Cases of AI agents being misused have proliferated, particularly among South Korean banks, leading to a series of data breaches. Attacks stealing personal information have also increased sharply in Japan, highlighting a new phase in the use of AI by both attackers and defenders.
Several banks, including South Korea’s Shinhan Bank, announced customer information breaches, revealing that the personal information of approximately 25,000 people had been leaked. CrowdStrike identified the suspect and reported that the attacks used the ARTEX AI engine and large language models. ARTEX was originally an open-source tool, but suspended its publication and deleted its GitHub repository after reports of misuse.
KB Kookmin Bank and Hana Bank also announced data breaches affecting 119 and 89 customers, respectively. In Japan, unauthorised access affected approximately 6.6 million Times Car members, including identity verification documents for approximately 1.6 million people, while data breaches at MrMax Holdings and infoQ were also confirmed.
Japanese experts said that the use of AI is accelerating vulnerability detection and the execution of attacks. Professor Yoshioka (吉岡) of Yokohama National University said that the average time from disclosure of a vulnerability to the occurrence of an attack had shortened from 141 days in 2024 to 35 days as of the end of August 2026.
As greater accountability and stronger security are sought for AI agents, governments and businesses are calling for rigorous use of multifactor authentication and vigilance regarding suspicious messages. Globally, investment in AI security is accelerating and efforts to develop regulations are gathering pace.