{"schema_version":"0.9.0","id":"LR-2026-0258","record_version":3,"title":"CyberStrikeAI multi-agent platform drives end-to-end attack workflow against Japanese organizations","verification":{"human_verified":false,"method":"automated_gate","auto_verified":true,"score":51.0,"score_breakdown":{"source_authority":12.1,"independent_corroboration":7.0,"implicated_party_confirmed":0.0,"citation_integrity":14.0,"specificity":3.0,"completeness":7.36,"unhedged_language":5.0},"checks":{"schema_valid":true,"every_field_cited":true,"quotes_verbatim":true,"source_fetched":true,"distinct_incident":true,"dates_plausible":true,"sources_agree":true,"source_describes_incident":true,"severe_backed_by_source":true,"record_integrity":true},"gate_version":"gate-2026-10-18.7","cross_check_model":null,"cross_check_agreement":null,"duplicate_of":null,"verified_by":null,"verified_at":"2026-10-28","extraction_run_id":null},"system":{"model_name":null,"model_version":null,"developer":"unknown","harness":"CyberStrikeAI","tools_granted":["reconnaissance","vulnerability_checks","exploitation","data_theft","reporting","credential_search"],"permissions_scope":null,"autonomy_level":"full-auto","guardrails_present":[],"deployment_context":"unknown","tier":null,"lifecycle_stage":null,"integration_type":"agentic_with_tools","intended_use":"penetration testing platform used to run attacks against target organizations","safeguard_state":null,"production_intended":null},"event":{"date_occurred":null,"date_disclosed":"2026-10-28","incident_class":"security_compromise","failure_class":null,"agent_involved":true,"secondary_failure_classes":[],"trigger":"unknown","duration":null,"detection_method":"public_researcher","summary":"Trend Micro researchers studied three Japan-focused attack infrastructures found in attacker-left files on public servers.","tags":["cyberattack","ai-agents","japan","penetration-testing-platform","attacker-infrastructure"],"date_detected":null,"near_miss":null,"root_cause":null,"root_cause_detail":null,"failure_class_detail":null,"responsible_party":"unknown","adversarial_actor":"external_attacker","input_provenance":null,"time_to_contain":null,"operations_paused":null,"remediation":null,"precursor_events":null},"impact":{"direct_loss_usd":null,"remediation_hours":null,"records_exposed":null,"third_parties_affected_count":null,"severity":"major","severity_because":"major: Hundreds of thousands of land and business records plus Windows credentials and email data were exposed and downloaded, an unbounded scope touching many third parties.","harm_class":[],"affected_description":"at least 19 target organizations, including at least 16 in Japan; a geographic information system server exposing hundreds of thousands of land and business records","protected_class_involved":null,"data_categories_exposed":["credentials","email","land_and_business_records"],"loss_range_usd":null,"reversibility":null,"downstream_exposure_count":null},"evidence":{"sources":[{"url":"https://securityaffairs.com/201913/ai/three-japan-focused-cyberattacks-show-how-hackers-use-ai.html","publisher":"Security Affairs","date":"2026-10-28","type":"press","title":"Three Japan-Focused Cyberattacks Show How Hackers Use AI","archived_url":null,"attachment":"first_report"},{"url":"https://thehackernews.com/2026/10/cyberstrikeai-uses-44-ai-agents-to.html","publisher":"The Hacker News","date":"2026-10-27","type":"press","title":"CyberStrikeAI Uses 44 AI Agents to Automate Hacking Operations Against Japan Targets","archived_url":null,"attachment":"fingerprint"}],"per_field_confidence":{"system.harness":"C","system.tools_granted":"C","system.integration_type":"D","system.intended_use":"C","system.autonomy_level":"D","system.developer":"D","system.deployment_context":"D","event.tags":"C","event.responsible_party":"C","event.adversarial_actor":"C","event.agent_involved":"C","event.detection_method":"D","event.summary":"C","event.incident_class":"D","event.date_disclosed":"A","event.trigger":"D","impact.affected_description":"C","impact.data_categories_exposed":"C","impact.severity":"D","context.denominator_available":"D","context.country":"C","impact.severity_because":"D"},"field_citations":{"system.harness":[{"source_index":0,"quote":"The researchers confirmed the use of CyberStrikeAI, an open-source penetration-testing platform built around AI agents."}],"system.tools_granted":[{"source_index":0,"quote":"It handled reconnaissance, vulnerability checks, exploitation, data theft and reporting as part of a repeatable process."},{"source_index":0,"quote":"One record mentioned a credential-search agent in a system that used 44 agents."}],"system.autonomy_level":[{"source_index":0,"quote":"Case A used AI to drive the entire workflow, which we confirmed."}],"system.integration_type":[{"source_index":0,"quote":"The researchers confirmed the use of CyberStrikeAI, an open-source penetration-testing platform built around AI agents."}],"system.intended_use":[{"source_index":0,"quote":"It handled reconnaissance, vulnerability checks, exploitation, data theft and reporting as part of a repeatable process."}],"event.detection_method":[{"source_index":0,"quote":"Researchers at Trend Micro studied three attack infrastructures to understand how hackers use AI."}],"event.summary":[{"source_index":0,"quote":"Researchers at Trend Micro studied three attack infrastructures to understand how hackers use AI."}],"event.tags":[{"source_index":0,"quote":"Researchers at Trend Micro studied three attack infrastructures to understand how hackers use AI."}],"event.responsible_party":[{"source_index":0,"quote":"Researchers still don’t know who was behind the three operations, whether they were connected or how much damage they caused."}],"event.adversarial_actor":[{"source_index":0,"quote":"Researchers at Trend Micro studied three attack infrastructures to understand how hackers use AI."}],"event.incident_class":[{"source_index":0,"quote":"The researchers confirmed the use of CyberStrikeAI, an open-source penetration-testing platform built around AI agents."}],"event.agent_involved":[{"source_index":0,"quote":"Case A: AI agents managed the attack workflow."}],"impact.affected_description":[{"source_index":0,"quote":"Researchers identified at least 19 target organizations, including at least 16 in Japan."}],"impact.data_categories_exposed":[{"source_index":0,"quote":"This provided access to hundreds of thousands of land and business records, as well as Windows credentials and email data."}],"context.country":[{"source_index":0,"quote":"Japan was the main target in all three operations, but attackers also targeted other countries and regions."}],"impact.severity":[{"source_index":0,"quote":"This provided access to hundreds of thousands of land and business records, as well as Windows credentials and email data."}],"impact.severity_because":[{"source_index":0,"quote":"This provided access to hundreds of thousands of land and business records, as well as Windows credentials and email data."}],"event.date_disclosed":[{"source_index":0,"quote":"published: 2026-10-28"}]},"notes_on_gaps":"Only one source (Security Affairs press summary of Trend Micro research). No model name, version, developer, permissions scope, guardrails, deployment context, lifecycle stage, safeguard state, or production-intent is stated; system.developer left unwritten rather than guessed. event.date_occurred, date_detected, duration and time_to_contain are not stated. event.trigger is not stated: no source names what set the behaviour off, so it is omitted rather than defaulted. event.failure_class is null because the agent was the attacker's tool, not an agent whose own mechanism failed; no failure_class test is met. event.root_cause is not written: no source names what failed. impact.direct_loss_usd, records_exposed, third_parties_affected_count and remediation_hours are not stated; the 'hundreds of thousands' figure is not a precise count. impact.harm_class left empty because no source states a harm kind in the taxonomy's terms. system.autonomy_level 'full-auto' is classified from 'Case A used AI to drive the entire workflow', which states AI drove the workflow but does not explicitly rule out a human; grade D. event.incident_class 'security_compromise' is classified from the attacker context, grade D. context.industry, org_size_band, denominator, systemic_exposure, regulatory and coverage are not stated. The 19-organization figure is a target count, not a confirmed-victim count. system.tier: not set; no operator named and deployment_context is not a lab's. [aggregated by deepseek-chat, aggregate-2026-09-27.1, 2026-10-28] system.integration_type: agentic_with_tools. system.autonomy_level: a source states no person was in the loop while it ran (not: silence about a human is not a statement that none was there). system.developer: no source names the developer. system.deployment_context: no source states where it ran. event.detection_method: a source states an independent researcher or journalist found it (not: a researcher who disclosed after being told is not the detector). event.incident_class: a source states an attacker, an injected instruction or a misused credential caused the system to act, or that the system's own boundary (sandbox, permissions, weights, accounts) was breached. event.trigger: no source states a cause. context.denominator_available: no denominator is available for this incident. [2026-10-28: source attached: https://thehackernews.com/2026/10/cyberstrikeai-uses-44-ai-agents-to.html (fingerprint); Both describe the same Trend Micro/TrendAI study of three Japan-focused attack infrastructures using CyberStrikeAI, with the report adding detail on the first attack.]"},"context":{"industry":null,"org_size_band":null,"country":"JP","denominator_available":false,"denominator":null,"related_incident_ids":[],"systemic_exposure":null,"shared_model_id":null,"upstream_incident_id":null,"incident_evidence":null,"regulatory":null,"coverage":null},"narrative":{"steps":[{"step":"doing","text":"In Case A, the CyberStrikeAI open-source penetration-testing platform, built around AI agents, ran reconnaissance, vulnerability checks, exploitation, data theft and reporting against at least 19 organizations, 16 of them in Japan, splitting tasks among up to 44 agents.","quote":"It handled reconnaissance, vulnerability checks, exploitation, data theft and reporting as part of a repeatable process.","source_index":0,"grade":"C"},{"step":"went_wrong","text":"The AI agents carried out an automated attack workflow against organizations that had not authorized it, breaching the boundary between permitted security testing and unauthorized intrusion.","quote":"Case A used AI to drive the entire workflow, which we confirmed.","source_index":0,"grade":"D"},{"step":"reached","text":"At least 19 organizations, 16 in Japan, were targeted; the clearest intrusion came through a publicly accessible administration page on an old web system, though the platform rarely gained deep access or stole data.","quote":"The clearest intrusion started through an administration page that was publicly accessible on an old web system.","source_index":0,"grade":"C"},{"step":"caught","text":"Trend Micro researchers found the attack infrastructure by examining files attackers left on publicly reachable servers, including scripts, target lists, logs and command records.","quote":"The researchers looked at files that attackers left on servers anyone could reach.","source_index":0,"grade":"C"},{"step":"done","text":"The researchers could not confirm every break-in or measure damage because victim logs were unavailable; they published the findings and said they would continue working with the relevant organizations and consider further technical reporting.","quote":"But the researchers could not see the victims’ own logs or network records.","source_index":0,"grade":"C"}],"model":"deepseek-chat","prompt_version":"aggregate-2026-09-27.1","extracted_at":"2026-10-28","source_urls":["https://securityaffairs.com/201913/ai/three-japan-focused-cyberattacks-show-how-hackers-use-ai.html"]}}