Chinese AI Agent Weaponized Against 80 Japanese Firms
A Chinese-language AI tool called ARTEX appears to have been deployed against roughly 80 Japanese companies in a coordinated campaign of cyberattacks. The case exposes a new frontier in how autonomous agents can be turned into weapons — and how lightly regulated AI release cycles create vulnerabilities that span borders.
The Tool That Turned on Its Creators
In July, a team of Chinese-speaking developers uploaded a system called ARTEX to an online technical-sharing platform. The pitch was straightforward: a sophisticated AI agent capable of autonomously scanning networks for software vulnerabilities, written to help organizations harden their defenses. It was meant to be a diagnostic tool — useful, harmless, open-source.
By September, ARTEX was being used to breach the systems of roughly 80 Japanese companies. Eight firms have publicly acknowledged data leaks. Two of the most prominent — an insurance provider and a logistics firm — became the first to confirm their systems had been compromised.
The transformation from penetration-testing assistant to offensive weapon happened faster than most security teams anticipated. And it may not have been the intention of ARTEX’s original developers at all.
What the Investigation Found
GMO Cybersecurity by YellAE, a Tokyo-based firm that took on the case at the request of several victim companies, identified six overseas public servers used in the attacks between September 18 and October 18. All six showed the unmistakable footprint of ARTEX running on them. No other AI agent was found. That uniformity is significant — it suggests a single operator or a coordinated group choosing one weapon and sticking with it.
CloudStrike, the American security giant, independently confirmed that ARTEX appeared in a string of attacks on multiple South Korean financial institutions during the same period. The same tool, the same window, different targets. The implication is that Japan was not an isolated case but part of a broader regional campaign.
JP-CERT, Japan’s national computer emergency response team, also reported detecting traces of AI agents in cyberattacks against Japanese firms starting in August — roughly two months before the ARTEX-specific servers were identified. That earlier activity may represent either a precursor phase or a separate tool still under investigation.
Why ARTEX Is Different
Traditional malware operates on a set script: exploit this known vulnerability, move to this directory, exfiltrate that data. It is powerful when the target matches its assumptions and useless when it encounters something unfamiliar.
ARTEX works differently. As an AI agent, it was designed to explore systematically, reason through unfamiliar environments, and adapt its approach as it learns. It does not simply search for one vulnerability — it surveys an entire attack surface and identifies the weakest point. That is precisely the capability that makes it valuable for defensive security assessments. It is also what makes it dangerous in the wrong hands.
The developers’ claim that ARTEX was built to help organizations improve their security may be genuine. But the same architecture that lets it find a security team’s blind spots lets an attacker find the organization’s. There is no reliable switch to flip between the two modes once the code is in the wild.
Who Controls ARTEX Now
The developer who published ARTEX announced on October 8 that he had removed it from public access after learning it was being used offensively. This is a familiar pattern in the open-source security world — code goes public, someone weaponizes it, the author pulls it down. It rarely closes the gap. Copies exist. Forks multiply. The knowledge of how to use ARTEX has already spread among operators who do not need the original repository to benefit from it.
The six servers identified by GMO were likely controlled by the attacker, not the developer. The removal of ARTEX from the original platform does not explain why six servers were still actively running it weeks later. Either other actors acquired the tool before it was pulled, or the developer had already lost control of the distribution chain.
What Gets Lost in These Attacks
The eight companies that have publicly disclosed breaches represent the tip of the iceberg. In Japan’s corporate culture, disclosure is often voluntary and delayed. Firms face intense pressure to avoid reputational damage, regulatory scrutiny, or stock-price impacts from admitting a breach. Many victims may never come forward at all, leaving the true scale of the campaign unknown.
What is leaked matters as much as how much. For financial institutions, it could be account details and transaction records. For logistics companies, supply-chain data and customer information. For insurers, policyholder records and claims history. Each category carries different regulatory obligations and different consequences for affected individuals.
The Real Vulnerability
GMO’s Takahi Fukamori put it plainly: the affected companies were hit through small, overlooked weaknesses in their systems. These are not novel zero-day exploits that require millions in research and development. They are the same configuration gaps, outdated patches, and misconfigured services that security teams routinely discover during defensive audits.
The real story here is not that ARTEX is an unbeatable tool. It is that attackers now have AI agents capable of finding those same small gaps at scale — across dozens of targets, simultaneously, without requiring human analysts to manually probe each one.
This is the structural shift. A vulnerability scanner that runs autonomously against 80 targets is qualitatively different from one that tests ten. The economics of attack have changed. The barrier to entry for campaigns that previously required specialized human operators has dropped sharply.
What Comes Next
Security teams in Japan and across Asia should treat this as an early warning, not a closed case. The six servers identified may be replaced. The technique — AI-driven systematic reconnaissance followed by exploitation of low-hanging vulnerabilities — is transferable to any tool in the open-source ecosystem. ARTEX itself was only publicly available for about three months before its removal. In that window, enough copies were made and enough knowledge was absorbed to sustain operations well beyond the takedown.
The Japanese government and its partners in the region will need to decide whether to treat AI agents in offensive cyber campaigns as a distinct threat category requiring new monitoring protocols, or whether existing frameworks can absorb the change without modification. The answer will shape how seriously the next campaign is taken — and how prepared the targeted companies are to respond.