Among the AI conversations left exposed on a server was a request for help with a résumé. The user wanted security-research credentials that included results from the ARTEX activity under investigation. Other conversations asked where stolen Korean data could be sold.1
A résumé is supposed to tell you what a person can do. These files raised a different question: how much did the person need to know?
CrowdStrike’s October 7, 2026 report linked the exposed histories and configuration files to intrusions at South Korean financial organizations in late September and early October. The résumé request did not establish the user’s identity or technical skill.1
Six days before CrowdStrike’s report, on October 1, 2026, Shinhan Bank disclosed that information about roughly 25,000 customers had leaked: names, telephone numbers, annual income and calculated loan limits among the fields. That notice did not attribute the breach to AI.2,3
Consider what those fields mean together. A name and a phone number give a stranger someone to call. Income and a loan limit give that stranger a way to sound informed. On October 6, 2026, Korea’s Financial Services Commission warned that scammers could cite those real financial details while posing as lenders. The warning concerned possible follow-on fraud, not confirmed losses.4
A customer receiving such a call would have to decide whether it was genuine. Somewhere upstream, a system had already failed to keep the information private.
In the exposed toolchain, ARTEX, an agentic penetration-testing tool, used one model backend; additional Claude Code sessions used other models.1 The arrangement matters more than the brands. An operation can draw on several tools, each doing part of the work. A company protecting its data cannot make its security depend on every provider making the same decision about every request.
The distance between knowing and doing
The Korean files leave the skill question open. A separate campaign documented by Amazon gives us a closer look.
In its February 20, 2026 report, Amazon described an actor or small group with low-to-medium technical skill. Investigators had found exposed working files: attack plans, victim configurations and custom code. The software lavished attention on formatting but broke on unusual inputs. Some comments merely repeated function names. A second AI service supplied additional planning when the operator needed help getting beyond existing tools.5
This is a recognizable problem in software development. Getting code to run once is different from understanding why it works, where it fails and how to repair it. An assistant can carry a user through parts of that distance without giving the user an engineer’s judgment. The result may be fragile. It may also be useful enough.
The old “script kiddie” insult carried a comforting assumption. Someone who borrowed a tool they could not build would eventually encounter a problem they could not solve. Interactive assistance moves that stopping point. A failure can become another question, another revision, another attempt.
The next step is a risk scenario, beyond what either investigation documents. Put that assistance inside a loop. The software can retain the result, ask for an adjustment and try again. It may still misunderstand the problem. It may repeat a mistake. But the operator no longer has to supply every step, or sit at the keyboard for every attempt. What once depended on one person’s knowledge and patience can continue with much less of either.
Then add compute. Scaling up gives an individual task more resources; scaling out lets more tasks run at once. Within the limits of the tools, budget and access available, an inexperienced operator can pursue more leads and spend longer on each. More compute does not guarantee better judgment. It can, however, multiply the reach of a method that works only occasionally.
That changes the defender’s problem. A clumsy attempt might be easy to stop. A system that keeps producing variations, across more targets, has more chances to find an overlooked opening. The attacker does not have to become an expert before the workload begins to resemble that of a much larger operation.
Anthropic’s June 3, 2026 analysis of 832 selected accounts banned for cyber misuse found that the attackers assessed to benefit most from AI were not necessarily the most technically skilled. Researchers also saw more low- and mid-skill actors using models during live operations. This was an observational study of March 2025 through March 2026 activity, using risk assessments rather than controlled measurements of skill gains.6
The Amazon campaign puts a consequence beside those observations. From January 11 through February 18, 2026, it compromised more than 600 FortiGate devices in over 55 countries. Those were devices, not 600 organizations. Amazon also reported complete credential databases taken in confirmed compromises.5
The operator’s limitations and the damage coexisted.
Where the help ran out
There is another detail in Amazon’s report worth keeping beside the 600-device count. The entry points were exposed management interfaces and weak, single-factor credentials. Amazon observed no exploitation of FortiGate vulnerabilities. The operator’s own records also showed failures against patched services and closed access paths. Faced with stronger defenses, the operator moved on to easier targets.5
The tools had extended the attacker’s reach. Ordinary controls still put some systems beyond it.
That is a useful place to begin the next security discussion. The Korean regulator’s October 2, 2026 response similarly called for examining externally accessible services and routes to internal information that bypassed authentication. These were instructions for institutions to check their systems, not a completed forensic account of every breach.7
Next week, choose one unremarkable workflow that can reach consequential data: a broker portal, a vendor connection or an employee support tool. Use an authorized test environment and a representative account. Find out what that account can retrieve beyond its legitimate job.
A working login is only the beginning of the test. Can the account ask for somebody else’s record? Can it collect far more records than the job requires? Does the service enforce the boundary on each request, including slow requests that never trigger a volume alarm? The permission check belongs where the data is served.
Then let the test produce a suspicious pattern. Follow the alert to the person expected to act on it. Disable the account and check whether existing sessions and queued work actually stop. If one of those steps fails, give the gap an owner and a deadline. A control that exists only in a design document will not interrupt an operation.
The same exercise works regardless of which model an attacker uses. It also tells us something useful about our own automated workloads: they need identities, limited permissions and a way to stop them that holds outside the prompt.
We may never know how much the person behind the résumé really understood. We can know much more about what our systems permit.
When someone gets a customer’s financial records, it is no consolation to discover that they needed help.
Subscribe for field notes on digital trust and AI.
Reporting note: CrowdStrike assessed the Korean operator as likely Chinese-speaking and financially motivated, with moderate confidence. The résumé’s personal details, including age and education, remain unverified; the full victim list and degree of autonomy are also unsettled. Anthropic’s sample was selected, and improved detection may explain part of the trend. Its risk scores included observed and potential harm.1,6
Sources and references
Dates are publication dates. Accessed 9 October 2026.
- CrowdStrike. 7 October 2026. Unknown Threat Actor Uses AI-Driven ARTEX to Target South Korean Finance. Return 1 Return 2 Return 3 Return 4 Return 5
- Shinhan Bank. 1 October 2026. Customer notice on the personal-information breach. Korean-language notice; descriptive English label. Return 1
- Korea JoongAng Daily. 1 October 2026. Shinhan Bank data breach leaks personal, credit information of 25,000 customers. Return 1
- Financial Services Commission, Republic of Korea. 6 October 2026. Beware voice phishing and smishing following recent financial-sector personal-information leaks. English translation of the Korean title. Return 1
- CJ Moses. 20 February 2026. AI-augmented threat actor accesses FortiGate devices at scale. Amazon Web Services Security Blog. Return 1 Return 2 Return 3
- Kyla Guru, Alex Moix and Jacob Klein. 3 June 2026. Mapping AI-enabled cyber threats: Insights from the LLM ATT&CK Navigator. Anthropic. Return 1 Return 2
- Financial Services Commission, Republic of Korea. 2 October 2026. Responding closely to recent financial-sector intrusion threats: Emergency response meeting chaired by the FSC Secretary General. English translation of the Korean title. Return 1