Artex, a Chinese artificial intelligence cybersecurity tool, has halted access to its source code after South Korea linked it to several recent bank breaches. Its developer acknowledged that attackers had misused the software and said the project would stop receiving updates. The decision limits public access to the code of a tool implicated in the attacks, but does not resolve the problem of copies already obtained by users or the competing security arguments surrounding open-source software.

South Korea’s Financial Services Commission says the breaches have affected more than 68,000 people. Shinhan Bank, among the institutions breached, reported that information associated with loan applications for about 25,000 customers had leaked. Separately, around 20 companies in Japan have reported possible data compromises in similar attacks potentially affecting millions of customers. Those figures describe different levels of reported exposure: people affected in South Korea, customers whose information leaked at Shinhan, and possible compromises in Japan.

The Shinhan information included customers’ names, phone numbers and annual income, the bank said. Its disclosure provides a specific account of the records exposed within the broader South Korean breaches. The commission’s figure covers people affected by the hacks, while the bank’s figure concerns customers with loan-application information that was leaked. The distinction matters when assessing the reported scale: the two disclosures describe the incidents at different levels, rather than establishing separate totals that should be combined.

Read more: Trump and Putin agree to release Russian diesel as fuel-price pressure mounts

The developer, identified as Autumn-27, announced the change on Thursday, saying Artex had been “abused by some bad actors” to conduct cyberattacks. The project would become closed-source, with no further versions made publicly available and no maintenance support, the developer said. Autumn-27 also said the use of Artex for attacks ran against the developer’s intentions, without directly addressing the alleged South Korean incidents. The acknowledgement of misuse therefore did not amount to a specific account of how the bank breaches occurred.

CrowdStrike said on Wednesday that its examination of digital clues suggested the attacker had used Artex and could be a 26-year-old based in China. The cybersecurity company described the suspected attacker as likely to speak Chinese and to have a financial motive. Those assessments were expressed as possibilities or likelihoods, rather than confirmed findings about the person’s identity. They add an investigative assessment to South Korea’s link between the tool and the hacks, while leaving uncertainty about who was responsible.

The reports from Japan widen the context without establishing that every incident had the same origin. Around 20 companies there have said their data may have been compromised, and the potential customer exposure runs into the millions. The Japanese government has urged businesses to improve their cyber defences. The Japanese reports concern possible compromises in similar attacks; they do not, on the supplied information, establish an Artex connection equivalent to the one South Korea has drawn in its bank cases.

Read more: Hurricane Isaias brings strong winds and flooding to US Gulf Coast

The incidents come as increasingly advanced AI models bring greater attention to the technology’s capacity to discover previously unknown routes into computer systems. South Korean President Lee Jae Myung warned on Tuesday that, as AI makes hacking more sophisticated, the damage is extending across areas on a scale difficult to compare with earlier experience. His remarks underscored a broader concern about the scale of damage as AI makes cyberattacks more sophisticated.

Restricting access can make Artex’s source code harder for new users to obtain and modify, but that effect has limits. Poe Zhao said closing the source code “cannot remove copies already downloaded or prevent people from continuing to use them”. That distinction separates control over future distribution from control over software already in circulation. Autumn-27 can end public releases and support for the project, but the change does not itself withdraw the code from everyone who acquired it while it was available.

There is also a security argument for retaining openness. Ilya Kulyatin, chief executive of Foundry Labs and founder of the Tokyo AI technology community, said users of open-source programs can strip out built-in restrictions, making some kinds of misuse easier. At the same time, he said, access to the code allows researchers to examine it, find vulnerabilities and strengthen protection. His assessment highlights the competing effects: the same access that permits unwanted modifications also enables scrutiny by people working on defence.

For Artex, the announced next steps are an end to public versions, updates and maintenance, alongside the move to closed-source code. For organisations responding to the attacks, that withdrawal leaves the limits identified by Zhao intact: existing copies remain usable. Japan’s call for stronger corporate cyber defences also stands independently of the developer’s decision. The closure makes Artex’s code harder for new users to obtain, while the reported breaches and the debate over openness show why access restrictions alone do not settle the security questions surrounding the tool.