ARTEX: The AI That Hacks on Its Own

By Muzamil Ahmad · Updated 2026-10-23 · Chatbots

#chatbots#artex ai#artex pentesting tool#ai hacking tool japan#autonomous ai attacks#gmo cybersecurity artex#ai pentesting agent

Save

Inside the autonomous attacks on Japan's companies. All week, the AI story has been about agents that work for you: Gemini agents finishing games unaided, and Anthropic's Claude Duet, which briefs you in the morning and asks before it acts. ARTEX is the same technology pointed the other way. It is an autonomous penetration-testing agent — software that, connected to a large language model, picks targets, plans intrusion routes and runs hacking tools by itself. And according to investigators in Tokyo, somebody has been running it against Japanese companies at scale.

On October 19, GMO Cybersecurity by IERAE — one of Japan's established security firms — published what it found while investigating attacks at its clients' request: on the overseas servers used to hit Japanese organizations, it found traces of ARTEX, and nothing else. No human toolkit alongside it, no second AI agent. Just the machine, working the night shift.

What ARTEX is

ARTEX is a Chinese-language, Chinese-developed autonomous penetration-testing tool, reportedly released publicly by a Chinese-speaking developer in July 2026. Tools like this have a legitimate twin: security teams use "pentesting" agents to attack their own systems before criminals do, and automating that work is an active, respectable research field. ARTEX itself is built for the real thing — connect it to an LLM and it can analyse a target, devise a way in, and operate the security tools needed to get there, chaining the steps a human attacker would take, without a human sitting in the loop for each one.

That design is exactly what makes the Japan findings matter. The skill in hacking was never only knowledge — it was hours. A person has to sleep; a probing campaign run by hand tops out at whatever a small team can touch. An agent does not have that ceiling, and the Japan wave shows what the new ceiling looks like.

What GMO actually found

Strip away the headlines and the verified core, from GMO's own investigation, is this:

• GMO examined attacks over a one-month window, September 18 to October 18, 2026, at the request of victim organizations.
• It identified six overseas public servers used against Japanese organizations — and found traces of ARTEX on all six, with no evidence of any other AI agent on them.
• The infrastructure had targeted about 20 Japanese companies, nine of them in the same industry. Targets concentrated in insurance, finance and logistics.
• Eight of the companies had disclosed breaches in September and October.
• GMO also found six further AI-based attack infrastructures aimed at Japanese firms across retail, education, marketing, insurance and finance, e-commerce, media and logistics, and judged that one group may be running country- and industry-specific campaigns.
• GMO named neither the victims nor an actor, and has shared its findings with law enforcement.

Read that again and notice what it is and is not. It is forensic evidence — traces of one specific tool, on the actual servers, across the actual window — not a vendor press release. It is also, deliberately, not an attribution: GMO's investigators, and the Wall Street Journal's reporting on the case, both stress that the evidence points to infrastructure, not to the people or organization behind it. Whoever ran ARTEX, and on whose orders, is not established. Anyone who tells you otherwise is ahead of the evidence.

About that "80 companies" number

If you have seen this story elsewhere, you have probably seen a bigger number: around 80 Japanese companies targeted. That figure comes from the Wall Street Journal's reporting on the campaign and has been repeated widely — TechDefused's summary lays out the Journal's account in English. It does not appear in GMO's own post, whose confirmed scope is the roughly 20 companies tied to the six servers it examined — and subsequent analysis, including SOCRadar's breakdown of the October breach wave, flags exactly that gap.

Both numbers can be honest at once: GMO documented the infrastructure it was hired to examine; the Journal's sources describe the wider campaign, which reportedly spread its traffic across hundreds of rotating IP addresses kept just under rate-limit thresholds so automated defences would not trip. But they are different kinds of claim — one is a forensic finding, the other is reporting — and this guide keeps them labelled that way, because the difference is the whole story of how AI-attack news will work from now on: the machine scales faster than the verification does.

The Korea chapter, and the developer who went quiet

Japan is not where ARTEX first surfaced. The same tool was tied to attacks on South Korean financial institutions beginning in late September — reported by CrowdStrike on October 7 and covered in Korean media — including cases involving data exfiltration. Then, on October 8, the developer halted public releases of the tool. The July public release is the uncomfortable hinge of the whole case: whoever picked ARTEX up had roughly three months to obtain it, adapt it and point it at live companies before its own creator stopped shipping it. Closing the source in October does nothing about the copies already out.

That is the open-source dual-use problem in its sharpest form to date. A pentesting agent published for defenders is, line for line, an attack agent for anyone else — and unlike a leaked password list, it does not expire.

The timeline, assembled

The article above scatters the dates across sections; laid end to end, they show how fast this moved — and how slowly the public picture formed.

• July 2026: ARTEX is reportedly released publicly by a Chinese-speaking developer.
• September 18: the start of the one-month window GMO later examined in Japan.
• Late September: the tool is tied to attacks on South Korean financial institutions.
• September 25 – October 8: at least 36 Japanese organizations issue first breach notices — the wider wave becomes visible in public.
• October 6: disclosed compromises of Japanese web systems reach 119 for 2026, against 84 in all of 2025.
• October 7: CrowdStrike reports the Korea connection.
• October 8: the developer halts public releases of ARTEX.
• October 18: the end of GMO's examination window.
• October 19: GMO publishes its findings.

Notice the ordering problem. The tool's public career effectively ended on October 8, yet the fullest public account of what it had been used for did not exist until October 19 — and it describes attacks from September. Defenders were reading about the previous month's intrusions weeks after the fact, which is precisely the gap an autonomous tool exploits: it does not need the headlines to be slow, but slow headlines help.

It also means the case is, in evidentiary terms, still young. One firm examining one month is a floor for the tool's activity rather than a ceiling — a further reason this guide keeps the documented scope and the reported scope as separate numbers instead of merging them into one bigger, softer claim.

Why Japan, and why now

ARTEX landed in a country already mid-wave. SOCRadar's count of the public record: at least 36 Japanese organizations issued first breach notices between September 25 and October 8 alone; disclosed compromises of Japanese web systems rose from 84 in all of 2025 to 119 by October 6, 2026, with 81 of those after July 1. The names in October's disclosure wave include Times Car, Lawson, Yamato Transport, Burger King Japan and Nikkei. Most of that wave is not attributed to ARTEX — GMO tied eight disclosed breaches to its infrastructure — and honest coverage has to keep that boundary. What ARTEX explains is not the whole wave; it is how part of it became cheap enough to run.

Three conditions made Japan a soft target for an autonomous agent, and none of them is unique to Japan:

• The language barrier fell. Analysts and officials in Japan have argued for two years that AI quietly removed the Japanese-language obstacle that once slowed foreign attackers — phishing, support scams and social engineering in fluent Japanese no longer need a Japanese speaker. An autonomous agent inherits that advantage everywhere it points.
• Web-facing systems were left to age. While budgets went to VPN and ransomware defence, public web apps and member APIs accumulated small flaws — one breached system in the October wave was roughly 20 years old. Agents are very good at finding exactly the small, boring, unpatched flaw, thousands of times over.
• Suppliers multiply every hit. Several of October's largest exposures came through one contractor, SaaS platform or cloud host serving many companies at once. For an agent scanning at scale, a shared supplier is not one target — it is a door into dozens.

Add a reported national shortfall of more than 30,000 security professionals, and the arithmetic is grim: the attackers automated first.

The week the agents grew up

ARTEX does not exist in a vacuum, and its timing is the story under the story. In the space of a few weeks, autonomous agents have: finished Minecraft unaided in the Gemini 4 Argon run we covered in our Gemini 4 Argon story; been handed your inbox and calendar by Anthropic, with an approval gate as the safety design, in Claude Duet; and now been found, forensically, on the servers behind a national breach wave. Meta's Muse and OpenAI's Dots, the other two consumer agents of the season (compared in our Muse Wonder guide), make the same architectural bet Duet does: a persistent agent, connected tools, work done between prompts.

The difference between Duet and ARTEX is not the machinery — it is the consent. Duet's entire design is that it asks before anything consequential. ARTEX is what the same class of software looks like with the asking removed and the target chosen by somebody else. Every capability argument for agents this year — they work while you sleep, they chain tools, they persist through a task — reads identically as a threat model. Defenders are not imagining this: the same week, Google reported catching attackers using AI to help build a zero-day exploit for the first time, a milestone the security industry had been predicting, in the future tense, for years.

How to read the next ARTEX headline

This story will have sequels, and they will not all be as carefully worded as GMO's post. Four questions separate the solid follow-ups from the noise:

• Who is speaking? A named investigator describing forensic evidence — traces on servers it examined, over a stated window — is one kind of claim. An outlet citing unnamed sources about a wider campaign is another. Both can be true; they do not carry the same weight.
• Which number is it? Watch what happens to the target count as a finding travels from report to headline. Here, a documented ~20 became a reported ~80 within days. When a figure grows in transit, the larger one is usually describing a bigger, looser thing.
• Is an actor named, and by whom? In this case the investigator deliberately named nobody, because its evidence stops at infrastructure. If a government later attributes the campaign, that will be a new claim from a different kind of source — not a detail GMO was hiding.
• What actually changed? New infrastructure, newly disclosed victims, or the same findings recycled under a fresh date? Autonomous-attack stories reward re-reading; not every "new" report is new information.

Who should actually worry

Not every company sits in the same blast radius, and the article's own details draw the map. Exposure runs highest for organizations with public member apps and APIs — the route the October breaches used — and for the sectors GMO's infrastructure concentrated on: insurance, finance and logistics, with the further AI-based infrastructures reaching into retail, education, marketing, e-commerce and media. Suppliers and hosts sit in a category of their own, because one compromise there becomes dozens of downstream victims. And firms running aging web estates carry the quiet risk: the small, boring, unpatched flaw is exactly what an agent scanning at scale is built to find.

Geography is not a defence either. The tool surfaced in South Korea before Japan, the conditions that made Japan soft — a fallen language barrier, ageing web systems, stretched security teams — are described in this article as unique to no country, and a publicly released tool does not respect borders after its release ends. For individuals, the exposure is mostly second-hand: your data sits in the member systems these breaches ran through, so the practical levers remain the ordinary ones — unique passwords, two-factor authentication, and treating breach notices from services you use as prompts to act rather than ignore.

What a business should actually do with this news

You cannot patch against a headline, but the Japan wave has a practical lesson list, and most of it is the unglamorous web hygiene that agents exploit when it is missing — the same list we give in our best AI tools for small business guide, from the defence side:

• Inventory your public web surface. The breaches ran through member apps, APIs and forgotten web systems. If you cannot list every public app and API you run, an agent scanning the internet can, and will.
• Patch the boring flaws first. Agents monetise small, known, unpatched vulnerabilities at scale. A 20-year-old web system still in service is not a legacy asset; it is an open window.
• Rate-limit and watch for distributed probing. The reported ARTEX pattern — traffic spread across many IP addresses, each staying under thresholds — is specifically designed to look quiet per-source. Defence has to aggregate across sources: total request patterns, not per-IP counts.
• Audit your suppliers like they are you. In October's wave, one compromised contractor or platform repeatedly meant dozens of downstream victims. Your vendor's web security is your web security.
• Use the same class of tool, defensively, first. Continuous automated pentesting of your own systems — the legitimate twin of ARTEX — is how defenders close the speed gap. The agent that finds your flaw in a scheduled test is cheaper than the one that finds it in September.

None of this requires believing the largest version of the story. Even GMO's confirmed core — one AI tool, six servers, twenty targeted companies, eight breaches — is enough to retire the assumption that a human has to be awake for your company to be attacked.

Verdict

ARTEX is not the first AI used in attacks, and "AI hacking tool" headlines have cried wolf before. This case is different for one reason: the evidence is forensic, published by the firm hired to clean up, and carefully worded — traces on the servers, a bounded target set, no actor named, findings handed to law enforcement. Treat the "80 companies" figure as reporting, the ~20 as documented, and the Korea chapter as the warning that the tool had a career before Japan noticed it.

The deeper point stands regardless of how the attribution eventually lands. The agent era's bargain — software that plans, persists and acts on its own — was never going to be available only to people who ask permission. Duet asks. ARTEX did not. Everything the industry builds next, on both sides, starts from that sentence.

The bottom line: the question for 2027 is not whether autonomous agents will attack companies — GMO just documented that they already do — it is whether your defences are automated enough to notice a machine that never sleeps, probing politely, just under every threshold you set.