Researchers looking into reported breaches at South Korean banks found an open directory. A Chinese instruction file there pointed them to a server in Hong Kong holding Claude Code session histories, Artex configuration files and memory files.
That trail shows AI tooling connected to the campaign. It does not settle how much the actor directed by hand.
The Directory Led to Bank Attack Records
CrowdStrike says the campaign ran from late September to early October 2026. It reported a breach of a loan progress checking service at one bank and a mobile system used by employees at another.
The reported counts cover different groups. Shinhan said about 25,000 customers were affected. Reuters counted at least nine banks that disclosed attacks or appeared in local media. The Record, citing officials, reported at least seven institutions and at least 68,000 people with affected data. Those figures should not be added into one total.
CrowdStrike links the activity with moderate confidence to an actor tied to China and describes the actor as likely one person. “Likely” matters here: the reporting does not confirm a lone operator.
Artex Leaves the Actor’s Role Unclear
One tool in the files was Artex. It breaks an objective into smaller tasks and, by default, runs three workers per task. Those workers can make bash and HTTP requests at the same time. CrowdStrike says this instance used DeepSeek v4.1 Flash as its main language model.
Reuters and CrowdStrike report requests to Claude about selling Korean breach data and finding Korean Telegram sales groups. The reporting does not say whether Claude answered, refused or flagged them. CrowdStrike also reports a prompt for a security researcher resume. It says personal details in that prompt likely belong to the actor, but it cannot definitively link them.
CrowdStrike says AI tooling can enable a financially motivated actor to conduct multiple intrusions in a short time. The exposed files show why the tooling drew attention, but they leave a central question open: how was Artex configured, and how much of the campaign did the actor direct by hand?
Local AI Tests Split Speed From Model Fit
A separate local AI comparison shows why a fast result is only part of a hardware choice. The shared speed test used a roughly 3.8 GB, 4-bit Llama 2 model with 7 billion parameters. The desktop RTX 5090 generated 290 tokens a second, the RTX 3090 reached 158, and the RTX 5090 laptop reached 156.5.
Prompt reading gave a different ordering. The laptop scored 6,667, ahead of the desktop 3090 at 5,175. These were volunteer runs on different builds and drivers, using a small model. They are useful results for that test, not a controlled comparison of larger models.
Then there is room for the model itself. A 32 billion parameter Qwen 3 file is 19.8 GB at 4 bits, 23.2 GB at 5 bits, 26.9 GB at 6 bits and 34.8 GB at 8 bits. A 24 GB card holds the 4-bit file with about 4 GB left for the context cache. A 32 GB card reaches the 6-bit file. Neither holds the 8-bit file.
For the 70 billion parameter Qwen 3, the 4-bit file is 42.5 GB. Even its 34.3 GB 3-bit file is too large for the desktop RTX 5090’s 32 GB. Apple lists the M5 Max with up to 128 GB of unified memory, and the 42.5 GB file fits on its 64 GB and 128 GB machines. The speaker’s ceiling of about 14 tokens a second for that setup is a calculation, not a measurement.
Model design also changed the speed result in a Hardware Unboxed test. A 30 billion parameter Qwen 3 mixture of experts model produced 234 tokens a second, while a dense 32 billion model produced 61. Both used 4-bit class quantization and a 4K context. Parameter count alone does not explain that gap.
The Jobs Claim Has No Job Count
Asked about AI and employment, the engineering careers speaker says, “I think in the short term it will destroy a lot of jobs.” The post gives no job-loss figure. The speaker expects agent automation to expand across development, testing, maintenance and data analysis, while describing change as gradual in some roles.
For graduates, the speaker advises mastering the basics, learning an industry, building things and collecting evidence of their work. That is a career view, not a measured account of AI’s effect on hiring.
The bank story ends with a more concrete check: where .claude files are stored, who can reach them, how long logs are kept and where backups copy them. Claude Code’s session logs are plain text. In this case, an open directory led researchers to histories, configuration and memory files, while the actor’s level of hands-on direction remains uncertain.