Claude Code ran on DeepSeek in the Korean bank hacks

The attacker behind the recent South Korean bank breaches used Claude Code — but not on Claude. CrowdStrike's report says the actor ran the ARTEX AI pentest suite on DeepSeek v4.1-flash, and used GLM-5.3 and Grok 4.6 in more Claude Code sessions. DeepSeek access likely came through an LLM API reseller. The lesson for anyone running coding agents: the harness and the model are separate parts, and the model is one setting away from being someone else's.

What actually happened

Per CrowdStrike's October 7 write-up, with follow-up reporting from BleepingComputer today:

• Timeframe: the campaign ran from late September to early October 2026.
• The evidence: open directories the attacker controlled held Claude Code session histories, ARTEX configuration files, and Claude memory files. A CLAUDE.md file held a Chinese-language pentest prompt.
• The models: ARTEX used DeepSeek v4.1-flash as its main backend. GLM-5.3 (Zhipu AI) and Grok 4.6 ran in other Claude Code sessions. CrowdStrike says the actor likely reached DeepSeek through xcai[.]pro, which it calls a likely LLM API proxy or reseller.
• The targets: a loan-progress inquiry service used by brokers at one bank, and an employee mobile work-support system at another. That matches the side-system pattern we covered on October 5.
• Attribution: none. CrowdStrike has moderate confidence the actor is a Chinese speaker with a financial motive.
• The tool: ARTEX's developer made the project closed-source and stopped updates, but English and Korean derivatives already exist.

Why it matters for your business

Coding agents are now standard equipment, for attackers too. A model vendor's safety controls cover that vendor's model. Point the same harness at a cheaper backend and those controls are not in the request path.

The same pattern shows up on your side, minus the crime. A developer finds a reseller selling "Claude-compatible" tokens at half price. Claude Code reads its API endpoint from an environment variable. One change, and your source code, your .env reads, and your customer data in test fixtures all go to a company you have never heard of.

What we do:

Pin the endpoint. Set the API base URL and allowed models in managed config that developers can't override. Block unknown LLM hosts at the network edge.

Treat agent history as sensitive data. This attacker got caught because session logs and memory files sat in an open directory. Yours hold prompts, file contents, and sometimes secrets. Keep them out of shared drives and public buckets.

Audit your side systems. The broker portal and the staff app got hit, not the core ledger. Inventory everything internet-facing, not just the crown jewels.

Sources: CrowdStrike, BleepingComputer.