Synack CEO Says AI Amplifies Attackers as South Korea Reviews 16 Firms

Synack CEO Jay Kaplan said artificial intelligence can amplify attackers’ expertise as South Korean investigators review breaches across 16 financial companies and assess whether any involved the technology.

South Korea’s Financial Services Commission (FSC), the country’s financial regulator, reported Oct. 14 that 16 financial companies had recently experienced data breaches, affecting an estimated 100,000 pieces of customer data. The estimate counts pieces of data, not people. By that date, no reported breach involved account passwords or credit card numbers.

The Financial Supervisory Service and Financial Security Institute were investigating whether the incidents were related, involved the same attacker or used AI. The commission said those questions remained under review; the tally does not establish that one actor targeted all 16 companies or that AI featured in every case.

A separate campaign against South Korean financial organizations ran from late September to early October. Exposed infrastructure tied to the activity contained ARTEX configuration files and Claude Code session histories. ARTEX is an open-source, agentic penetration-testing tool developed in China. The number of organizations affected in the campaign is unconfirmed. A connection between the campaign and the 16-company tally has not been established.

CrowdStrike assessed with moderate confidence that the operator was likely Chinese-speaking and financially motivated, citing Chinese-language prompts and ARTEX’s development in China. The company did not name an adversary.

A June benchmark of six frontier AI systems recorded an average Pass@3 result of 16.1% for GPT-5.5 with Codex on simulated web-exploitation tasks without extra hints. Its result rose to 33.0% with the most task-specific hints. The benchmark used simulated cyber ranges rather than live attacks, and its results do not establish how AI was used in the South Korean breaches.

Kaplan, Synack’s CEO and co-founder and a former National Security Agency (NSA) hacker, argued in an Oct. 27 commentary that security teams lack enough skilled personnel. “When attackers have AI at their disposal, their expertise multiplies,” Kaplan wrote. Synack completed its merger with NetSPI on Oct. 5 and describes its security testing as combining AI with human expertise.