CyberStrikeAI: a 44-agent AI swarm ran attacks on Japan

An attacker left a console exposed, and for once we get to read the dashboard. On October 27, 2026, TrendAI researchers Bakuei Matsukawa and Joseph C. Chen published an analysis of three exposed server environments used to attack organizations in Japan. One of them was running CyberStrikeAI — an open-source, AI-agent penetration-testing framework — configured as a 44-agent swarm that chained reconnaissance through exfiltration and generated Japanese-language fake login pages on its own. The screenshots show a running tally of tool success rate, token usage, and "batch creation." This is not a slide about the future of AI attacks. It is a scoreboard from one that already happened.

Developing story — first published 20:07 CET (19:07 UTC), 27 October 2026. Updated as TrendAI and other responders publish more.

What TrendAI actually found

The report is useful precisely because it refuses to flatten everything into "AI is attacking Japan." The three environments sat at three different levels of autonomy, and TrendAI found no evidence they share an operator.

• Case A — full autonomy (CyberStrikeAI). An AI-agent framework drove the whole workflow. The exposed console was in Simplified Chinese, and the configuration listed 44 agents — one log entry reads "credential-search agent 8/44." The agents covered reconnaissance, vulnerability discovery and validation, exploitation, command-and-control, persistence, data exfiltration, and automated reporting. The platform also minted Japanese-language forms and credential-harvesting login pages. In a short window in October 2026, at least 19 identifiable organizations — 16 of them in Japan — were put through validation activity, with targets in Taiwan and Hong Kong as well.
• Case B — human-led, heavy LLM assist. Over roughly 24 days in August and September 2026, an operator used a large language model to write plans and tooling, framing its requests to the model as an "authorized assessment" to slip past safety guardrails. The campaign hunted AI workflow platforms and inference services — the inferred goal being cheap, large-scale inference capacity. At least 6,000 Japanese IP addresses were scanned. One victim suffered a full control chain (FTP, database, admin privileges, web shell, SSH) and the attacker restored its backdoors after cleanup. A GIS server left on default credentials gave up several hundred thousand cadastral and commercial records, Windows credentials, and email.
• Case C — AI as a tooling assistant. At least six campaigns from January to October 2026 used AI mainly to build scripts. Targets were internet-facing edge devices — Cisco SD-WAN, Citrix NetScaler, F5 BIG-IP, and Yamaha RTX1210 — reached through published vulnerabilities, exposed management functions, or credentials left in configuration files. (The Yamaha routers fell to leaked config credentials, not a product bug.) At least 1,300 WebLogic candidates and 35 VPN entry points were enumerated; discovery lists also named systems in the UK, France, Italy, Qatar, and Colombia.

The quiet finding: a bigger workforce, the same job

The headline number is 44 agents. The finding that matters is what those agents mostly produced. For many of CyberStrikeAI's targets, TrendAI records the outcome plainly: "no session, no web shell, no exfiltration." The clearest intrusion it could reconstruct started at an unauthenticated, publicly reachable admin interface on a legacy web system — a door that was already open.

TrendAI puts it directly: "AI has increased the attackers' workforce, but the work still consists of looking for unlocked doors." And elsewhere: "AI is no longer an experimental capability for APT groups; it is an operational component embedded directly into campaigns." Both are true at once. The agents did not conjure novel zero-days against hardened systems; they industrialized the search, running thousands of validation passes across three countries at a token cost the dashboard was happy to display.

That is the part defenders should internalize. CyberStrikeAI is not exotic. It is an open-source Go project that launched in late 2025, with more than 6,600 GitHub stars, 100-plus built-in templates, native support for Claude and DeepSeek, and — as of October 2, 2026 — a commercial owner in ThreatBook. The same framework was earlier linked by researchers to a wave of FortiGate targeting that ran alongside the AI-assisted campaign Amazon documented against 600-plus FortiGate appliances across 55 countries. This is commodity offense now, and it does not care whether your door is in Osaka or Milan.

Shut your own unlocked doors

TrendAI withheld IOCs to avoid disrupting active investigations, so there is no IP list to block. That is the right lens anyway: when the attacker is a validation swarm, the defensive win is removing what it validates. In priority order:

1. Find your exposed front doors first. Enumerate your own internet-facing admin interfaces, legacy web consoles, and management planes the way the swarm does — unauthenticated. The Case A intrusion began at a public admin page nobody had retired. See our guide to automated penetration testing for how to make that enumeration continuous rather than annual.
2. Kill default and config-file credentials. The GIS breach in Case B and the Yamaha RTX1210 compromises in Case C both came from credentials that were never changed or were left readable in configuration backups. Rotate them, pull secrets out of configs, and enforce MFA on every management and VPN endpoint.
3. Patch the edge, by exploitability not by CVSS. Cisco SD-WAN, Citrix NetScaler, and F5 BIG-IP were in the Case C crosshairs via published vulnerabilities — the ones an agent can look up and fire in seconds. Prioritize internet-facing, known-exploited bugs (for example, the kind of pre-auth RCE we covered in PHP2Shell, CVE-2026-109618) ahead of high-score bugs nobody is reaching.
4. Hunt for the behavior, not a signature. Look for bursts of structured validation traffic to many of your hosts, credential-stuffing against admin paths, and — the Case B tell — backdoors that reappear after you remove them. An actor who restores access after cleanup is still inside; re-image and rotate rather than delete-and-move-on.
5. Verify the fix with the same proof. After you close a door, re-run the exact check that found it open. "We patched it" and "an attacker can no longer reach it" are different claims.

What is not known yet

TrendAI assesses Case C with high confidence but could not confirm it, because no prompt text or API keys were recovered. The three cases are not attributed to a named threat actor, and the report explicitly finds no shared operator among them. Which specific Japanese organizations were compromised — versus merely validated or listed — is not public, and no IOCs have been released. Treat downstream claims tying these cases to ARTEX, to specific nation-state groups, or to a single campaign as unconfirmed until a primary source says so.

Matching an attacker swarm with a defender swarm

Here is the uncomfortable symmetry: the attacker in Case A did not have a secret weapon. It had an autonomous AI red team — a swarm of agents running recon-to-report against everyone at once, cheaply, continuously. The only reason it mostly failed is that most doors were already shut. The defensive answer is not a better signature; it is to run that same search against yourself, first and continuously, so your unlocked doors are closed before someone else's 44 agents enumerate them.

That is what Zero Hunt is built to do. Its 10-agent swarm — Recon, Vulnerability, Exploit, Web, Credential, Post-Exploit, Pivot, Tactic, Source Analyst and Report, under a human-approved controller — runs the attacker's own workflow against your estate, writing a fresh exploit chain per target rather than replaying a catalog, every skill backtested in the AI Gym before it touches production. It runs on-premise on private models (ZeroHunt Apex), so there is no third-party inference bill to meter and no external provider that can throttle or switch it off — and a human stays in the loop for every action that matters, with each finding signed at write time. Because the attacker's real advantage in TrendAI's data was patience on the wire — thousands of slow validation passes, a GIS server quietly drained — the appliance's deep-learning traffic model, four inference heads on billions of PCAP sequences running locally on the GPU, is built to see that staging and exfiltration while it is happening, not in the next morning's SIEM digest. The swarm is already out there looking for unlocked doors. The question is only whose swarm finds yours first. Talk to us.