TrendAI: three AI-assisted attacks on Japan
On 23 October 2026 in Japanese, and on 27 October in English, TrendAI (Trend Micro) published an analysis of three attacker servers left in open directories. In case A the open-source CyberStrikeAI platform ran the whole attack chain against at least 19 organizations, at least 16 of them in Japan; in case B AI helped a human plan and write tools; in case C its role was limited to tool development.
Why it matters
Few reviews separate an 'AI attack' by how deeply the model is involved and state the confidence for each case: in A the AI runs the workflow, in B it assists a human, in C it probably only writes code. The company's conclusion: AI raised scale and speed but the doors were the same - legacy web systems, default credentials, exposed administration interfaces - and no new vulnerability was used. This is a security vendor's analysis of attacker files with no victim-side logs, so it does not establish how many attacks succeeded.
Source and limits. The article rests on files left on attacker-controlled servers in publicly accessible directories; there are no victim-side logs, disk images or network records. The material shows what the attackers prepared, attempted and recorded, and their reports contain many self-declared successes that the company does not count. Counts are lower-bound estimates. Victims are described only by count, industry, size and country. The three servers are distinct from those in TrendAI's earlier reports on ARTEX, an autonomous AI penetration-testing system. Case A (October 2026, short and concentrated). Abuse of CyberStrikeAI, 'an open-source penetration-testing tool built around AI agents', is confirmed; the exposed console is in Simplified Chinese. Reconnaissance, vulnerability discovery and validation, exploitation, command and control, persistence, exfiltration and automated reports formed a single repeatable workflow. Records such as 'credential-search agent 8/44' confirm, in the company's words, a configuration in which 44 agents shared the work. At least 19 identifiable organizations, at least 16 of them in Japan, were subjected to validation activity; deep compromise was limited to a small proportion, and for many targets the platform itself recorded 'no session, no web shell, no exfiltration'. Even the clearest chain began at an unauthenticated public administration interface of a legacy web system. The platform throttled traffic to each target to avoid detection and produced forms and fake login pages in the target's language. Case B (August-September, about 24 days). A human directs and a large language model speeds up planning and tool development. An LLM-written plan for reconnaissance and attack on AI and GPU services was found; the request was presented as an authorized assessment to circumvent guardrails (the technique is withheld). AI services were also targets: the lists include AI workflow platforms, LLM preprocessing platforms and inference services, plus tools to hijack others' AI access. At least 6,000 Japanese IP addresses were scanned; one or two companies suffered deep compromise and large-scale data theft. Conclusion: AI remained an aid; there is no evidence of autonomous execution. Case C (January-October, prolonged parallel activity). An experienced operator whose use of AI, limited to tool development, is rated 'high confidence' from stylistic indicators with no direct evidence (prompts, keys). Targets: exposed VPN devices (Cisco SD-WAN, Citrix NetScaler, F5 BIG-IP, Yamaha RTX1210) and WebLogic servers; at least 1,300 WebLogic candidates and 35 VPN entry points. Comparison. The working language of all three is Simplified Chinese (a weak clue, the company says). Japan is the most frequent target but the choice of industries is opportunistic. AI changed the number of targets handled, speed, language and automated record-keeping; it did not change the kinds of vulnerabilities, the entry points or the share of deep compromises. The company found no evidence that attackers used an AI-found zero-day; the PHP flaws found by an AI-assisted audit are called a discovery by defenders. What the record does not claim. That 44 agents attacked that many organizations: 44 is the number of agents in a configuration, while the targets confirmed number at least 19. It is not established whether the three cases share an operator, or who they are. The Japanese original was compared with the English edition only for its date and activity periods. There is no independent confirmation.