CyberStrikeAI’s 44-Agent Platform Used in Japan-Focused Intrusions
Trend Micro has detailed three cyberattack cases targeting organizations in Japan in which artificial intelligence played roles ranging from full workflow automation to assistance with tool development. The most automated case used the open-source CyberStrikeAI penetration-testing tool, assigning work across 44 agents during activity concentrated in October 2026.
Researchers examined three exposed server environments used by the threat actors. The systems contained reconnaissance and attack tools, scripts, target lists, results, logs and command histories. They ranged from workspaces operated largely by skilled humans to AI-agent platforms that automated the workflow, including command and control.
44 agents across the attack lifecycle
In the first case, CyberStrikeAI automated reconnaissance, vulnerability discovery and validation, exploitation, command and control, persistence, data exfiltration and reporting. The platform delegated functions among 44 agents and could generate Japanese-language forms and fake login pages.
Trend Micro said at least 19 identifiable organizations, including at least 16 in Japan, were subjected to validation activity in a short period. Each organization had a report in a consistent format and an evidence index, which researchers described as outputs of a structured platform process rather than ad hoc operator notes.
The activity reflects a broader pattern in which agentic systems can turn familiar offensive steps into repeatable workflows. The context provided by OpenAI findings on agent reward hacking highlights how autonomous agent behaviour can also be directed at exposed credentials and services, rather than requiring a wholly new class of weakness.
Two further cases show different AI roles
The second incident was human-led, with a large language model used to speed planning and tool development. Its infrastructure and artifacts indicated an interest in AI workflow platforms and inference services, apparently to obtain substantial inference capacity at low cost. One intrusion targeted a geographic information system server exposed with default credentials, leading to theft of cadastral and commercial records, Windows credentials and email data during a 24-day campaign in August and September 2026.
In the third case, AI was limited to developing tools and scripts. The operator targeted Cisco, Citrix, F5 and Yamaha edge devices through published vulnerabilities, management functions or credentials found in configuration files. Researchers estimate at least six campaigns between January and October 2026, including opportunistic activity against exposed VPN devices and WebLogic servers.
Exposure management remains central
Trend Micro found no evidence that the three cases shared an operator, and the AI models involved are unknown. The first operator also targeted Taiwan and Hong Kong, while the third case included organizations in the United Kingdom, France, Italy, Qatar and Colombia in WebLogic discovery lists.
For businesses, the practical implication is unchanged but more urgent: identify internet-exposed systems, remove default credentials, apply available fixes and review configuration files for secrets. AI may let attackers test more targets and adapt language at scale, but the reported operations still relied on exposed services and known weaknesses.