Masatoshi Kumagai, chairman and chief executive of GMO Internet Group, in an official company portrait. Image: GMO Internet Group (press release via PR TIMES)
The head of one of Japan’s biggest internet companies says AI has pushed the internet to breaking point. In a blog post on Sunday, Masatoshi Kumagai, chairman and chief executive of GMO Internet Group, wrote that “the internet itself is on the verge of breaking”, blamed the “explosive evolution and misuse” of AI, and urged Tokyo to turn its new active cyber defence powers on the people who attacked his company last week.
That attack hit Onamae.com Desktop Cloud, a GMO service that rents Windows servers to forex traders who run automated trading bots on MetaTrader. GMO says up to 26,739 servers may be affected, that customer information was taken, and that some customers found trades in their brokerage accounts that they never made. It began shutting every server at 4am Japan time on October 21 (19:00 UTC on October 20).
An “AI cyber saturation attack”
Kumagai, who founded GMO 31 years ago, says open-weight AI models have been stitched together into countless attack tools, so hacking that once took real skill is now open to anyone. As proof he points to ARTEX, an autonomous penetration-testing tool built for defenders, which GMO Cybersecurity by Ierae found running on the servers behind attacks on about 20 Japanese companies.
The same tool has been tied to break-ins at four South Korean banks and, by Microsoft, to a China-linked group that got into company clouds in under three hours. He also cites this month’s critical PHP flaws, which he says AI exploited within hours. As he put it:
We have already entered an era where, with only simple instructions, AI searches for weaknesses and drives itself all the way to a break-in.
Masatoshi Kumagai, GMO Internet Group, on his blog (translated from Japanese)
The result, he wrote, is an “AI cyber saturation attack”, in which countless AI-made attacks overwhelm defenders, and the raid on GMO is “the very symbol” of it.
What GMO hasn’t said
Neither Kumagai’s post nor GMO’s fourth incident report, published on Saturday, says AI was used in the attack on Desktop Cloud. ARTEX was found in attacks on other companies, not on GMO.
Kumagai also admits GMO had been warned. Its in-house white-hat hackers had flagged problems with the service, he wrote, but the team running it moved too slowly, “and attackers exploited that gap”. The attacker claims on a website of their own to have used weak settings, including one administrator account shared by every server, which GMO has not confirmed, ITmedia reports.
The attackers have demanded $50 million (about ¥8 billion), Kumagai said in a note added on Monday, and threatened more rogue trades on customer accounts at over 70 brokers, data leaks and ransomware. GMO says it will not pay. It will give every current customer ¥5,000 (about $30) and cover confirmed losses from unauthorised trades, even where a broker refuses a refund. GMO Internet Group shares fell sharply on Monday, Reuters reported.
“Not shifting our responsibility to the state”
On Saturday GMO asked the government to treat the case as the “first activation” of active cyber defence, which lets police and Japan’s Self-Defense Forces trace and neutralise attackers’ servers before damage spreads. The law took effect on October 1.
Critics were quick to point out that GMO is not one of the critical infrastructure operators the law is built around, and that the government, not a company, decides when to use it. Kumagai says he understands both points, and asks ministers to judge by the real effect on people’s lives rather than formal categories:
We are by no means shifting our own responsibility onto the state or pleading for a rescue.
Masatoshi Kumagai, on his blog (translated from Japanese)
Many users on X say he is recasting GMO’s own failures as a national problem, ITmedia reports. Kumagai says GMO will bear every cost itself and has 200 security staff on the case, using AI tools of its own to sift the evidence.
Tokyo steps in
On Monday Prime Minister Sanae Takaichi held the government’s first cabinet-level meeting on the wave of attacks and said that, once an attack is understood, Japan would “strategically choose and carry out every response option”, including neutralising attackers’ servers, the Yomiuri Shimbun reports. She ordered an emergency package of measures as soon as next week. Chief Cabinet Secretary Minoru Kihara has said any decision will rest on the law’s requirements, whatever GMO asks.
Why it matters
Kumagai runs one of Japan’s largest internet infrastructure groups, and his warning about cheap, self-driving AI attacks matches what security firms have found with ARTEX in Japan and Korea. But his own company’s breach followed warnings it did not act on in time, and nothing published so far shows AI was behind it.
Sources: Masatoshi Kumagai’s blog (October 25, updated October 26); GMO Internet, fourth report on the Desktop Cloud attack (October 24); ITmedia NEWS; Yomiuri Shimbun; Reuters via Newsweek Japan.
Latest Policy & Safety news
