale break-ins using generative AI.

Role of AI: According to the police, the suspect expanded his attacks considerably with the AI tool. About 60 of the 90 companies fall within the 44 days in which he worked with AI.

How well established: The information comes from the police; we could not retrieve the police statement itself. We rely on several Korean media outlets whose reports agree. The case shares the tool with the attacks on Korean financial companies covered in week 41. According to the Seoul Economic Daily, the police have not established a connection. The case is now with the prosecutors. The suspect is presumed innocent.

ARTEX in espionage and extortion

CrowdStrike describes a campaign by the group it calls VAPOR PANDA and links to China. From 17 October it used ARTEX against more than 200 organisations, including foreign ministries in four regions of the world. CrowdStrike confirms that the attackers got into nine organisations. One operator ran several intrusions at the same time and stepped in only at decision points. At a Greek government entity he gave the agent a 2022 directory export from the mail server. Its keys had likely not been rotated since, and the agent used them to read mailboxes. CrowdStrike distinguishes the campaign from Storm-0940, which we covered in week 43.

Google has observed ARTEX and similar platforms in its own incident response cases since late August. There, ARTEX is also used by extortionists who steal data. Microsoft reports that two North Korean groups have also been using ARTEX since late October.

The British registrar 123 Reg told The Register that a break-in on 18 September was the first known AI-driven attack on the company. On Chinese infrastructure it found AI skills for attacks, that is, instructions for agents. According to 123 Reg, ARTEX was used in the attack. Customer data such as names, phone numbers and booked products was read. 123 Reg suspects a Chinese state-sponsored group; this has not been established.

Role of AI: In the well-documented cases the agents handle reconnaissance, moving through the network and the search for higher privileges. Humans supply targets and credentials and step in at decision points.

How well established: CrowdStrike relies on its own telemetry and on agent transcripts from the attackers' openly accessible directories, Google on its own investigations. Microsoft gives no details for North Korea. 123 Reg confirms the break-in itself and bases the AI statement on its own findings; the attribution is a suspicion.

AI developer platforms: the series of break-ins continues

Wiz counts at least nine platforms for AI developers that reported incidents in October, including Railway and OpenCode from our previous weeks. In all public reports the attackers specifically hunted for stored environment variables, above all keys for AI services. Wiz sees no single shared vulnerability.

New this week: Northflank advises its customers to treat all environment variables as decrypted. Several customers confirm that their AI keys were misused. On 28 October Command Code stopped an incident that it links to a large-scale distillation attack on models from Anthropic and OpenAI, and revoked all API keys. At the terminal provider Warp, according to its CEO, the attacker likely got in through a hole in a vendor dependency and accessed agent trace data. At most about one percent of users may have been affected. According to Warp, the attack appears to have come from an agent swarm. Chainalysis reports a break-in using "offensive agentic techniques". Names, email addresses and roles of users were accessed; investigation content was not, as far as is known.

Role of AI: AI keys are the loot. Warp and Chainalysis say the attackers themselves used AI agents, without providing evidence.

How well established: The break-ins are confirmed by those affected. No source establishes that the same attackers are behind them.

Tampered Claude Code extension in the Cursor marketplace

On 29 October a tampered version of the Claude Code extension was available for about eleven hours in the extension marketplace of the AI editor Cursor. According to Cursor it collected information about the host and tried to set up a persistent SSH backdoor. Without administrator rights this step usually failed. It did, however, add the attacker's key, install persistence and send the host details to the attacker. According to Cursor, the versions did not come from Anthropic. Cursor does not say how they got into the marketplace.

How well established: confirmed by the marketplace operator. The malware itself does not use AI. The targets were developers working with an AI tool.

AI in malware

Cisco Talos describes the infostealer VOLTA. It sends a structured summary of its loot to a language model that rates what can be turned into money. If a model refuses, VOLTA falls back to a chain of three models. SOCRadar found that the extortion group n0n used a coding agent that wrote hundreds of attack scripts. At least 23 organisations in 14 countries were affected. In every documented case the group got in with weak or stolen credentials.

How well established: analyses of the malware and of the attackers' servers. How widespread VOLTA is remains open.

Vulnerabilities in AI tools

• LiteLLM Enterprise (GHSA-w4c7-34wj-hqm8): An unauthenticated request could make the proxy read a local file and send it to the attacker. This could expose the master key and the keys for the AI providers. Critical, only with an Enterprise licence, fixed.
• Claude Code (CVE-2026-88968): On macOS, code inside the sandbox, for example from a malicious repository, could overwrite files outside the workspace. Fixed in 2.1.251.
• Cloudflare Workers AI (report): Between 27 August and 9 September, 155 responses of the GLM 5.3 model contained data from other customers' requests. Cloudflare found no evidence of deliberate exploitation.

How well established: confirmed by the vendor. The advisories for LiteLLM and Claude Code do not say whether the flaws were exploited.

What follows from our point of view

• Rotate old credentials. At the Greek government entity, keys from a four-year-old export were enough; at n0n, weak or stolen passwords. CrowdStrike assesses that an attacker with agents can work on more targets at once than by hand.
• Treat keys for AI services like money. Anyone who stored them with one of the affected platforms should rotate them. Spending limits cap the damage; alerts on unusual usage are a reason to take a closer look.
• Watch for rapid command sequences. Google describes ARTEX as conspicuous: command sequences of 2 to 25 seconds and a lot of trial and error. Monitoring that flags such patterns has a good chance of spotting the agents.
• Anyone who installed or updated the Claude Code extension via Cursor on 29 October should follow Cursor's guidance. According to Cursor, uninstalling the extension may not be enough.

Selection and sources

We include reports in which AI was essential to the attack, as a tool, as a target or for deception. Every statement is checked against the linked source, as a rule the primary source. Where only media reports are available, we say so. We distinguish whether an incident has been confirmed by the affected party, an authority or the vendor, or has so far only been reported. We welcome notice of errors and make corrections visible.