AI Hackers Go Regional: ARTEX in Japan, and Can AI Plan an Attack on a Factory?

An open-source AI pentesting tool shows up behind attacks on Japanese companies, and a new study measures how well AI can plan attacks on industrial systems. Here's what both mean for defenders.

Penetration-testing tools have always had a split personality. The same scanner that helps your red team find a weak server on Monday helps a criminal find it on Tuesday. That's been true since the first port scanner, and the industry made peace with it long ago.

What's new in 2026 is that the tools have started to think. AI-powered pentesting frameworks don't just run a checklist. They plan, try things, read the results and try something else, with a language model making the decisions. And this month, one of them has moved firmly from security labs into real attack campaigns: first against banks in South Korea, and now against companies in Japan.

At the same time, a new research report asked a scarier question: how good is AI at planning attacks on the systems that run factories, power and water? The answer is more nuanced than either the optimists or the doomsayers would like. Let's look at both stories, what's confirmed, what isn't, and what to do about it.

Story one: ARTEX turns up in attacks on Japanese companies

Japan has had a rough autumn. September and October brought a wave of breach disclosures, from e-commerce and gift-card platforms to insurers and media services. On October 19, the Tokyo-based firm GMO Cybersecurity by Ierae published findings suggesting at least part of that wave had a common thread: an AI-powered penetration-testing tool called ARTEX, running on attacker infrastructure. ITmedia covered it the next day, and international outlets followed.

Here's what the investigators found, working with outside partners:

• One attack server targeted about 20 Japanese companies, and almost exclusively Japanese ones, as far as GMO could observe. Nine of those companies were in the same industry.
• Six more AI-enabled attack servers were focused mainly on Japanese organizations, each with its own industry focus: digital gifts and retail, education and printing, loyalty points and marketing, insurance and finance, e-commerce with media and logistics, and pure e-commerce.
• Eight of the targeted companies had publicly disclosed data breaches in September and October. GMO concluded that the same group was behind multiple incidents and shared its findings with law enforcement.

The pattern is what stands out. GMO's reading, informed by the earlier Korean case, is that the attackers run campaigns narrowed by country and industry, and set up separate attack hosts for each campaign. That's not spray-and-pray. It's an organized operation using AI to scale a very targeted playbook.

Now the important caveats. GMO hasn't said which AI models were used in the Japanese attacks. And the eight breach disclosures don't prove ARTEX caused every one of them. Being on a target list isn't the same as being breached by that tool, and as The Epoch Times notes, none of those companies has publicly linked its breach to ARTEX. What's confirmed is AI tooling on attacker infrastructure aimed at Japanese organizations. The full chain from tool to each compromise is still incomplete.

GMO's earlier October 15 blog post adds some useful color on technique: attackers using AI to find flaws in software versions that public vulnerability advisories don't even list, and rotating through hundreds of IP addresses to slip past blocklists. Daiki Fukumori, who heads GMO's cybercrime center, also made a point I think is important. In his view, the problem isn't just that AI lets anyone attack.

Skilled attackers are studying the mismatch between how they attack and how defenders defend, and using AI to exploit that gap at scale.

What ARTEX is, and what we learned from South Korea

ARTEX is an open-source penetration-testing automation framework developed in China. Its intended purpose is legitimate: connect a large language model to a pentesting workflow so it can automate reconnaissance, check for known vulnerabilities and attempt exploitation, the way a red team would during an authorized engagement. The problem is that "authorized" lives in a contract, not in the code.

Most of what we know about how attackers actually use it comes from an earlier case. On October 7, CrowdStrike published an investigation into a campaign against South Korean financial institutions in late September and early October. South Korean authorities confirmed intrusions at seven institutions, and the country's financial regulator put the number of affected people at more than 68,000.

CrowdStrike got unusually deep visibility for one reason: the attacker left directories open on their own servers. Inside were ARTEX configuration files, Claude Code session histories and Claude memory files. From those, the researchers reconstructed a two-server setup: a Hong Kong-based machine as the main operating base, and a separate server running the ARTEX instance that likely carried out the attacks.

The model lineup is interesting in itself. ARTEX ran primarily on DeepSeek v4.1-flash, likely accessed through a third-party API reseller. The attacker also used Claude Code as a working environment, with some of those sessions running on Zhipu AI's GLM-5.3 and xAI's Grok 4.6. In other words, the agent harness and the model behind it were mixed and matched. If one provider got in the way, the operator could swap in another.

The session logs also made the operation surprisingly human. According to CrowdStrike, the attacker asked Claude where stolen Korean data is typically sold, and how to find Korean Telegram groups for data sales. And in what may be the most self-defeating prompt of the year, The Register reports that the logs included a request to help write a résumé, with personal details that may help identify the attacker. CrowdStrike assessed, with moderate confidence, that the operator is likely Chinese-speaking and financially motivated.

A few honest observations from all this. First, the attacker was a person, and AI was the force multiplier. Somebody chose the targets, configured the tools, ran the servers and looked for buyers. Second, a mainstream coding agent, Anthropic's Claude Code, was part of this attacker's toolkit, sometimes running on other companies' models. Vendors have safeguards meant to catch misuse like this, but the case shows that no single vendor's guardrails can stop an operator who simply routes around them with another model. Third, this pattern isn't unique. It looks a lot like the Cairn campaign Reuters described this month, where one operator combined Claude Code, DeepSeek and an open-source agent platform to break into more than 100 companies' websites. Different tools, same playbook: an off-the-shelf agent framework, a mix of models, and a human steering at a high level.

Story two: can AI plan an attack on a factory?

Operational technology, or OT, is the world of industrial control systems: the PLCs, HMIs and networks that run factories, power plants, pipelines and water treatment. Attacks there aren't about stolen records. They're about physical processes, and the consequences can be physical too. So when people worry about AI-powered attacks, OT is where the worry gets serious.

On October 21, OT security company Frenos published its first State of AI in OT Security report, which tries to measure the risk instead of guessing at it. The researchers put ten AI models through the same industrial attack-planning challenges: six US frontier models, two US open-weight models and two foreign open-weight models, all anonymized. Across 16,980 tests, they analyzed 13,884 individual decisions, 2,520 planning attempts and 576 simulated attack runs.

The setup is worth understanding, because it shapes what the results mean. Each model received facts about a target environment, its starting access, the actions available and the goal. It then had to produce a sequence of steps, which was checked to see whether the steps actually fit together, and some plans were run in a simple simulator.

The headline result: the three strongest frontier models built valid attack paths roughly 90% of the time, and each found a working plan for every one of the 35 paths at least once. After that, the drop is steep. The best foreign open-weight model passed about 36% of its attempts, the best US open-weight model about 5%, and some frontier models landed well below 40%.

There's also a subtle point in the data that I find useful: coverage is not consistency. One foreign open-weight model managed at least one valid plan for 77% of the paths, but only about 36% of its attempts passed. If an attacker can retry many times, coverage is what matters. If a defender is using AI for analysis, consistency is what matters. The same model can look dangerous or unreliable depending on which number you read.

And the failure modes are very familiar to anyone who has reviewed AI-generated code. Models sometimes skipped a step a plan needed, or assumed they had access that no earlier step had actually provided. As Frenos points out, a knowledgeable human reviewer could catch those mistakes, which also means an unsupervised model would leave them in.

Frenos is explicit about the limits, and they matter. The models were handed the facts and the menu of possible actions. They didn't discover the target, map the network or deal with real equipment.

So the study doesn't show that AI can find and carry out an OT attack on its own. It shows that, given good information, the best models are now very capable planners.

One more fair caveat: Frenos sells simulated OT penetration testing, so it's a vendor study. It's also unusually transparent about its scope, and the full methodology is in the downloadable report.

Reading the two stories together

At first glance these are different worlds: criminals breaking into gift-card platforms on one side, a lab study about power plants on the other. But put them next to each other and a clear picture emerges.

The bottleneck is moving from planning to access. In the Frenos study, the best models were already excellent planners once someone handed them the map: the assets, the connections, the vulnerabilities. What they weren't asked to do was build that map. ARTEX is exactly a tool for building the map: automated reconnaissance and vulnerability discovery against real, internet-facing systems. Today, those two capabilities live in different places, and OT networks are much harder to map from the outside than an e-commerce site. But the direction is obvious, and defenders should plan for it rather than wait to see it.

AI changes the economics of who gets targeted. Look at the Japanese target list again: digital gifts, loyalty points, printing, e-commerce, education. These aren't the household names that sophisticated attackers used to focus on. When an AI agent does most of the grinding, a campaign against nine mid-size companies in one niche industry suddenly pays off. If you've been thinking "we're too small to be interesting," this month is a good time to drop that assumption.

The humans are still in charge, on both sides. The Korean logs show a person choosing targets, configuring tools and shopping for buyers. The Frenos results show that even the best models make mistakes a human expert would catch. AI is a force multiplier, not a replacement, for attackers and defenders alike. The side that pairs good people with good tooling wins.

We've been lucky with attacker sloppiness. In the Korean case, the attacker left directories open. In the Cairn case Reuters described, the control panels were exposed. That's how we got such detailed pictures of AI-driven campaigns. It won't last. As these tools mature, attackers will lock down their own infrastructure, and the next investigations will have much less to work with.

And Fukumori's point about "mismatch" deserves the last word here.

Attackers aren't winning just because AI makes them faster. They're winning where defenses are designed for yesterday's attacks: blocklists that assume a handful of IPs, patch processes that assume a published advisory, monitoring that assumes a human pace. AI finds those gaps faster than we close them.

A year ago, "AI-powered attacks" mostly meant better phishing emails. This month we have an open-source AI pentesting tool linked to campaigns in two countries, against carefully chosen industries, and a study showing the best models can plan most industrial attack paths when someone hands them the map. Neither story is apocalyptic. Both are a clear signal that the gap between "possible in a lab" and "used in the wild" is closing fast.

The good news is that the defenses still work. Know what you expose, patch faster, detect behavior rather than addresses, keep your maps private, and keep skilled humans in the loop. The bad news is that "eventually" is no longer an acceptable timeline for any of it.

I'd love to hear from you. Has your team seen signs of AI-driven scanning or attacks in your logs? If you work in OT, does the Frenos result match your gut feeling, or does it feel overstated? And would you run an AI pentesting tool against your own systems? Tell me in the comments. I read every one.

If you enjoyed this article, feel free to give it some claps 👏 — it helps more people discover this content. To stay updated with my latest posts, hit the Follow button! You can also consider subscribing to get notified about new articles.