Japan's GMO Cybersecurity by Ierae has confirmed that attackers are using ARTEX, an autonomous AI system for penetration testing, in real attacks. Roughly 20 companies in Japan were targeted, and eight of them have already disclosed data leaks.
The tool was built for legitimate security audits: it finds weak spots on its own and runs the checks. Now the same automation is working for criminals, and this is no longer an experiment but a targeted campaign.
How it was uncovered
GMO specialists first went through the event logs of affected organizations, and the pattern of activity suggested an AI was doing the attacking. They then reached the attackers' infrastructure and found traces of ARTEX there.
One server held signs of attacks on about 20 Japanese companies, nine of them in the same industry. Six more servers turned up later, each focused on its own sector: online stores, finance and insurance, education platforms, logistics and digital gift services.
Not just Japan
CrowdStrike described a similar case earlier: at the end of September ARTEX was used against financial firms in South Korea. The attackers' servers held tool configurations and Claude Code logs, and the platform ran on DeepSeek with other language models plugged in.
GMO does not claim all twenty companies were breached, but it links several incidents to a single group. The findings have gone to law enforcement, and the check on whether other countries were hit is ongoing.
Our take
For site and online store owners the lesson is simple: an AI scanner never gets tired and checks everything, so outdated plugins, forgotten admin panels and exposed staging environments get found faster than before. Regular updates, locked-down service URLs and log monitoring are now the bare minimum, not overcaution. More at SecurityLab.