TrendAI Says 44 AI Agents Went Door Knocking at Japanese Organizations

Someone pointed 44 AI agents at Japan, gave them a job list, and walked away from the keyboard. That is the picture TrendAI's researchers paint after finding three attacker server environments sitting open on the internet,.

TrendAI, the enterprise security arm of Trend Micro, says the exposed servers held "reconnaissance and attack tools, scripts, target lists, results, logs, and command histories," according to researchers Bakuei Matsukawa and Joseph C Chen, as reported by The Hacker News. Some were run mostly by hand. Others automated the whole job, command and control included.

The headline case is the loud one. TrendAI says the operator abused CyberStrikeAI, an open-source penetration-testing tool built around AI agents, and that its exposed console was in Simplified Chinese. Log entries such as "credential-search agent 8/44" are how the researchers confirmed a setup with 44 agents sharing the work. Reconnaissance, vulnerability validation, exploitation, persistence, data theft and automated reporting ran as one repeatable pipeline. It also produced Japanese-language forms and fake login pages.

The numbers come with a big asterisk, and TrendAI is upfront about it. In a short window in October 2026, at least 19 identifiable organizations, at least 16 of them in Japan, were hit with what the researchers call validation activity. Each got a report in the same format. The operator also targeted Taiwan and Hong Kong. But the researchers say deep compromise reached only a small share, and for many targets the platform itself logged "no session, no web shell, no exfiltration." An attempted attack, they stress, is not a compromise.

"AI has increased the attackers' workforce, but the work still consists of looking for unlocked doors." TrendAI researchers

That line is the whole story, and it cuts against the more breathless AI-hacking headlines. The clearest intrusion in the first case began at an unauthenticated, publicly reachable admin page on a legacy web system. TrendAI says no novel vulnerability was involved. What the agents added was scale and patience. Per the researchers, the platform worked many targets in parallel and throttled traffic to each one, so no single organization's logs looked alarming.

Two quieter cases, same lesson

The other two environments show how uneven this adoption is. In the second, a human led the attack and used a large language model to speed up planning and tool development. TrendAI says the campaign was also designed to target AI workflow platforms and inference services, apparently to get cheap inference capacity. One intrusion hit a geographic information system server exposed with default credentials and pulled out cadastral and commercial records, Windows credentials and email. The campaign ran 24 days across August and September 2026.

In the third, AI was limited to writing the operator's scripts. TrendAI says that actor ran at least six campaigns between January and October 2026 against edge devices from Cisco, Citrix, F5 and Yamaha, plus WebLogic servers, using published vulnerabilities, exposed management functions or credentials left in configuration files.

Here is what we do not know, and it matters. TrendAI says there is no evidence at this stage that the three environments share an operator. It also does not know which AI models are behind the attacks. Anyone naming a specific model or state is guessing. And this is a security vendor analyzing files it found, which is useful evidence but not an independent audit.

Still, the practical read is hard to dodge. Automated scanning noise can now write itself a tidy report in the victim's language. If your legacy admin panel is open to the world, a swarm does not need to be clever. It only needs to be patient.

The wider pattern fits other recent reports. We covered a separate case in which one hacker used AI agents to break into more than 100 websites, a different operation with no link to this one in TrendAI's findings. Microsoft's 2026 Digital Defense Report, as cited by The Hacker News, says AI has pushed the median time from vulnerability discovery to weaponization to well below 24 hours.