GMO security unit finds ARTEX AI agent on servers attacking Japanese firms

What GMO found

GMO Cybersecurity by Ierae, a Tokyo security company in the GMO Internet Group, says it has confirmed that an AI hacking agent called ARTEX was used in some of the break-ins that have hit Japanese companies since September. In a blog post published on 19 October 2026, Daiki Fukumori of the firm's GMO Cyber Crime Countermeasure Center wrote that when the team examined the servers attackers were using, it found ARTEX, an autonomous penetration-testing system, running on them.

The finding backs up a suspicion Fukumori raised four days earlier. In a post dated 15 October, he said that, judging from forensic logs and his own research into telling human attacks from AI ones, it was "almost certain" that AI had been used in the recent wave of intrusions. The new post says the server analysis confirms that estimate.

The news spread quickly in Japan. Nikkei reported on the evening of 19 October that it appeared to be the first time ARTEX had been tied to attacks on Japanese targets. NHK and the Yomiuri Shimbun followed early on 20 October, and Kyodo News ran an English-language breaking headline saying a "China-linked AI agent may be behind Japan cyberattacks." GMO itself does not say who the attackers are or where they are based.

Seven attack servers, each aimed at one kind of business

GMO says the first attack server it studied, together with outside organisations, was aimed almost entirely at Japan, at least as far as the firm could observe. It targeted about 20 Japanese companies, and nine of them ran websites in the same industry. Reading that alongside CrowdStrike's findings in South Korea, GMO concludes that the attackers run campaigns narrowed by country and by sector, and set up a separate attack server for each campaign.

Following that lead, the team found six more servers using AI that were likewise aimed mostly at Japanese companies. GMO lists the main targets of each one: digital gifts and retail distribution; education, gifts and printing; loyalty points, gifts and marketing; insurance and finance; e-commerce, media and logistics; and e-commerce alone.

Among the Japanese companies GMO confirmed as targets, eight had already put out data-breach notices in September or October 2026, which GMO says shows one attack group causing several of the breaches. It has passed what it found to law enforcement. The Yomiuri, citing the same research, counts the attacks differently: it says six overseas public servers used against Japanese companies between 18 September and 18 October all showed traces of ARTEX and no other AI agent, and that about 80 companies in insurance, finance, logistics and other fields were attacked. GMO's blog does not give a total, so the 80 figure comes from the newspaper's reporting.

What ARTEX is

ARTEX is not a language model. It is an agent framework that connects to outside large language models and uses them to analyse a target, plan routes in and run standard security tools, the work a human penetration tester would normally do by hand. Penetration testing itself is legal and routine: companies hire testers to attack their own systems and report the holes.

The Yomiuri says a Chinese-speaking developer posted ARTEX publicly in July 2026 on a code-sharing site, and that it is known for searching thoroughly for weaknesses. After the Korean attacks were made public, the developer, who uses the handle Autumn-27, stopped updates and said the project would become closed source. BleepingComputer reported that English- and Korean-language versions built from the existing code are still circulating, so the tool remains available in its last public form. The developer has said ARTEX was designed to help organisations improve their security.

The link to the South Korean bank attacks

Japan is the second country where ARTEX has turned up in real attacks. On 7 October, CrowdStrike published an analysis of a campaign against South Korean financial organisations that ran from late September to early October and ended in stolen data. The attacker left open directories on its own servers containing Claude Code session histories, ARTEX configuration files and Claude memory files, which let researchers see the operation from the inside. AI Lookout covered that report when it came out.

CrowdStrike said the ARTEX instance used DeepSeek v4.1-flash as its main model, with GLM-5.3 from Zhipu AI and Grok 4.6 used for extra Claude Code sessions. That detail has since gained a policy angle: the US Department of Homeland Security has ordered federal civilian agencies to remove DeepSeek, including tools built on it, although that order rests on supply-chain grounds, not on this case.

GMO says the Japanese campaign looks like the same method used in Korea, but it presents the connection as an inference rather than proof. It is still investigating whether countries other than Japan and South Korea are being targeted, and says it will report back on its blog.

How the intruders got past defences

Fukumori's 15 October post, written before ARTEX was confirmed, explains why companies that believed they had done the basics were still breached. He draws on many cases brought to GMO, not on any single victim, and names three blind spots.

The first is relying on CVE records, the public database of known vulnerabilities. Those records list affected versions, but other versions are often vulnerable too, especially unsupported ones that are never checked or patched. He argues that AI lets attackers trace source code across every version and find these "shadow vulnerabilities" with little effort, so a severity score stops mattering once attacks are automated.

The second is attack surface management, the practice of scanning your own internet-facing systems from outside. External scans often cannot read exact version numbers and must avoid anything that might crash a live service. Attackers have neither constraint and can simply fire exploit code. The third is web application firewalls. Fukumori says the attackers studied the rules closely, for example switching to a new IP address just before hitting a rate limit, rotating through hundreds of addresses in total.

His conclusion is that the surge is not only about AI making attacks easy for anyone. Skilled attackers, he writes, are analysing the gaps between how defenders work and how attacks work, and using AI to exploit those gaps at scale. A similar pattern of one operator running many AI agents at once showed up in exposed Cairn control panels that showed agents breaching more than 100 company sites.

What Japanese companies are being told to do

Fukumori told the Yomiuri that victim companies had been hit through small weaknesses and urged firms to run a full check for vulnerabilities they may have missed. The newspaper also reported that JPCERT/CC, Japan's national computer emergency response team, has seen traces of AI agents in attacks on Japanese companies since August. A column by the Cyber Security Research Institute notes that the Information-technology Promotion Agency (IPA) opened a special consultation desk for unauthorised-access cases on 16 October.

The practical advice from GMO and others is familiar, but the timescale has shrunk. Companies should list every system reachable from the internet, including test servers and forgotten subdomains, patch internet-facing software within days rather than at the next maintenance window, put multi-factor authentication and rate limits on login and admin pages, and watch for bursts of automated requests. A breach notice from a company in the same sector is a warning sign, since GMO found campaigns grouped by industry, and firms in one sector often run the same software.

What is still unknown

Much remains unclear. GMO has not named the roughly 20 companies on the first server's target list or the eight that had already disclosed breaches, and readers should not match them to particular public breach notices by guesswork. It has not published server addresses, the models the attackers used in Japan, or the exact intrusion steps. Its observations cover only what it could see.

Not every recent breach in Japan is an AI attack, either. Companies have reported incidents caused by malware at contractors, phishing and ransomware, and GMO's sister company GMO Research & AI disclosed a data leak of its own; Fukumori's 15 October post says that company runs on systems entirely separate from GMO Cybersecurity's. Who is behind the campaign is also open. Kyodo's headline calls the agent China-linked because of where it was developed, which is not the same as attributing the attacks to China.

Why this case matters

The case shows how quickly an openly published offensive tool can move from one country's banks to another country's online shops. ARTEX was public for only a few months before it was used in Korea, and pulling it offline did not stop the Japanese campaign, which GMO dates to the weeks after the Korean attacks began.

It also shows the new shape of AI-assisted intrusion. The tools themselves are mostly ordinary: scanners, known exploits and password guessing. What the agent adds is speed, persistence and the ability to repeat one successful approach across every company in a sector. For defenders, the signals to watch next are whether GMO or JPCERT/CC publish technical indicators, whether police in Japan or South Korea name a suspect, and whether ARTEX shows up against companies in other countries.