TrendAI: 44 AI agents automated attacks on Japanese firms — through old, unlocked doors

Trend Micro's TrendAI researchers have reconstructed three attacker setups behind a wave of intrusions against Japanese organizations in 2026, including one where an open-source tool ran 44 AI agents to automate an attack from start to finish. The victims were mostly smaller businesses and local public bodies running old, exposed web systems. The fixes are familiar ones: find what you have on the internet, close unprotected admin pages and default passwords, and check that your own AI and GPU services are not reachable from outside.

What happened, in plain English

In autumn 2026 a string of Japanese organizations had data leaked from their web systems. Japan's National Cybersecurity Office warned businesses on October 9, according to TrendAI. On October 23, 2026 (English edition October 27), TrendAI researchers Bakuei Matsukawa and Joseph C Chen published an analysis of three attacker-controlled servers they rebuilt from files left in open directories. Each one used AI to a different degree.

• Case A: attackers used CyberStrikeAI, a free penetration-testing tool built on AI agents. (Penetration testing means attacking systems with permission to find weak spots.) It split the work across 44 agents: scanning, checking weaknesses, breaking in, keeping access, taking data and even writing a report on each victim. It also produced Japanese-language fake login pages.
• Case B: a human ran the attack and used a large language model (LLM, the technology behind chatbots) to plan it and write tools. One target type stood out: companies running AI services and GPU (graphics processor) clusters, which the researchers believe the attacker wanted for cheap AI computing power.
• Case C: AI only helped write scripts. The attacker went after VPN gateways and WebLogic application servers.

Think of it as burglars who bought a robot that tries door handles all night and writes up which ones opened. The robot is new. The unlocked doors are not. None of the cases used a new, unknown vulnerability.

Are you affected? What to do now

TrendAI does not name victims. It counts at least 19 organizations in Case A (16 or more in Japan, with others in Taiwan and Hong Kong), at least 6,000 Japanese IP addresses scanned in Case B, and at least 1,300 WebLogic candidates and 35 VPN entry points in Case C. These are lower-bound figures, and scanned addresses or candidates are not confirmed compromises; the authors say exact counts will appear in a separate report. The WebLogic target lists also included organizations in the UK, France, Italy, Qatar and Colombia.

You should care if your organization runs old web applications, internet-facing admin panels, VPN or edge devices, WebLogic, or self-hosted AI tools — in Japan or anywhere else. The techniques are not tied to one country.

Checklist, in TrendAI's priority order:

• Inventory every public-facing web system. Update legacy platforms, or isolate them behind a VPN or take them offline.
• Look for exposed admin interfaces and default credentials. Case A's entry point was an admin page that needed no login. Case B reached several hundred thousand land-registry and commercial records through a GIS (mapping) server still using its default password.
• Review VPN and edge-device configurations. Case C targeted Cisco SD-WAN, Citrix NetScaler and F5 BIG-IP through published vulnerabilities or management functions. Against Yamaha RTX1210 routers there was no product flaw at all: the attacker used credentials found in stolen configuration files. Patch, rotate any credential that lives in a config file, and stop reusing passwords between devices.
• Check whether your internal AI services are reachable from the internet — inference servers, AI workflow platforms, GPU clusters. Ask suppliers who host them for you the same question.
• Tune monitoring for "low and slow" attempts. The Case A tool throttled its traffic per target to stay under alert thresholds. Look at failed logins and admin-page hits across many hosts over days, not only bursts.
• Brief staff who use LLMs at work. The Case B attacker got around the model's safeguards by claiming to run an authorized security assessment. Requests built on false premises are a social-engineering pattern worth naming in awareness training.
• Shorten patch cycles and consider virtual patching (blocking an exploit at the firewall or WAF before the real patch is applied), since TrendAI expects the gap between disclosure and exploitation to narrow.

Indicators of compromise: TrendAI is withholding them "to avoid interfering with investigations", and says it will share findings with law enforcement and notify potentially affected organizations. As of November 5, 2026, no official IOC list has been published.

If your external inventory is current, admin pages require authentication, and no default passwords remain, there is little new to do.

The expert view

The useful contribution here is not "attackers use AI" — that is well established — but a careful separation of how much AI was involved and how sure the researchers are. TrendAI rates Case A and Case B as confirmed and Case C as high confidence based only on style: section-headed command sequences and tidy, emoji-marked script comments. The authors say plainly that these "remain stylistic signatures" a skilled human could reproduce. That is the right level of humility, and it is a model other threat-intel writing could follow.

Case A is the part that is genuinely new. TrendAI calls it the first detailed account of an AI agent platform automating an entire intrusion workflow in observed attacks. The operator's console was in Simplified Chinese, and each victim had a standardized report with an evidence index — TrendAI calls these "outputs of a structured process run by the platform." Yet the platform's own logs recorded "no session, no web shell, no exfiltration" for many targets, and deep compromise was limited to a very small share, with one clear intrusion chain. The authors' warning applies to every headline about AI hacking: "An attempted attack must be distinguished from a compromise." They also note that AI self-assessments of success can be over-optimistic, which is one reason honeypots and decoys are useful — an agent that reports a hit on a decoy is giving itself away.

Case B shows AI infrastructure becoming a target in its own right. Where the attacker got in, it was thorough: at one company it built a full control chain across FTP, a database, administrator rights, a web shell and SSH, and kept restoring backdoors after cleanup. Several hundred attempts against one AI/GPU cluster all failed. This matches the broader "LLMjacking" trend, where stolen compute or API access is the prize rather than data.

TrendAI's summary is the line to keep: AI "changed parts of the attack process while leaving its fundamentals unchanged." What changed was the number of parallel targets, speed, language adaptation and automated record-keeping. What did not change was the vulnerability types, the entry points and the share of targets deeply compromised. The researchers found "no evidence in our three infrastructures that attackers exploited an AI-discovered zero-day." In short, as they put it, "AI changes the scale of attacks without changing the priorities for defense."

This fits a pattern seen in October 2026: the ARTEX agent used against Korean banks, reported by CrowdStrike (our coverage), and Microsoft's reporting on Storm-0940. TrendAI says most of the activity it describes predates the published ARTEX reports. CyberStrikeAI itself was previously reported in a campaign against Fortinet FortiGate appliances earlier in 2026, according to The Hacker News.

Still unknown: who the operators are. TrendAI does not attribute the activity, does not know whether the three cases share an operator, and calls the Simplified Chinese interface "only a weak clue to location or affiliation" that "cannot establish either." The researchers also had no victim-side logs or disk images, so the true number of compromised organizations may differ from what the attacker-side files show.

Official sources

• TrendAI (Trend Micro), Bakuei Matsukawa and Joseph C Chen — Not Only ARTEX: The Different Levels AI Is Used in Attacks Targeting Japan (English edition October 27, 2026; Japanese original October 23, 2026)
• CrowdStrike — Unknown Threat Actor Uses AI-Driven ARTEX to Target South Korean Finance (October 7, 2026; related context)
• Coverage: The Hacker News — CyberStrikeAI Uses 44 AI Agents to Automate Hacking Operations Against Japan Targets (October 27, 2026)