CyberStrikeAI used 44 AI agents to automate hacking operations against Japanese targets

Trend Micro's research division TrendAI disclosed three attacks against Japanese organizations in which AI played a leading or supporting role, based on analysis of attacker-exposed server environments. The first used the open-source penetration testing tool CyberStrikeAI to automate the process from reconnaissance, vulnerability discovery and exploitation, C2, and data theft to report generation via 44 agents, and generated fake Japanese-language login pages; in October 2026, at least 19 organizations (at least 16 of them in Japan) were subjected to validation activity in a short period. The second was human-led, using large language models to accelerate planning and tool development, and targeted AI workflow platforms and inference services to obtain inference compute at low cost; one intrusion used default credentials to steal cadastral and commercial records on a GIS server, and the activity lasted 24 days from August to September 2026. In the third, AI was used only to write the operator's tools and scripts, and the attacks targeted Cisco, Citrix, F5, and Yamaha edge devices, launching at least six operations from January to October 2026.