The ARTEX AI Pentest Tool Is Now Tied to Attacks on Japanese Firms
GMO Cybersecurity by Ierae announced on 19 October that attack infrastructure aimed at Japanese companies ran ARTEX, the AI-driven penetration testing tool CrowdStrike tied to South Korean bank hacks earlier in October. One host targeted about 20 companies, nine in one industry, and eight targets have disclosed breaches since September. The Chinese developer made ARTEX closed-source on 9 October citing misuse, but copies were already in circulation.
On this page
What GMO found in Japan
GMO Cybersecurity by Ierae, the security arm of Japan's GMO Internet Group, announced on 19 October that it had examined attack infrastructure used against Japanese companies and found ARTEX, an AI-driven penetration testing tool. The Japanese original describes ARTEX as an "autonomous security verification system", built for security work and repurposed for attacks.
The scale is the part worth pausing on. The first infrastructure GMO examined had targeted roughly 20 companies, and "Nine of these companies belonged to the same industry." Six more AI-powered attack infrastructures turned up afterwards, most of them aimed at Japanese firms. Of the identified targets, eight publicly disclosed data breaches between September and October 2026. GMO observed that targets appear to be selected by country and industry, with separate hosts prepared for each attack, and said it shared its findings with law enforcement to prevent further damage.
The same tool, a wider campaign
This is an extension of a story this blog covered earlier in October. On 7 October, CrowdStrike Intelligence reported that an unknown threat actor used ARTEX, then a recently released open-source tool, against South Korean financial institutions, with a rapid, largely autonomous workflow built on AI agents. GMO had already flagged on 14 October that records left on Japanese victims' systems "strongly suggested AI-driven attacks"; the infrastructure investigation now corroborates that. GMO's own wording was cautious, pointing to "the possibility that similar tactics are being employed in Japan", but the tool traces on Japanese targets match the Korean pattern.
The campaign design matters as much as the tool. Separate infrastructure per attack, victims grouped by industry within a country, and six-plus additional hosts discovered after the first: this is an operator running AI-assisted intrusion as a repeatable production process, not a one-off test of a new toy.
The developer closed the source; the attacks continued
Eleven days before GMO's announcement, Reuters reported that ARTEX's Chinese developer had converted the tool from open source to closed source, citing misuse by what it called bad actors following the Korean bank hacks. Closing the repository does not retract anything: the code was public on GitHub before the Korean campaign, so every operator who cloned it still has it, and the Japanese attacks GMO documented continued after the switch.
That sequence answers the question open-source AI tooling keeps facing. Availability is not the variable that decides whether an agentic pentest tool gets abused; it only decides whether defenders can read what the tool does. A closed-source ARTEX is harder for security teams to fingerprint and no harder for criminals to run.
What this means for AI agent tooling
CuriousLM readers care about local AI that acts on the user's behalf, and ARTEX is a reminder that the same architecture serves both sides. An agent that plans, executes tools, and iterates on results is exactly what a pentest tool needs and exactly what an intrusion operator wants. Nothing about that requires a frontier model in a data center; the Korean and Japanese campaigns ran on a tool built around whatever LLM it could call.
Two practical takeaways follow. First, treat any agent framework with network reach as dual-use and log its actions, because the defensive value of "we can read exactly what the agent did" disappears the moment a project goes closed-source. Second, expect more of this: the gap between a legitimate security-verification agent and an attack agent is a system prompt and a target list, and the events of the past month show that gap being crossed in production.