Around 80 Japanese companies were targeted in hacks launched from overseas servers carrying digital traces of Artex, an AI agent developed in China, according to the Wall Street Journal.
GMO Cybersecurity by Ierae investigated the attacks at victims' request and examined a window running from 18 September to 18 October.
It identified six overseas public servers used against Japanese organizations, and found traces of Artex running on all six, with no evidence of any other AI agent present.
The firms targeted were concentrated in insurance, finance and logistics, and eight were confirmed to have suffered data leaks.
Artex is described as a Chinese-language autonomous penetration-testing tool that, connected to a large language model, can analyze targets, devise intrusion routes and operate security tools, automating work traditionally done by human attackers.
Investigators assessed the tool was likely used, though they caution the attribution is not conclusive since the evidence points to the infrastructure rather than the people or organization behind it.
The tool had reportedly also surfaced in a recent string of attacks on South Korean financial institutions, pointing to activity beyond Japan alone.
It was reportedly released publicly by a Chinese-speaking developer in July 2026, giving attackers a relatively short runway to obtain and adapt it.
The case lands amid a broader wave of Chinese AI agent development spanning general-purpose, enterprise and consumer tools, with platforms such as ByteDance's Doubao and Alibaba's Qwen already embedded in apps used by hundreds of millions of people monthly.
Read more about Cybersecurity
