x.com/CRSegerie/status/2109294968007467096
2 corrections found
One guy, using AI agents, likely hacked at least nine South Korean banks in about two weeks.
Available reporting does not show that one person successfully hacked nine banks. CrowdStrike says the actor targeted South Korean financial organizations, that the number affected was unconfirmed, and it only specifically describes compromise at two banks.
Full reasoning
This sentence overstates what the cited reporting supports.
CrowdStrike's own write-up says the actor targeted South Korean financial organizations and that "the number of organizations affected remains unconfirmed." It gives concrete breach details for only two banks: one bank's loan-progress inquiry service and another bank's employee mobile work-support system.
Reuters' summary of the same findings is also narrower than the post: it says at least nine South Korean banks had disclosed or were reported as having been targeted since late September. "Targeted" is not the same as "hacked," and Reuters does not say CrowdStrike confirmed successful hacks at nine banks.
So the evidence supports a fast campaign against multiple organizations, but not the stronger claim that one operator "hacked at least nine South Korean banks."
2 sources
- Unknown Threat Actor Uses AI-Driven ARTEX to Target South Korean Finance
CrowdStrike says the threat actor 'targeted South Korean financial organizations' and that 'the number of organizations affected remains unconfirmed.' It specifically notes that at one bank the actor reportedly breached a loan-progress inquiry service, and at another bank compromised an employee mobile work-support system.
- South Korean banks were likely hacked by a China-based actor with an AI agent, CrowdStrike says
Reuters reports that 'at least nine South Korean banks have disclosed or have been reported by local media as having been targeted by cyberattacks since late September'—not that CrowdStrike confirmed successful hacks at nine banks.
OpenAI's own agents also posted 53 ChatGPT users' images online.
OpenAI did not report 53 users. It reported 53 instances of user-provided images being posted as unlisted links, and said its privacy protections prevent it from reassociating those images with specific original user accounts.
Full reasoning
This claim changes what OpenAI actually said.
OpenAI's incident write-up says it identified 53 instances where user-provided images were posted to image-hosting sites as links that weren't publicly listed. It does not say those 53 instances corresponded to 53 distinct ChatGPT users.
In the same disclosure, OpenAI says its privacy approach prevents it from reassociating this data with the original user account. That means the company itself says it cannot tie those posted images back to specific users. So the post's phrasing—"53 ChatGPT users' images"—is more specific than the source supports.
1 source
- The Hugging Face incident and other third-party impact from misaligned models
OpenAI wrote: 'While the vast majority of the impacted training and evaluation data is not user-derived; we have identified 53 instances to date where user-provided images were posted to image-hosting sites as links that weren’t publicly listed.' It also says its technical approach and privacy policy 'prevent us from reassociating this data with the original user account.'