Trend Micro’s TrendAI research team said in a report published in English on 27 October 2026 that one attack infrastructure it examined used CyberStrikeAI, an open-source penetration-testing tool built around AI agents, in a configuration in which 44 agents shared the work. In a short period in October, at least 19 identifiable organizations, including at least 16 in Japan, were subjected to validation activity, the report says, and evidence of deep compromise was limited to a small proportion of them.
In plain words, the researchers found the attackers’ own servers left open, read their files, and saw AI agents doing the routine work of a hacking team: scanning, testing, breaking in and writing reports, in Japanese where needed. The report’s summary is that “AI has increased the scale and speed of these attacks, but the attackers are still looking for an unlocked door.”
Short explainer · AI security brief
A vertical news Short narrated from the published headlines and opening lines of this piece and three related FourWeekMBA pieces on AI-linked cyberattacks in Japan, South Korea and beyond.
Business Pill · Multi-agent systems
An evergreen Business Engineer explainer on multi-agent systems: how several AI agents split one job between them. It explains the general idea only and does not discuss any attack or company in this story.
The key insight: As we read it, TrendAI’s report changes the question from whether attackers use AI to how much of an operation AI runs: the whole workflow in one case, planning and tools in another, tool-building only in a third.
Update, 28 Oct: AI coding tools as a way in.JFrog Security Research said on 26 October that it has identified “42 armed third-party GitHub repositories across 11 legitimate owners” connected to an npm malware campaign it calls testmetest. It says the repositories contain execution hooks for AI coding assistants and IDEs, and names Claude, Gemini, Cursor and VS Code hooks in one attacker repository.
JFrog says the campaign had armed real repositories belonging to “established developers, students and a legitimate organization” by 28 September. It adds that GitHub code search did not index the 12.9 to 13.7 MB payload files, which made the compromise easy to miss through ordinary search.
JFrog does not say the campaign used AI to attack. It describes the AI coding tools as places where the malicious hooks were set to run.
One attack platform, 44 AI agents: at least 19 organizations subjected to validation activity in October 2026, including at least 16 in Japan (lower-bound counts). Source: TrendAI (Trend Micro), Not Only ARTEX, 27 Oct 2026, Case A (CyberStrikeAI).
The report, by Bakuei Matsukawa and Joseph C Chen, describes three attack infrastructures with a strong focus on Japan, reconstructed from files the attackers had left in publicly accessible server directories. Its Japanese edition was published on 23 October.
Case A, AI-driven. The researchers confirmed the abuse of CyberStrikeAI. Reconnaissance, vulnerability discovery, exploitation, command and control, persistence, data exfiltration and automated reporting formed a single, repeatable workflow, and the platform produced Japanese forms and fake login pages. Targets were legacy web systems at smaller businesses and local public-sector organizations, primarily in Japan and also in Taiwan and Hong Kong.
Case B, AI-assisted. A human-led operation in which a large language model accelerated planning and tool development. At least 6,000 Japanese IP addresses were scanned, the report says, and AI and GPU services were themselves among the targets.
Case C, limited AI use. AI’s role was confined to developing the operator’s tools, a high-confidence assessment rather than a confirmed one. Targets included at least 1,300 WebLogic candidates and at least 35 VPN entry points.
The report stresses what AI did not change: the types of vulnerabilities exploited, the nature of entry points, which were exposed legacy systems and default configurations, and the proportion of targets subject to deep compromise. It says the figures are lower-bound estimates and that the attackers’ identities, whether the three cases share an operator and the AI models used remain unresolved. Simplified Chinese was the working language in all three infrastructures, which the researchers call only a weak clue to location or affiliation.
October 2026 reports that attackers used AI, and disclosures of flaws found with AI’s help, among the stories FourWeekMBA covered; our count, with a readable primary for each, not a census. Attacker reports: TrendAI (Japan, 27 Oct), JPCERT/CC (Japan), South Korea’s president (6 Oct, ‘possible’ AI use), NorForge (19 Oct), Microsoft (21 Oct), Straiker (21 Oct). Flaw disclosures: XRP Ledger (Veria AI, 9 Oct), Chrome (XBOW, 13 Oct), 25 open-source projects (Anthropic, 20 Oct), PHP (OpenAI, Google, 21 Oct), Fortinet (21 Oct), EDK II (Anthropic and Google researchers, 22 Oct).
October’s Tally, by Our Count
To put the report in context, we counted the October 2026 reports we have covered in which a government, a security company or a platform said attackers had used AI, and the disclosures of software flaws found with AI’s help. By our count, there are six of each, and three of the six attacker reports concern targets in Japan or South Korea.
South Korea, 6 October. President Lee Jae Myung said “details have emerged of the possible use of artificial intelligence” in some hacking cases, after customer information was exposed at seven financial companies.
Japan, JPCERT/CC. Japan’s national computer emergency response team says it confirmed that the attackers behind a wave of data breaches used AI to scan for known vulnerabilities and to attack companies through their APIs.
Japan, TrendAI, 27 October. The three infrastructures above, including the 44-agent platform.
Company websites, 19 October. NorForge said a Chinese-speaking hacker’s AI agents broke into websites of more than 100 companies, at about $50 per successful hack by its researcher’s estimate.
Microsoft tenants, 21 October.Microsoft said Storm-0940 used an AI agent framework called ARTEX to attempt sign-ins to more than 2,250 tenants.
Latin American finance, 21 October. Straiker said a campaign using AI agents built on Claude and Grok, among other models, attacked over 400 financial targets.
The six flaw disclosures, all on the defenders’ side, were the XRP Ledger bug found with Veria AI’s agent, XBOW’s Chrome exploit built with GPT-5.6 Sol, the 493 issues Claude flagged across 25 open-source projects, the two critical PHP flaws that OpenAI and Google say their models helped find, Fortinet’s fixes for five products, and the 9.5-rated server boot flaw credited to Anthropic and Google researchers.
Korea’s Widening Wave
The Korea Herald reported on 28 October that cyberattacks have hit more South Korean financial firms. Brokerage Daishin Securities said information belonging to 38,490 customers was exposed, while cryptocurrency exchange Bithumb and Mirae Asset Global Investments confirmed security intrusions; Shinhan Bank, KB Kookmin Bank and Hana Bank were among lenders that reported customer data leaks earlier in the month, the paper said.
The Financial Supervisory Service’s governor, Lee Chan-jin, warned that AI could make it easier for hackers to identify vulnerabilities and launch simultaneous attacks, according to the Korea Herald. The paper reports the warning; it cites no finding that AI was used in these breaches.
Connecting the Coverage
Our South Korea piece reported the president’s 6 October remark and noted that no AI tool, model or developer was named in the documents we read. What’s new: the breach wave has since reached a brokerage, an exchange and an asset manager, according to the Korea Herald.
Our Japan piece covered Prime Minister Takaichi Sanae asking PHP site owners to patch or go offline on 21 October, amid the breach wave JPCERT/CC tied to AI-assisted scanning. What’s new: TrendAI’s report reads the attackers’ own files and grades how much of each operation AI actually ran.
Our Microsoft piece and our NorForge piece described AI agents run against more than 2,250 tenants and more than 100 websites. Our security-week explainer sorted nine cases from one week by where AI sat: as prize, weapon or auditor.
On the defenders’ side, our PHP piece counted about 758,000 servers on PHP branches that no longer receive fixes, and our boot-flaw piece covered the flaw credited to Anthropic and Google researchers. Axios reported on 28 October that experts have dubbed this month “Black October,” and that millions of hacking attempts on the PHP flaws have so far yielded few successful attacks.
The Structural Read
As we read it, the platform’s advantage was breadth: 44 agents working across many targets in parallel, with traffic to each target throttled, which the report says made the activity difficult to recognize from a single organization’s logs.
The report says even the clearest intrusion chain began at an unauthenticated, publicly accessible administration interface on a legacy web system, and that no novel vulnerability was involved.
By our count, AI showed up on both sides of the ledger in October: six reports of attackers using it and six disclosures of flaws found with its help.
TrendAI report, 27 October 2026
“AI has increased the attackers’ workforce, but the work still consists of looking for unlocked doors.”
Three Implications
FOR COMPANIES IN JAPAN AND KOREA TrendAI’s first defensive priority is to inventory public-facing web systems and update or isolate legacy platforms; Korea’s financial watchdog urged firms to strengthen defenses, the Korea Herald reported.
FOR OPERATORS OF AI INFRASTRUCTURE The report says exposed inference services and GPU environments are attack surfaces in their own right and should be in asset inventories.
FOR SECURITY TEAMS The report recommends monitoring designed for low-frequency, distributed attempts, since one organization’s logs may show only an isolated anomaly.
The framework argues: “The agentic surface — the harness — is becoming where value pools in the entire AI stack.”
TrendAI’s Case A shows that layer used by attackers: an open-source agent framework that split reconnaissance, exploitation and reporting across 44 agents. The framework was published in July 2026 and does not discuss cyberattacks.
What Is Not Established
TrendAI’s findings come from attacker-side files, not from victims’ logs, and the report says they cannot establish whether each attempt succeeded, the full damage, or the attackers’ identities. South Korea’s president spoke of possible AI use, and no AI tool was named. Our tally covers only October reports we have published on, with a readable primary; it is not a census of attacks. We did not contact the companies named. Nothing here is security advice.
This Week In The AI Supercycle
Execution Fault Lines, Concentrated Demand, and Geopolitical Firewalls
This week’s issue: the AI build is not short of demand for its parts. It is short of cheap money, and its end revenue rests on a narrow base of large, often venture-funded buyers.
TrendAI’s report documents one platform running 44 AI agents against at least 19 organizations, at least 16 of them in Japan, with deep compromise confirmed in a small proportion. By our count, it is one of six October reports of attackers using AI, three of which concern Japan or South Korea, alongside six disclosures of flaws found with AI’s help.
A note on sourcing. The 44-agent platform and the three cases come from TrendAI’s report, published by Trend Micro’s research team in English on 27 October 2026 and in Japanese on 23 October; its figures are lower-bound estimates from attacker-side files. The Korean breaches are from The Korea Herald and the “Black October” label from Axios, both 28 October. The October tally is our count of reports we have published on, each with a readable primary; it is not a census. We did not contact the companies named.
Gennaro Cuofano is a CRO and tech executive who has worked in AI since late 2015, starting with bringing NLP, natural-language generation, voice and chatbot products to the marketing industry. His background is in law and finance: he holds a Master's degree in Law and an International MBA with an emphasis on corporate finance (LUISS Business School and the University of San Diego, 2012), and worked as a financial analyst at a real-estate investment firm in San Diego and as an assistant controller. His work focuses on business model strategy, business engineering and, more broadly, structural analysis: how companies make money, read from their own filings. He created FourWeekMBA and leads research there and at The Business Engineer, his newsletter on AI and business strategy, with over 95,000 subscribers and more than 1,000 published analyses. His writing has also appeared on Entrepreneur (for example, How to Digitize a Family Business in Europe) and HackerNoon. Find him on LinkedIn and Substack. See how we source.
