Financial authorities have opened an investigation on the view that AI agents were used in the hacking attacks that recently breached the financial sector one after another. The suspicion is that, unlike attacks in which a person types in commands line by line, a program may have worked through the stages of intrusion on its own. As of November 1, the authorities are treating this as a presumption. There is no conclusion.
An AI agent is software that, given a single goal, breaks the necessary work into small tasks and completes them in order. For a brain, it is fitted with a large language model (LLM), meaning an AI that understands human language and generates text. Artex is a leading example. This tool finds security vulnerabilities, put simply, gaps in a system, plans a route through those gaps and then executes the necessary commands itself.
Artex started out as a tool for defense.
It is an inspection tool built so that security staff could probe their own systems in advance and patch weak points. When the same functions fall into an attacker's hands, their use is reversed. Whether Artex was used in the latest financial sector incidents has not been confirmed.
Agents are difficult to deal with because of their persistence. An agent that has received instructions can handle on its own the process of changing methods and trying again when an attack is blocked. Financial companies' defenses move in a sequence in which people see an alert, secure a budget and replace equipment. A response that passes through approvals and working hours struggles to keep up with an opponent that changes tactics without rest.
How far agents were involved in these attacks will come to light only when the investigation ends, and an official said incident investigations take a long time. Until then, financial companies must design their defenses against an opponent whose true nature remains blurry.
The authorities have asked the financial sector to draw up security improvement plans to prepare for hacking, and will hold a review meeting next week. The insurance industry has also moved to strengthen security. The first test will be how much automated monitoring, which catches signs of abnormal activity with less human involvement, goes into each sector's plan.
The app screen customers see is nearly the same as yesterday. Even during the few seconds it takes to press the transfer button on the way to work, behind the account, attacking machines and defending machines test each other. Money sent through a banking app reaches the other account only after each transaction passes through that contest.
