A Chinese-language AI tool cracked a test website's defenses and pulled out personal information in about 15 seconds. S&J, a Tokyo security company, demonstrated the attack on a dummy site for the Yomiuri Shimbun.
Nobuo Miwa, the company's president, ran the test himself. He obtained the tool, called ARTEX, on October 7 and connected it to Claude, an AI model made by the US company Anthropic.
He then typed a Japanese prompt of about 150 characters ordering ARTEX to probe the site for vulnerabilities — weak points in its systems — and collect personal data. The site had standard security measures in place. ARTEX found a gap almost immediately.
"Work that would take a person several days gets done in seconds, in minutes," Miwa told the paper.
How the tool works
ARTEX is a vulnerability scanner written in Chinese by an anonymous engineer. It does not think for itself: it connects to an outside AI model as its "brain" and then decides how to proceed on its own. Any model can be plugged in.
The developer says ARTEX was released publicly in July so that companies and organizations could use it.
Suspected use against Japanese companies
Miwa's demonstration was confined to a dummy site. But ARTEX has already been suspected in actual attacks targeting Japanese companies, according to reports from overseas media.
Tools of this kind have made large-scale attacks easier for people without advanced skills. Researchers say Chinese hackers prefer DeepSeek, a Chinese-made model, to power such attacks: it performs comparatively well and has very loose safeguards against misuse.
Cyberattacks on Japan are rising across the board, not only those involving ARTEX. Japan recorded more cybersecurity incidents from January to September than in all of last year, according to a tally by TrendAI reported by Reuters. September alone saw 86 incidents, about 18 percent more than the previous month.