CyberStrikeAI and Other AI Agents Automate Hacking Operations Against Japanese Targets
Researchers have uncovered three sophisticated cyberattacks against Japanese organizations that leveraged AI agents, with one operation fully automating hacking tasks using up to 44 agents.
Cybersecurity researchers have detailed three distinct cyberattacks targeting organizations in Japan, where artificial intelligence (AI) played a pivotal role, either as the primary operator or as a crucial assistant to human attackers. The analysis, conducted by TrendAI, focused on three exposed server environments used by threat actors, revealing a significant leap in AI-driven cyber warfare capabilities.
These environments contained a comprehensive suite of tools, including reconnaissance and attack scripts, target lists, operational results, logs, and command histories. The researchers noted a spectrum of AI integration, ranging from workspaces heavily managed by skilled human operators to fully autonomous AI-agent platforms that managed the entire attack workflow, including command and control (C2).
The first identified attack utilized CyberStrikeAI, an open-source penetration testing tool, to automate various stages of the attack lifecycle. This included reconnaissance, vulnerability discovery and validation, exploitation, C2, persistence, data exfiltration, and automated reporting. The operation delegated tasks among 44 distinct AI agents, enabling the generation of Japanese-language fake login pages and forms, and targeted at least 19 organizations, with 16 in Japan, within a short October 2026 timeframe.
The second attack was characterized as human-led but significantly accelerated by a large language model (LLM) for planning and tool development. This campaign specifically targeted AI workflow platforms and inference services to acquire substantial inference capacity at a low cost. One notable intrusion involved the theft of cadastral and commercial records, Windows credentials, and email data from a GIS server exposed with default credentials over a 24-day period in August and September 2026.
The third instance saw AI confined to assisting the operator in developing tools and scripts. This campaign focused on exploiting edge devices from vendors like Cisco, Citrix, F5, and Yamaha using known vulnerabilities, management functions, or exposed credentials. The threat actor behind this operation is estimated to have conducted at least six campaigns between January and October 2026, opportunistically targeting exposed VPN devices and WebLogic servers.
While there is no current evidence linking these three incidents to a single operator, the scope of these attacks extends beyond Japan and South Korea. The actor behind the first attack also targeted organizations in Taiwan and Hong Kong, and the third case's discovery lists included entities in the UK, France, Italy, Qatar, and Colombia. TrendAI emphasized that AI has amplified attackers' capacity, allowing them to test thousands of targets simultaneously, adapt to local languages, and operate without fatigue, though the fundamental weaknesses exploited remain the same.
This development aligns with a broader trend of threat actors integrating agentic AI into their offensive security workflows to expedite research, malware development, social engineering, and other attack phases. Microsoft's 2026 Digital Defense Report indicates that AI has reduced the median time from vulnerability discovery to weaponization to well under 24 hours, lowering the expertise, time, and cost required for attackers to exploit vulnerabilities.
The growing demand for AI tools by malicious actors has also spurred a new monetization avenue through the sale of stolen AI provider session tokens and offensive AI tools, further commoditizing cybercrime and lowering the barrier to entry for advanced, persistent, and evasive attacks. AI is no longer an experimental capability but an operational component embedded directly into campaigns.