[Financial News] Cyber threats powered by artificial intelligence (AI) are spreading, but the domestic banking sector's response remains in its infancy. In particular, domestic banks are understood to have conducted penetration tests using AI agents for the first time only this year. Such tests accounted for just over 10% of all penetration tests. Banks are effectively defenseless against increasingly intelligent and sophisticated AI-enabled hacking. AI hacking runs rampant, but response preparations remain in their infancy Data submitted by the Financial Supervisory Service to the office of Park Sang-hyuk, a Democratic Party of Korea lawmaker and secretary of the National Assembly’s Political Affairs Committee, showed that 20 domestic banks had conducted a total of 78 penetration tests through August this year. Only 9 of those tests, or 11.5%, used AI agents. This year marked the first time that banks used AI agents for penetration testing. Until last year, there had been no cases of AI agents being used for such tests at commercial, regional, internet-only or specialized banks. The seven commercial banks—KB Kookmin Bank, Shinhan Bank, Hana Bank, Woori Bank, Standard Chartered Bank Korea, Citibank Korea and iM Bank—conducted 44 penetration tests through August this year, but only 4 of them, or 9.1%, used AI agents. Among the five regional banks—Busan Bank, BNK Kyongnam Bank, Kwangju Bank, Jeonbuk Bank and Jeju Bank—only 1 of 13 tests, or 7.7%, used AI agents. The specialized banks fared even worse. The five specialized banks—Korea Development Bank (KDB), Industrial Bank of Korea (IBK), Export-Import Bank of Korea (KEXIM), Nonghyup Bank and Suhyup Bank—conducted 13 penetration tests this year, but none used AI agents. The three internet-only banks—KakaoBank, K Bank and Toss Bank—were relatively better prepared, with 4 of the 8 tests they conducted this year, or half, using AI agents. Banks began using AI agents for penetration testing because AI started to be used in earnest in actual cyberattacks around last year. In a report analyzing cyber threat trends from last year, Mandiant, Google Cloud’s cybersecurity subsidiary, stated, "In 2025, hackers moved from experimenting with AI to using it in actual attacks in earnest." AI has evolved from mainly assisting human tasks, such as writing phishing messages and generating code, to being directly integrated into attack processes, including financial hacking. Although AI-enabled cyberattacks are rapidly becoming more sophisticated, the banking sector’s AI-agent-based defensive training is failing to keep pace. Regional banks are vulnerable links in defending against AI attacks There are concerns that the greater hackers’ use of AI agents could widen the response gap between banks depending on their digital and cybersecurity capabilities. Regional banks, which generally have fewer specialized personnel and less capacity to build systems, could become vulnerable links against new forms of attack. A financial security industry official said, "Large banks are at least building the personnel and systems needed to prepare for AI-based cyberattacks, but the situation is different for regional banks." The official added, "If attacks using AI agents gain momentum, regional banks could become relatively vulnerable links." As hacking and data breaches have recently occurred one after another in South Korea’s financial sector, financial authorities have also warned of the possibility of AI-enabled attacks. At an emergency meeting held at Government Complex Seoul on the 4th to inspect responses across the financial sector to recent intrusion threats, Financial Services Commission Chairman Lee Eok-won urged the sector to maintain the highest level of vigilance, saying, "The possibility of attacks using AI cannot be ruled out." Financial authorities subsequently instructed financial companies to reexamine their overall security frameworks, including externally exposed information technology (IT) assets, authentication and access controls, and systems for detecting malicious activity. Park Sang-hyuk emphasized, "Although AI is now widely used in hacking, many banks are only beginning to respond to AI-enabled hacking, while others have not yet begun. Financial institutions need a shift in both mindset and policy so that security is viewed as an investment rather than a cost." [email protected] Seo Ji-yoon and Park Moon-soo Reporter