President Lee states AI agents detected in South Korean bank intrusions on 6 October 2026

President Lee announced the finding after forensic review of intrusion logs from multiple domestic banks. Attack sequences showed automated reconnaissance, credential stuffing, and lateral movement consistent with agentic AI rather than human operators. The statement followed internal briefings from the Financial Supervisory Service and National Intelligence Service.

Network telemetry from affected institutions recorded decision loops under 200 milliseconds and polymorphic payload generation absent in prior campaigns. These metrics align with documented behaviors in open-source AI red-team frameworks released between 2024 and 2025. No CVE identifiers have been assigned; the incidents remain under active classification.

The development connects to earlier reports of AI-assisted phishing kits observed in Southeast Asian financial crime clusters during 2025. Korean regulators had previously mandated multi-factor transaction signing, yet the new vectors bypassed these controls through context-aware session hijacking. Operational impact includes extended monitoring windows and potential delays in real-time settlement systems.

The Financial Supervisory Service is scheduled to release sanitized indicators of compromise by 20 October 2026. Banks must submit updated detection rules within 30 days or face capital add-ons under existing cybersecurity guidelines.