As Japan faces a surge in cyber attacks, including large-scale personal data breaches, evidence has emerged that the Chinese AI penetration testing tool 'ARTEX' has also targeted around 80 Japanese companies. A security firm in Japan conducted a simulation using ARTEX and found that the AI could identify vulnerabilities and extract virtual user information from a website in approximately 15 seconds with minimal instructions. This has raised concerns about the need for companies to utilize AI for security assessments and defenses.
According to the Yomiuri Shimbun on October 22, S&J, a security firm responsible for the system security of thousands of companies in Japan, including major corporations, downloaded ARTEX on October 7 to test its performance on a simulated website. ARTEX is an AI agent that autonomously plans and executes tasks based on given objectives. Developed by an anonymous engineer for corporate security assessments, it was released online in July and won awards at security technology competitions held in China in August and September. The program is currently no longer publicly available.
The firm instructed ARTEX, linked with the AI 'Claude' from the U.S. company Anthropic, to diagnose vulnerabilities in the simulated site and collect personal data using about 150 characters in Japanese. After about 15 seconds, a message appeared on the screen stating 'Collection complete.' In fact, personal information from registered virtual users was collected. Despite the simulated site having standard security measures, ARTEX quickly identified small vulnerabilities. Nobuo Miwa, president of S&J and a former advisor to the Ministry of Internal Affairs and Communications, stated, 'What would take a human days to accomplish can be completed in seconds or minutes. AI agents can be used in various cyber attacks.'
Evidence of ARTEX's use has also been confirmed in attacks targeting Japanese companies. According to the Nihon Keizai Shimbun (Nikkei), another Japanese security firm, GMO Cybersecurity, found traces of ARTEX running on all six servers used by attackers during their investigation. The targets were primarily Japanese IP addresses, with around 80 Japanese companies identified as victims. GMO noted that the discovered servers represent only the tip of the iceberg, suggesting there may be more attack servers and targeted companies.
Attackers managed their targets by categorizing them by industry on each server. According to Nikkei, the targeted sectors included 'digital gift cards and retail,' 'insurance and finance,' and 'e-commerce.' Daiki Fukumori, director of the GMO Cybercrime Countermeasures Center, speculated that the attackers likely designated industries for the AI to prevent an excessive increase in targets. The type of information sought varies by industry, such as credit card details or IDs and passwords, making it easier to monetize stolen data when categorized.
On October 20, Chief Cabinet Secretary Minoru Kiuchi stated at a press conference that the government is analyzing the potential misuse of AI in the ongoing cyber attacks against Japanese companies. He emphasized the need to investigate all possibilities, including foreign involvement, to identify the perpetrators and the origins of the attacks.
Nikkei reported that ARTEX operates by combining multiple AI models from the U.S. and China, rather than relying on a single model. Fukumori noted that after analyzing the systems of affected companies, he observed that ARTEX behaves flexibly based on the situation after intrusion, which distinguishes it from traditional programs that operate according to fixed rules.
According to an analysis by the American security firm Zscaler, traces of models such as China's DeepSeek and Zhipu AI, as well as the U.S. conversational AI 'Grok,' were found to have been used through ARTEX in attacks targeting South Korean financial institutions. Yomiuri reported that ARTEX appeared to query these AIs during its process of finding attack methods.
Concerns have also been raised that ARTEX may have circumvented safeguards designed to prevent the misuse of AI. Yomiuri noted that major AIs typically have 'guardrail' features that reject requests that could be used for criminal purposes. However, Miwa assessed that ARTEX's own guardrails were 'merely formal' and could be easily bypassed. He also analyzed that ARTEX might have obtained information for attacks by querying Claude in a way that evaded its safety mechanisms.
Nikkei reported that ARTEX's terms of use limited its application to personal learning, research, and technology verification. After the misuse became apparent, the developer stated on October 8 that the purpose was to enhance the defensive capabilities of companies and organizations, asserting that any misuse was against their intentions and transitioning the program to private status.
However, simply halting public access does not eliminate the threat. Zscaler warned that copies downloaded before the transition to private status could still be in use. Yomiuri reported that modified versions of ARTEX, which enhance its attack capabilities, are also circulating on the internet. Fukumori pointed out that some attackers could develop such AI programs independently, making complete regulation challenging.
Meanwhile, there have been successful cases of utilizing AI in cybersecurity. According to Yomiuri, a Japanese security firm, with the permission of a client, used ARTEX to assess the actual website of that company, discovering several vulnerabilities that had not been identified in previous inspections by Japanese IT firms. Miwa emphasized the need for companies to thoroughly investigate their systems' vulnerabilities using AI and to strengthen security measures, including closely monitoring databases containing personal information.
* This article has been translated by AI.
Copyright ⓒ Aju Press All rights reserved.