On October 28, 2026, Trend Micro researchers Bakuei Matsukawa and Joseph C Chen published a report confirming that attackers, centered on 44 coordinated AI agents, launched a full-chain automated cyberattack against at least 19 organizations that month. Sixteen of the targets were in Japan, with the remainder distributed across Taiwan and Hong Kong. This is the most AI-driven real-world attack case researchers have recorded to date.
What Is Truly Novel About This Attack
According to the Trend Micro report, the attackers used CyberStrikeAI—a legitimate open-source penetration testing platform, not new malware developed specifically for attacks. The platform chains reconnaissance, vulnerability discovery and validation, exploitation, command and control, persistence, data exfiltration, and structured reporting into an automated pipeline that requires no human intervention. Recovered files show that a "credential hunting agent 8/44" directly confirms the division of labor among the 44 agents: different agents handle different stages, work in parallel, and feed results into a shared database, forming a standardized process that can be reused across multiple targets.
The entire attack did not exploit any zero-day vulnerabilities. Trend Micro confirmed that the initial breakthrough came from an administrative interface on a legacy web system that could be accessed without authentication. The 44 agents systematically searched a large number of targets for these long-unpatched old doors rather than digging for new security flaws. The core value of automation lies in scale and speed, not technical depth.
Anti-Reconnaissance Design That Disperses Traffic
The most engineering-heavy design in this system is its traffic distribution strategy. Agents work in parallel across multiple targets while keeping traffic to each individual target at a low level. This means that any single victim organization reviewing its own logs would find it very difficult to detect attack traces from traffic anomalies. Trend Micro researchers were able to reconstruct the full picture only by retrieving publicly accessible files on the attacker's server—including attack scripts, target lists, execution logs, and command records.
The attack platform's management console provides a visual interface for tool execution success rates, token usage, and bulk creation controls. Reports are generated separately for each identifiable target and include structured evidence indexes. The platform can even automatically generate Japanese-language forms and fake login pages to suit Japanese targets. This is an attack operations system with a project management interface.
A Simplified Chinese Interface Does Not Equal Attribution
Screenshots of the management console show that the operator interface uses Simplified Chinese. Trend Micro researchers explicitly warn that interface language cannot establish an attacker's geographic location or organizational affiliation. CyberStrikeAI is an open-source project that anyone can download and deploy, and language preference may reflect either native habit or deliberate disguise. Two other Japan-targeted attack cases studied in the same batch of Trend Micro reports also used Simplified Chinese as the operating language, but the three cases used different tools, and researchers could not confirm whether they came from the same operator.
The headline wording in early media coverage tends to create incorrect attribution assumptions among readers. The attackers' identities remain unknown, and Trend Micro has not put forward any evidence-supported attribution conclusion.
The Real Ceiling of Automation Efficiency
According to the Trend Micro report, a large number of attack records show results of "no active sessions, no web shells, no data exfiltration." The full deployment of 44 agents did not produce a corresponding intrusion success rate. On many targets, the automated process completed reconnaissance and vulnerability validation but failed to achieve deep compromise.
A second case studied by Trend Micro during the same period (Case B) adopted a hybrid model of "human-led plus AI-assisted planning," and the attackers achieved deeper penetration against a small number of targets—including simultaneous control of FTP services, databases, administrative accounts, web shells, and SSH access. At the current stage, human-machine collaboration still causes more serious real-world damage than pure AI automation. This conclusion is an accurate gauge of the current progress of AI weaponization: the tools have been engineered, but human judgment still has irreplaceable value in handling edge cases and escalating privileges.
Why Japan Became a Concentrated Target
The time context of the Trend Micro report provides an important clue. In the autumn of 2026, multiple Japanese companies and institutions successively reported data breaches in web systems. Japan's National Cybersecurity Office issued a warning to businesses on October 9, 2026, and the ruling party's cybersecurity chief characterized the current situation as a "state of emergency." This shows that the attack was not an isolated incident but part of a larger wave of scanning and targeted attacks.
CyberStrikeAI had previously appeared in a separate attack campaign against FortiGate devices—in early 2026, an attacker with limited technical capability used the tool to break into more than 600 FortiGate firewalls in over 55 countries without using any zero-day vulnerabilities. CyberStrikeAI is being reused by different operators in different attack campaigns, a natural consequence of the spread of open-source attack platforms.
What It Means for Defenders
All of Trend Micro's defensive recommendations point to the same fundamental problem: legacy systems exposed to the internet and default credentials. The reason CyberStrikeAI's attacks can be replicated at scale is precisely that its prey—unauthenticated administrative interfaces, unchanged default passwords, and old VPN devices that have not been taken offline—is abundant in Japanese organizations, enough to sustain a 44-agent pipeline in continuous operation.
The dispersed, low-traffic attack pattern makes it extremely difficult for any single organization to detect the attack relying on its own logs. Trend Micro was able to discover this attack because the attacker's server files were publicly accessible on the internet—an operational security mistake, not the result of defensive monitoring.
Assessment
The CyberStrikeAI case confirms that AI agents can already execute a complete attack chain without sustained human intervention and can adapt to the language and culture of specific targets. But this case also reveals the real boundary of current AI attacks: it excels at large-scale scanning and process standardization, but when facing deep privilege escalation that requires dynamic judgment, its effectiveness still falls short of human-machine collaboration.
Defenders need to clean up the exposure surface of legacy systems before AI agents close the gap in handling edge cases—because once AI agents close that gap, today's failure records ("no sessions, no exfiltration") will become success records.
© 2026 Winzheng.com 赢政天下 | 转载请注明来源并附原文链接