When AI attacks banks, AI must be part of the defense

Lee Kwang-hyung

The author is a former president of KAIST.

A human attacked the bank, but the weapon was new: artificial intelligence. Recent cyberattacks targeting Korean financial institutions showed signs of AI involvement, with some customer information compromised. According to an analysis by a U.S. cybersecurity company, attackers connected an AI-powered security testing tool called Artex to multiple AI models. However, the precise intrusion methods and AI's role at individual institutions require further investigation.

Previously, hackers had to gather information, write programs and adjust their methods manually after failures. Now AI can handle repetitive tasks: identifying targets, testing vulnerabilities, analyzing results and trying again. Humans set objectives while AI automates parts of the process, accelerating attacks and reducing costs.

Three technological developments explain this transformation.

First is the emergence of agentic AI. Conventional conversational AI answers questions and explains procedures. Agentic AI receives objectives, uses tools and executes multistep tasks. Ask a chatbot about flights to Jeju, and it provides schedules. Ask an AI agent to book a suitable flight, and it can check calendars, compare options and complete reservations.

Multiple agents can also divide tasks and operate simultaneously. In cyberattacks, they can examine network vulnerabilities and automatically test alternative entry points when attempts fail. What once required a burglar to inspect every entrance can now be accomplished by several automated tools working together.

Second is the proliferation of open AI models and automation tools. Some models can be downloaded and operated independently, while publicly available software connects different AI systems with other programs.

Artex, implicated in the recent incident, is not an AI model itself but a tool for automating security assessments. Such technologies help researchers and cybersecurity specialists strengthen defenses, but criminals can exploit them too.

Third, offense and defense are two sides of the same coin. Security professionals searching for vulnerabilities and hackers seeking entry points often employ similar techniques. A knife can serve as a surgical instrument or a weapon.

Moreover, banks cannot readily see what instructions attackers give their AI systems. They can only examine traces of activity, including login records, information requests and program execution.

One distinction remains essential: AI did not independently attack the banks. Humans used it to commit crimes, and responsibility rests with those directing and carrying out those acts. Nevertheless, AI developers and financial institutions must also be examined for their safety precautions.

I propose three responses.

First, AI developers and service providers must make safety a fundamental product requirement. Before release, they should thoroughly test potentially dangerous uses and respond quickly to suspicious activity.

When AI executes external programs or transfers large quantities of information, permissions should be restricted. Potentially damaging actions should require human approval, with detailed records identifying who authorized and executed them.

Crimes involving open models present additional challenges. Widely distributed software cannot easily be recalled or monitored. Yet blanket prohibitions would also obstruct legitimate security researchers using identical technologies to identify and repair vulnerabilities.

Research and defensive applications must remain accessible while unauthorized intrusions and personal information theft face strict accountability.

Second, banks must transform their defenses. Passing an initial security barrier should never automatically establish trust. Internal systems should be segmented, and employees and contractors should access only information necessary for their duties.

This approach, known as Zero Trust, requires rigorous identity verification and access controls. Even legitimate accounts should trigger immediate scrutiny when they retrieve unusually large amounts of information within short periods.

Banks should also deploy AI defensively. Security AI can rapidly identify suspicious patterns across enormous volumes of access records. Preventing intrusions matters, but containing damage after breaches is equally important.

Effective defenses must include mechanisms to stop information leaks and restore systems quickly. Only then can banks build resilient protection against increasingly automated attacks.

Third, governments must act. Hackers cross national borders while investigations and regulatory oversight remain divided among jurisdictions. Even domestically, financial regulators, investigators, banks and AI companies have different responsibilities.

Authorities should establish systems for rapidly sharing information about attack methods and emerging threats. International cooperation is also essential for identifying, pursuing and prosecuting cybercriminals.

Humanity has developed rules with every major technological innovation. Rather than abolishing automobiles, societies introduced traffic lights and seat belts. AI likewise cannot be governed through prohibition alone. Sensible regulation should preserve its benefits while controlling its risks.

Offensive weapons and defensive shields have always evolved together. In the AI era, attackers can continuously search for vulnerable systems. Defenders must learn and respond at comparable speed.

But humans must decide what AI may do, where its actions must stop and who bears responsibility when safeguards fail.

As AI knocks on banks' doors, technology is not the only thing requiring improvement. Our readiness to govern, deploy and defend against that technology must improve just as quickly.