[Beyond the Scene] Fear of 'Autonomous AI Hacking' Grips Finance, Time to Return to Basics

AI Hackers Target Weak Links with Lax Security
Review Basic Security Practices, Including Authentication Systems

The financial sector is on edge amid suspicions that artificial intelligence (AI) was used in a series of recent, simultaneous cyberattacks on financial institutions. Over two to three days, hackers combed through five commercial banks, rapidly scraping information available from their web pages and servers. Without automated attacks using AI agents, it would have been impossible to launch such a large-scale assault on commercial banks in such a short time. The autonomous AI hacking that raised concerns during the “Mythos shock” six months ago and the “Hugging Face shock” three months ago has now become a reality before our eyes.

What makes autonomous AI hacking frightening is its speed and scale, which surpass those of humans. AI agents can automate everything from identifying existing vulnerabilities to carrying out attacks. This latest incident has shown that they can find security gaps that financial institutions have either overlooked or were unaware of, and launch indiscriminate attacks across entire institutions. The International Monetary Fund (IMF) and the Bank for International Settlements (BIS) are also focused on the growing prevalence of AI-powered hacking. They have noted that, for now, AI is more likely to be widely used as a tool to quickly identify and exploit existing vulnerabilities in systems with lax security than to create unprecedentedly sophisticated hacking techniques capable of dismantling existing defenses.

One key question in this latest series of customer data breaches in the financial sector is where the hacking occurred. At commercial banks, the damage was concentrated in work-support services for employees and loan recruiters, areas where security had previously been neglected. After Shinhan Bank was identified as the first victim, industry observers said that if the bank had improved its system to ensure that loan recruiters could view only information they had requested themselves, with security in mind, the customer impact affecting more than 25,000 people could have been avoided. KB Kookmin Bank and Hana Bank, too, could have prevented the damage with simple measures, such as strengthening access controls and addressing known web vulnerabilities. This is why some say the incident tested financial institutions’ security fundamentals.

In the era of AI-powered hacking, attacks may be attempted more frequently than in the past. “Side doors” and peripheral systems that have long been overlooked are prime targets for AI hackers. The BIS has pointed out that hackers are gaining entry through basic weak points, such as inadequate security patches and vulnerabilities at outsourcing firms.

Financial institutions and regulators should consider whether they have focused only on securing core services directly tied to customer accounts. Reviewing peripheral systems, starting with existing defenses and basic security practices, is the first step toward preventing further damage. Experts say that greater investment in security, including staffing, is achievable only if it is not viewed as a sunk cost and is expanded decisively. Paradoxically, the key to stopping AI attacks, armed with rapidly advancing capabilities, lies in returning to the basics.

This content was produced with the assistance of AI translation services.