# TrendAI: 44 AI agents probed 19 organizations, 16 of them in Japan

> A 44-agent CyberStrikeAI workflow ran against legacy web systems at smaller Japanese businesses and local public bodies.

- **Severity:** Info: Research, tools, evals or lab claims with no direct exposure. Context, not an alert.
- **Category:** Incident, Attack
- **Published by:** TrendAI
- **Disclosed:** 2026-10-23
- **Affects:** CyberStrikeAI
- **Research by:** Bakuei Matsukawa, Joseph C Chen
- **Primary source:** https://www.trendaisecurity.com/en-us/resources-insights/deep-research/not-only-artex-the-different-levels-ai-is-used-in-attacks-targeting-japan
- **Page:** https://theinjection.dev/items/trendai-japan-ai-attack-levels/

TrendAI rebuilt three attack infrastructures aimed at Japan from files the operators left in open server directories. One ran CyberStrikeAI, an open-source AI pentest tool, with 44 agents sharing the work across at least 19 organizations.

## What happened

TrendAI published this analysis of three attacker infrastructures in Japanese on 23 October 2026, with an English edition following on 27 October. Bakuei Matsukawa and Joseph C Chen rebuilt each operation from files the attackers had left in publicly reachable server directories. All three were active during 2026 and concentrated on Japan, and TrendAI says they are distinct from the infrastructures covered in earlier ARTEX reporting.

## How it works

CyberStrikeAI, an open-source penetration-testing tool built on AI agents, drove one of the three operations end to end as a single repeatable workflow: reconnaissance, vulnerability discovery and validation, exploitation, command and control, persistence, data exfiltration and automated reporting. Log entries such as 'credential-search agent 8/44' record 44 agents splitting the work, and the exposed management console used Simplified Chinese. The clearest intrusion chain began at an unauthenticated, publicly reachable administration page on a legacy web system, and TrendAI states that no novel vulnerability was involved. The platform throttled traffic to each target, which kept the activity faint in any single organization's logs.

## Who is affected

Targets were legacy web systems at smaller businesses and local public-sector organizations: at least 19 of them, at least 16 in Japan, with others in Taiwan and Hong Kong. Deep compromise reached a very small share, and for many targets the platform itself logged no session, no web shell and no exfiltration. TrendAI describes every figure as a lower bound.

## What to do

Inventory public-facing web systems, update or isolate legacy platforms, and check for externally exposed administration interfaces and default credentials. TrendAI also advises designing monitoring that can detect low-frequency, distributed attempts, because a single anomaly in one organization's logs may not be enough to judge the activity.

## Quick facts

- **Organizations probed:** At least 19, at least 16 of them in Japan
- **Agents:** 44, per the platform's own logs
- **Tool abused:** CyberStrikeAI, an open-source AI pentest tool
- **Entry point:** Unauthenticated admin page on a legacy web system
- **Not established:** Success per attempt, total damage, attacker identity

## Sources

1. [TrendAI Report](https://www.trendaisecurity.com/en-us/resources-insights/deep-research/not-only-artex-the-different-levels-ai-is-used-in-attacks-targeting-japan)
2. [Microsoft On ARTEX](https://www.microsoft.com/en-us/security/blog/2026/10/21/storm-0940-uses-artex-agentic-ai-connectwise-supply-chain-compromise/)