AI Agent UpdateThe AI hacking tool that hit Korean banks just surfaced in Japan
ARTEX, a Chinese-built AI pentesting tool, has been found in attacks on roughly 80 Japanese firms weeks after CrowdStrike linked it to breaches at nine Korean banks. Meanwhile one operator allegedly breached 100+ companies using autonomous agents at ~$50 in tokens per breach. Offense just got radically cheaper — defense is the trade.
The News
GMO Cybersecurity by Ierae found traces of ARTEX — a Chinese-built AI penetration-testing tool — on all six overseas attack servers it examined over Sept 18 to Oct 18. Roughly 80 Japanese firms across insurance, finance and logistics were identified as targets, and 8 have already disclosed data breaches.
This is the same tool CrowdStrike linked to late-September breaches at nine Korean banks that exposed about 68,000 records — roughly 25,000 at Shinhan and 40,000 at Yegaram. A pentesting tool built to find vulnerabilities for defenders is now a repeat weapon against the financial sector across two countries.
Separately, Reuters reported Oct 19 that a Chinese-speaking hacker delegated nearly all attack work to autonomous AI agents, breaching more than 100 companies — including Deere, SharkNinja and Cummins — after attempting over 1,200 sites, at a cost of roughly $50 in AI tokens per breach.
The defense side is capitalizing in response: Blackwall raised a $100M Series C at a $2.2 billion valuation — 4x since 2025 — for AI-agent traffic filtering, confirming AI-agent security as its own funding category.
When a breach costs $50 in tokens, every company is in scope — and security stops being an IT budget and becomes a survival budget.
Why It Matters
The economics of attack have collapsed. When a breach attempt costs $50 in tokens and agents do the labor, every mid-size company becomes worth attacking — the target list stops being the Fortune 500 and starts being everyone with a login page. That expands the addressable market for platform security — $CRWD and $PANW — from enterprises to the entire economy.
ARTEX makes the point concretely for boards: a dual-use AI tool moved from Korean banks to Japanese insurers in under a month. Defense budgets follow incidents, and incidents are now arriving at AI speed — expect the AI-agent security category Blackwall just raised into to become a standard line item in 2027 budgets.
Analyst's Take
The number that should rearrange security budgets is $50. For the price of a team lunch, an operator rented enough machine labor to break into a hundred companies. Defense has spent decades pricing attacker scarcity — skilled humans are expensive and rare. Agentic offense deletes that scarcity, and every control designed around 'an attacker wouldn't bother' is now mispriced.
What the market is missing: the same agent stack creating this risk is also the defense's best tool, and the platforms with the deepest endpoint and identity telemetry — CrowdStrike and Palo Alto Networks — are structurally positioned to sell it. The bullish case isn't fear; it's that attack volume is now an AI scaling curve, and security spend has to scale to match or concede. Watch for the first earnings calls where 'AI-driven attack volume' shows up as a demand driver by name.
By The Numbers
FAQ
What is ARTEX?
A Chinese-built AI penetration-testing tool — software designed to probe systems for vulnerabilities. Traces of it were found on all six overseas attack servers GMO Cybersecurity examined, and CrowdStrike previously linked it to breaches at nine Korean banks.
What happened in Japan and Korea?
In Japan, ~80 firms in insurance, finance and logistics were targeted, with 8 data breaches disclosed so far. In Korea, late-September breaches at nine banks exposed ~68,000 records, including ~25,000 at Shinhan and ~40,000 at Yegaram.
How cheap has AI hacking become?
Reuters reported one actor delegated nearly all attack work to autonomous AI agents, breaching 100+ companies (including Deere, SharkNinja and Cummins) after attempting 1,200+ sites — at roughly $50 in AI tokens per breach.
Why is this bullish for CRWD and PANW?
Collapsing attack costs expand the market for platform security from large enterprises to effectively every company, and the vendors with the deepest endpoint and identity data are best placed to sell AI-driven defense — CrowdStrike and Palo Alto Networks.
Source: Bloomberg via Moneyweb · Reuters