Chinese AI Tool Artex Linked to Wave of Attacks on Japanese Companies

An autonomous AI agent designed for security testing has turned up on servers used to attack Japanese businesses. According to findings by GMO Cybersecurity, reported by the Kyodo, Jiji and AFP agencies, a China-linked tool called Artex ran on six devices used in a series of attacks.

What investigators found

The findings of GMO Internet Group were reported by Kyodo and picked up in Poland by the PAP news agency. The company's specialists identified six attacking devices that used the AI agent against targets in retail, logistics and finance. A GMO blog post published on Monday describes the servers as targeting almost exclusively companies in Japan.

Jiji Press, meanwhile, reports that the findings come from GMO Cybersecurity by Ierae, a subsidiary of GMO Internet Group. According to the agency, the attacks were traced to six servers, each running Artex, described as an AI-based penetration testing tool. The company reportedly says the same group was behind multiple incidents.

According to AFP, Daiki Fukumori of GMO wrote on the company blog that the attacks were almost exclusively aimed at Japan.

What Artex is

Artex is an autonomous AI agent originally built for penetration testing and finding vulnerabilities in systems. According to its developer, cited by AFP, Artex was meant to help organizations strengthen their defenses by finding weak points. In late September it was linked to a series of unauthorized intrusions at financial institutions in South Korea.

The developer works under the pseudonym Autumn-27. AFP reports that in October they cut off access to the source code and ended updates to the project, admitting that malicious users had exploited the tool. They said that using the program for attacks was entirely contrary to their intentions.

Government response and limits

GMO passed the collected data to law enforcement. The government in Tokyo urged the private sector to urgently strengthen protection of its IT infrastructure. Cybersecurity minister Toshiharu Furukawa said that, after receiving information from affected companies, the government is checking whether AI was used maliciously.

The sources do not say who operates the servers or where they are located, so "China-linked" refers to the tool's origin, not to a confirmed perpetrator. The reports also do not show that Artex caused every breach in Japan or that the attacks were fully autonomous. The figures in the sources refer to different groups: dozens of companies reported incidents overall, while eight financial and logistics firms targeted from the six Artex-linked servers disclosed breaches, according to Jiji.

Why it matters for companies

The case shows that offensive AI tools built for defensive purposes can fall into the wrong hands. AFP notes that AI's ability to find previously unknown ways into computer systems is drawing growing attention worldwide as leading labs release more advanced models. For Polish security teams, it is a signal to account for attacks run by AI agents in their testing and monitoring, but GMO's findings so far concern Japan, and the earlier link between Artex and the South Korean attacks comes from the Korean side.