Artex AI Cyberattack: Lessons from the Japanese Corporate Breach

What is the Artex penetration testing tool?

Artex is an autonomous penetration-testing tool designed to help organizations strengthen their cyber defenses by using AI to identify potential weak points. A developer in the Chinese-speaking world released the software publicly in July 2026 on an online technical information-sharing service.

The tool was originally intended to assist security teams in finding vulnerabilities within their own systems.

Key Security Lessons from the GMO Internet Group Cyberattack

The Artex tool was identified as the source of unauthorized access in Japanese corporate networks following an investigation by the information security arm of the GMO Internet Group. On October 19, 2026, GMO Cybersecurity by Ierae announced there was a high likelihood that this Chinese-language AI agent was used in the cyberattacks.

Researchers detected traces of the agent on all six overseas public servers they examined between September 18 and October 18, 2026. The security firm confirmed the tool's involvement after conducting an investigation in collaboration with external organizations.

Who was targeted by these AI-powered attacks?

The operation targeted approximately 80 Japanese companies in sectors including finance, insurance, and logistics. According to Daiki Fukumori of GMO, the attacks were almost exclusively focused on Japan.

The campaign appears to be a sector-focused operation that switched attack hosts. Between September and October 2026, eight of the targeted companies disclosed data breaches, which indicates a series of crimes by the same group. Dozens of companies, including restaurant chains and a car hire operator, reported unauthorized access that potentially impacted millions of customers.

How did the Artex AI cyberattack occur?

The developer of Artex ceased public distribution of the tool on October 8, 2026, after confirming it was used in cyberattacks. The developer stated that this use was entirely contrary to their original intent, which was to help organizations improve their security.

Yeni Şafak English reported that the Chinese AI tool Artex was used in a wave of cyberattacks on Japan. Prior to these incidents, the software was also linked to hacks on financial institutions in South Korea, leading to its removal from public access to prevent further misuse. The developer has since blocked programmer access to the source code and confirmed that the project will no longer receive updates.

How Companies Can Protect Systems Against AI-Powered Threats

In response to these incidents, the Japanese government has called on companies to strengthen their cyber defenses, with the head of the ruling party’s cybersecurity committee declaring a state of emergency this month. JPCERT/CC has confirmed that AI agents were used in these attacks and is urging organizations to perform a comprehensive review of their systems.

Daiki Fukumori, who led the investigation at GMO Cybersecurity by Ierae, noted that attackers gained access through weaknesses in a small number of systems. Daiki Fukumori urged companies to conduct a comprehensive review for vulnerabilities.

Are AI-Powered Cyberattacks Affecting Other Countries?

The impact of this Chinese AI tool extends beyond Japan. According to U.S. security firm CrowdStrike, Artex was used in a series of attacks against multiple financial institutions in South Korea during September and October 2026.

Various news outlets, including CHOSUNBIZ, the Seoul Economic Daily, and 파이낸셜뉴스, have confirmed that the same tool targeted both Korean banks and Japanese companies. News reports from South Korea also noted that the tool, which was previously used against Korean financial firms, subsequently struck 80 Japanese businesses.

GMO Cybersecurity by Ierae is currently investigating whether other countries have been targeted in addition to Japan and South Korea.

Current Status of the Artex AI Cyberattack Investigation

Daiki Fukumori of GMO Internet Group identified six internet servers that were actively launching AI-powered attacks against industries including finance, e-commerce, and logistics.

The company’s information security arm has provided details regarding these six servers to law enforcement agencies. The information security arm has shared information regarding the six servers with law enforcement agencies to prevent further damage.