Stupid Fuck Award Candidate: When Your AI Hacking Assistant May Help Identify You

Sometimes you read a cybersecurity story and wonder whether somebody is deliberately trying to win the Stupid Fuck Award.

Well, thanks to the October 13, 2026 edition of SANS NewsBites, I think we have another candidate.

According to SANS, CrowdStrike investigated AI-assisted attacks against South Korean financial institutions. The attackers reportedly used ARTEX, an open-source agentic penetration-testing tool, along with large language models. The incidents involved the compromise of personal information at several financial institutions.

Now here’s where things get interesting.

Investigators reportedly discovered exposed AI session logs associated with the campaign. Among the material was a request to compose a résumé. The information in that request might help identify the person behind the attacks.

Wait a minute. You’re allegedly using AI to attack banks, and then you’re leaving behind information that could tell investigators who you are?

What could possibly go wrong?

The tool can leave a trail

We’ve spent a lot of time talking about AI making cybercrime faster and easier. Attackers can use automated tools to probe networks, write code, and process stolen information. But those same tools can generate logs, prompts, temporary files, configuration data and other artifacts.

If those artifacts are exposed, investigators may be able to reconstruct what happened. In this case, CrowdStrike reportedly found session information that may provide leads about the attacker’s identity.

The irony is rather delicious: a tool used to assist an intrusion may also help the people investigating it.

Let’s not get ahead of ourselves

Before we hand out the trophy, there’s a distinction worth making. The SANS report says the résumé request MAY contain identifying information. That does not mean the suspect has been conclusively identified, arrested or convicted. We also don’t know whether the résumé information was truthful.

An exposed résumé request is a lead, not proof of who committed a crime. Investigators still need to verify the evidence.

But even with that qualification, leaving potentially identifying personal details in an exposed AI session is an astonishing operational-security mistake.

The award nomination

So, congratulations to whoever left that trail, assuming investigators establish that it belongs to the attacker. You’ve given cybersecurity commentators something to talk about, and perhaps you’ve given investigators something useful as well.

This is a Stupid Fuck Award CANDIDATE for now. If the investigation confirms what the logs suggest, we may have ourselves a winner.

And for everybody else, here’s the lesson: AI isn’t magic. It doesn’t erase evidence. In some cases, it creates more of it.

Thanks, SANS NewsBites. I wasn’t even looking for an award candidate, and you delivered one.

Sources

• SANS NewsBites, October 13, 2026, Volume 28, Number 76, “CrowdStrike Investigation of Cyberattacks on South Korean Banks May Have Turned Up Information That Identified Hacker.”
• CrowdStrike, “Unknown Threat Actor Uses AI-Driven ARTEX to Target South Korean Finance.”