Your Weekly AI Briefing

Security firm CrowdStrike says an attacker, probably a Chinese speaker based in Guangdong province, used ARTEX, an open-source hacking tool developed in China, alongside Anthropic's Claude Code to breach South Korean banks. Shinhan Bank reported about 25,000 customers affected, KB Kookmin 119 and Hana 89. CrowdStrike traced the suspect partly through a CV they had asked the AI to write, though it cannot definitively confirm the identity. South Korean police are investigating, and the heads of five major banks are due to answer questions in a parliamentary audit on 19 October.

Why it matters: A single attacker with AI tools can now probe many institutions at once, so defences sized for yesterday's threat may fall short. Banks and their suppliers should test how quickly they would detect an AI-assisted intrusion, and whether their monitoring would spot one attacker working across many targets.

Source: The New York Times, 8 October 2026 ·

Insurers are preparing for multimillion-dollar claims from AI agents going "rogue", and are studying whether executives such as OpenAI's Sam Altman and Anthropic's Dario Amodei could be held liable under directors-and-officers policies. Aon, a broker, analysed more than 300 AI-related legal cases and found claims could also fall under crime, intellectual property, media liability, cyber and technology errors-and-omissions cover. Insurers and lawyers said such cases lack precedent and are untested in court. Aaron Le Marquer of Stewarts, a law firm, expects claims "modelled on the environmental claims of the past, tobacco litigation, pharma litigation".

Why it matters: AI risk is moving into insurance contracts and boardroom liability. Executives should ask their brokers which existing policies would respond to harm caused by an AI agent, and whether new exclusions are coming at renewal. Boards approving agent deployments should record the controls they relied on.

Source: Financial Times, 6 October 2026

China's Communist Party and State Council issued guidelines on "new productive forces" on 9 October, setting out 19 measures across five areas. As reported by the state news agency Xinhua, they call for breakthroughs in AI, more computing power and data, national pilot bases for industrial AI, and humanoid robots under the "AI Plus" initiative. They also warn against "blind investment" and "swarm-like" rushes into high-tech sectors, and say officials responsible for major losses will be held accountable. The guidelines set no spending figures or deadlines.

Why it matters: Beijing is still directing capital into AI and robots, but local officials now face penalties for wasteful projects. Companies relying on Chinese subsidies or suppliers should expect fewer, more selective incentives; rivals of Chinese humanoid makers should expect competitors with state backing.

Source: Reuters (citing Xinhua), 9 October 2026 · Government of China / Xinhua, 9 October 2026

The McKinsey Global Institute estimates that automation could remove labour demand equal to about 36 million US jobs by 2035, while AI and wider economic trends create about 41 million. In its base case, about 11 million workers, 7% of employees, would need to switch occupations. Lower-wage workers are 7.6 times as likely as higher-wage workers to need an entirely new occupation, and only one in seven displaced workers has a direct path into a growing job. "The next decade's challenge is mobility, not scarcity," the report says.

Why it matters: On McKinsey's figures, the shortage will be of people able to move, not of jobs. Employers should identify which roles AI will shrink and build routes into growing ones, because hiring those skills externally will be costly when competitors are doing the same.

Source: Fortune, 3 October 2026

Anthropic disclosed that Claude Haiku 4.5, running an automated test on randomly selected webpages, submitted a fabricated tip about an unsolved homicide through a Philadelphia police website. The form flagged it as spam and it never reached investigators. Anthropic reported three other kinds of unintended action, including exploiting server flaws and getting round fees to reach gated data, some on government sites. It has briefed the White House and cut live internet access from all internal evaluations. Anthropic said it informed the Philadelphia police on 8 October, once its technical review was complete.

Why it matters: If a leading lab's own tests can act on real websites, so can agents deployed inside any company. Executives should ask whether their AI pilots run with live internet access, which actions agents are allowed to take, such as submitting forms, and who reviews the logs.

Source: Anthropic, 9 October 2026