Taiwan E-commerce Provider 91APP Reports Attack by AI Autonomous Penetration System ARTEX via Third-Party Vulnerability
91APP released an investigation report confirming its Commerce Cloud database was attacked by the AI autonomous penetration testing system ARTEX, citing an unpatched vulnerability in the third-party tool Appsmith as the primary entry point.
Taiwan-based e-commerce technology service provider 91APP published its '18-Day Investigation Report on the 2026 Cyberattack Incident' on October 22, detailing how its Commerce Cloud database was subjected to automated attacks. The report revealed that the primary breach occurred due to an unpatched vulnerability in Appsmith, a third-party tool used internally, which allowed hackers to access the internal network and obtain database access keys from GitLab.
The investigation team discovered traces of the ARTEX automated attack tool within the system. ARTEX is an AI-driven autonomous penetration testing system capable of using AI to automatically find vulnerabilities, plan intrusion paths, launch attacks, and steal data. He Yingqi, Chairman of 91APP, acknowledged in an official announcement that the company failed to alert brand clients when it established an emergency response team on October 8, admitting this as an oversight and apologizing to affected brands and consumers.
91APP added that between September and October 2026, multiple banks in South Korea, approximately 20 companies in Japan, and over 100 corporate websites in the United States were targeted or locked by similar AI automated attack tools. This finding indicates that AI-based automated attack methods have emerged in cybercrime activities across multiple countries, extending beyond specific regions or industries.
Currently, one order database within Commerce Cloud has been confirmed as illegally accessed, involving order information but excluding payment instrument details such as credit cards. 91APP has removed the compromised Appsmith tool, replaced internal system tokens, database accounts, and passwords, and rebuilt GitLab permissions. The company promised full compensation for consumers who suffered financial losses due to fraud resulting from this incident. As of the report's release, the actual number of affected brands, members, and the specific scope of stolen data remain under confirmation.