First they came for poker, then crypto. AI-assisted attacks on South Korean banks could hand regulators the excuse to come for open source.
A disturbing story came to my attention this week. In late September, several banks in South Korea were hacked. Hacking is nothing new of course, but the scale of the attacks and the way they were carried out soon led investigators to suspect, and then confirm, that AI had a hand in it.
Between Sunday 27 September and Thursday 1 October, someone worked their way through seven South Korean financial firms, among them household names like Shinhan and KB Kookmin, and made off with data on roughly 68,000 people. Nobody stormed the vaults. The attackers went in through the side doors, the systems used by employees, contractors and loan agents: a loan-inquiry service at Shinhan, employee support systems at Kookmin and Hana. Shinhan took 15 hours to notice. Some of the others took days. The Korea Financial Security Institute then traced the attackers’ IP addresses and server logs and found evidence pointing to ARTEX, a Chinese-language, open-source penetration-testing tool that anyone can download from GitHub. (Penetration testing is what the good guys do to find the holes before the bad guys do. ARTEX hands the whole job to a team of AI agents.) Who was at the keyboard is anyone’s guess, and experts are careful to point out that ARTEX may not have been the only tool used. That didn’t stop President Lee Jae Myung ordering a thorough investigation on 4 October.
The reason this set off my particular alarm bells is that I have very little faith that those with the means, motive and opportunity to impose draconian control over our lives will resist the temptation. A friend of mine tried to play some low-stakes online poker a few years back, and what happened to him illustrates what I mean.
One day, the online gambling site PokerStars decided he wasn’t allowed to play €1 sit-and-go tournaments unless he sent them shots of his passport, his face from multiple angles, his tax ID and his inside leg measurement. After failing the test thanks to Spanish bureaucracy, he tried other poker sites based in Malta, Gibraltar and the other side of the world, but it didn’t matter. They all demanded the same thing.
Why? Because the Financial Action Task Force (FATF), an unelected global body, had decided it should be so. The G7 created the FATF back in 1989, and now, if FATF says jump, every government on Earth asks “how high?” (Strictly speaking FATF only makes recommendations, but a country that ignores them ends up on its grey list, which amounts to much the same thing.) Its rules filtered down through national laws until every online poker site in the world had introduced KYC (“Know Your Customer”) checks. No elections, no accountability. On the face of it, it looks like a one-world government in all but name, but it’s actually far less coordinated than that.
The story shows how widely, thoroughly and quickly the establishment can, if it has a mind to, introduce rules that are effectively global.
A few years later a similar fate befell crypto exchanges. Seemingly overnight, it became impossible to trade cash for bitcoin or vice versa on an online exchange without identifying yourself for tax purposes. At least, that’s the official line. Behind the business-suit rhetoric there are reasons to do with control and political stability. Clearly it is not to governments’ advantage to have unaccounted-for mountains of money sloshing about the planet. That’s how terrorism gets financed, and terrorism threatens power. The EU has even legislated to ban anonymous crypto accounts on exchanges from 2027. Earlier drafts went after self-custody wallets too, before that idea was dropped. For now. Not that it makes much difference, when the only way to turn coins in your own wallet back into cash is to KYC yourself to an exchange. The whole reason Bitcoin was brought into being was to let people transfer value person to person, and the ‘establishment’ are trying their best to stop it. Also, by tying crypto to exchanges, the ‘establishment’ gets to consolidate power in large crypto companies and put their own men on the boards, just as they have with the banks. As George Carlin said: “It’s a big club, and you ain’t in it!”
So when I heard about the South Korean bank attacks I had a flash of déjà vu. The war drums are sounding on AI regulation today, with even the AI companies calling for it. Sam Altman told the US Senate back in 2023 that he’d like a government agency to license the most powerful models, and only last month the CEOs of Anthropic and OpenAI said their cutting-edge models are powerful enough to be dangerous, and need regulating and independent testing before release. It’s early days, but I suspect the script will go like this. We will hear no end of stories in the press about the security and terrorism threats of AI. It will be demonised beyond reason. Legislation will demand registration. KYC will be required for frontier model subscriptions, and we will meet a new public enemy: ‘open source’. Open-source models, open weights, even open-source software itself will be cast as an un-American communist plot to steal your money. Microsoft, which bought GitHub in 2018, will probably be coerced into leading the way with KYC for open-source software, a practice that will then be forced on source control systems worldwide.
I’ve been talking about the establishment very generally, to bracket together a variety of Western interests both private and public. I’m no geopolitical expert, and I don’t have much of a clue how the BRICS countries fit into this jigsaw. It was hard enough before Trump’s second term, but chaos is the watchword these days. I’ve just heard, as I write this, that Trump has agreed a deal with Putin to supply Russian diesel to America, a move few of us probably had on our October 2026 bingo card. Short-term predictions are therefore a complete crap-shoot, but in the long term it seems to me that AI is going to become the focus of a struggle for control. I urge everyone to learn about AI, learn to use local models, learn its strengths and weaknesses, and use it for the good of their communities. As I’ve argued previously in these blogs, AI is too important a technology to be owned and operated by a tiny cohort of billionaires, or by a tiny cohort of allied countries. We need to demand that AI, the new means of intellectual production, is owned by the people, for the people.