One threat actor ran 44 AI agents against Japanese organizations this month. Not 44 people. One operator, one platform, forty-four delegated workers that did reconnaissance, validated vulnerabilities, exploited them, held command-and-control, exfiltrated data, and then wrote the report at the end.
That last part is what should stop you. The report was not a summary a human typed up at 2am. TrendAI's researchers found uniform, templated write-ups with an evidence index behind each one, across at least 19 identifiable organizations, at least 16 of them in Japan. These were outputs of a structured process run by the platform, rather than ad hoc notes left by an operator, Trend Micro's enterprise security division wrote in a deep-research note published on 27 October 2026.
The tool at the centre of it is CyberStrikeAI, an open-source penetration-testing framework that has been quietly repurposed for real intrusions, including an earlier campaign against Fortinet FortiGate appliances. It also generated Japanese-language forms and fake login pages as part of the run. Not machine-translated slop. Locale-correct phishing assets, produced inside the same workflow.
Read that again and then look at your own headcount plan for detection engineering this quarter.
Three attacks, three different levels of autonomy
TrendAI analysed three exposed server environments used by operators targeting Japan, and the range is the useful part of the story.
The first is the full-agent platform: end-to-end automation through the attack lifecycle, at machine tempo, with a repeatable pipeline and a reporting layer. The operator behind it also appears in target lists for Taiwan and Hong Kong.
The second was human-led with an LLM as an accelerant for planning and tool development. It lasted 24 days across August and September 2026 and started with a GIS server left on default credentials, walking out with cadastral records, commercial records, Windows credentials and email data. The same operator was hunting AI workflow platforms and inference services, apparently to steal cheap inference capacity.
The third is the most conservative: AI used only to write the operator's scripts. That actor still ran at least six campaigns from January to October 2026 against exposed VPN devices and WebLogic servers, and its discovery lists reached the UK, France, Italy, Qatar and Colombia.
Three maturity levels, one conclusion. You do not need a frontier model to be targeted by an agentic intruder. You need to be reachable and slow.
The window between disclosure and exploitation has collapsed
TrendAI's framing is blunt and, honestly, refreshing: AI has increased the attackers' workforce, but the work still consists of looking for unlocked doors. The types of doors have not changed. What has changed is the ability to try thousands at once, adapt to the target country's language, and continue without fatigue.
Microsoft's 2026 Digital Defense Report puts a number on that compression. Median time from vulnerability discovery to weaponization is now well below 24 hours. Your patch window used to be measured in weeks and justified by change-freeze committees. It is now measured against a pipeline that does not sleep and does not wait for a maintenance window.
This is not a Japan story
Two weeks ago Microsoft reported Storm-0940, a China-state-aligned actor, compromising a ConnectWise cloud backup application and using the ARTEX agentic framework to sign in to more than 2,250 Microsoft 365 tenants. The majority of attempts failed, which is the point: volume is cheap now. Authorities in South Korea have identified seven suspects linked to intrusions at more than 90 organizations, most involving ARTEX, with ransom demands of 360 million won in 38 of them and more than 8.2 million records taken.
Then there is CyberCartel's CARLIY0S, a swarm of four role-specialized Claude models that debate each target, defer to an arbiter, and hand the decision to an orchestrator before acting against Latin American banks and payment providers. And BUGSTER, a financially motivated operator who wired Hermes Agent to DeepSeek V4 with Cursor as a secondary tool, safety controls off, running brute-force and enumeration campaigns that pulled PII on thousands of students from Indian universities.
There is also a market now: stolen AI provider session tokens and packaged offensive tools sold under names like APEX AI, MessiahGPT and DarkGPT. The barrier to entry is a subscription, not a skillset.
Trend Micro's own summary is the one to keep: AI is no longer an experimental capability for APT groups; it is an operational component embedded directly into campaigns.
What actually holds
Nothing here rewrites security fundamentals. It rewrites their required speed, and it changes what counts as evidence.
Kill the default credential class. A GIS server on default creds cost one victim 24 days of exposure and a data set nobody can un-leak. Inventory internet-facing management planes first, then close them.
Patch edge infrastructure on a 24-hour clock. Cisco, Citrix, F5, Yamaha, FortiGate, WebLogic. These appear in every one of these campaigns because they are reachable and rarely touched. If your edge patch cycle is quarterly, you are the unlocked door.
Hunt on machine tempo signals. One operator probing 19 organizations in a short window leaves a shape: bursts of scanning from cloud ranges, rapid vulnerability validation, user-agent and timing patterns that look like software rather than a person. Build detections for velocity, not just for known payloads. A pipeline that probes thousands produces thousands of chances to be seen.
Watch outbound AI traffic as an attack surface. Stolen inference capacity, agent frameworks calling model APIs from segments that should never do that, and session tokens replayed from new geographies. If a server that has no business talking to an LLM provider starts doing exactly that, you want a ticket, not a mystery.
Keep the human in the loop where the damage lands. Automated reconnaissance is a nuisance. Automated exfiltration and automated payment changes are not. Deterministic gates on data-egress volume and on any agent that can move money or permissions still buy you the minutes that matter.
The aratech takeaway
Every one of these incidents shares a boring root: reachable, unpatched, weakly-identified infrastructure, now being worked by software that never gets tired. The defenders who come out of 2027 intact will not be the ones with the most impressive model. They will be the ones whose edge is patched, whose identities expire, whose egress is baselined, and whose logs are cheap enough to keep for the 24 hours that decide the outcome.
If you want a straight answer on where your exposure sits against an agentic attacker, we run that assessment in five days, evidence-first, and hand you the list in priority order. Start with the conversation, not the procurement. Talk to aratech.