China-based hacker used AI coding agent in attacks on South

CrowdStrike said the campaign was linked to a China-based threat actor and targeted banks and other financial organisations in South Korea. A China-based hacker used Anthropic's Claude Code artificial intelligence tool during cyberattacks targeting South Korean financial institutions, according to cybersecurity firm CrowdStrike. The activity involved an AI coding agent being used to assist with parts of the attack process, including writing and modifying code and supporting attempts to gain access to targeted systems. CrowdStrike said the campaign was linked to a China-based threat actor and targeted banks and other financial organisations in South Korea. The case highlights growing concern among cybersecurity researchers over the use of generative AI tools by hackers to automate technical tasks and speed up offensive operations. AI coding agents can help users generate scripts, troubleshoot software and automate complex programming tasks. Those same capabilities can also be misused to support malicious activity. CrowdStrike said the attacker used Claude Code as part of a broader workflow rather than relying on the AI system to carry out the entire attack independently. The cybersecurity firm said the incident demonstrated how threat actors were increasingly experimenting with commercially available AI tools to improve efficiency and reduce the technical effort required during cyber operations. Anthropic has policies prohibiting the use of its systems for malicious cyber activity and has introduced safeguards intended to detect and block abusive behaviour. The South Korean financial sector remains a frequent target for cyberattacks because of the sensitive data and financial assets held by banks and related institutions. Cybersecurity companies have increasingly warned that artificial intelligence is likely to be used on both sides of the cyber landscape, helping defenders identify threats while also allowing attackers to automate reconnaissance, coding and other stages of an intrusion.