CyberStrikeAI automates attacks with 44 AI agents
CyberStrikeAI was used to divide cyber attacks among 44 artificial intelligence (AI) agents, automating work from target discovery through data theft and reporting. TrendAI identified the activity while examining three exposed environments that attackers had used against organizations in Japan. Those systems contained attack tools, scripts, target lists, results, logs and command histories, giving researchers visibility into operations ranging from hands-on intrusions to largely automated campaigns.
The first operation used CyberStrikeAI, an open-source penetration testing framework, meaning software intended to help security teams test systems for weaknesses. The tool had previously appeared in attacks against Fortinet FortiGate appliances. In October 2026, attackers used it to create a repeatable process covering reconnaissance, vulnerability discovery and confirmation, exploitation, command-and-control (C2), persistence, data exfiltration and report generation. C2 is the communication channel through which an attacker directs compromised systems, while persistence describes methods for retaining access after the initial breach.
CyberStrikeAI assigned different parts of the operation to 44 agents and could produce Japanese-language forms and imitation login pages. Trend Micro's enterprise security division said at least 19 identifiable organizations underwent validation activity during the short campaign, including at least 16 in Japan. Each target had a similarly formatted report and an indexed collection of evidence, which the researchers assessed as output from a structured automated workflow rather than informal notes created by one operator.
The second environment showed a different model: a human-directed campaign in which a large language model (LLM), software trained to interpret and generate language, helped with planning and tool development. The attackers also targeted AI workflow platforms and inference services, apparently seeking access to substantial computing capacity at low cost. One intrusion involved a geographic information system (GIS) server, a system used to manage location-based information, that was exposed with its default credentials. The breach led to the theft of cadastral and commercial records, Windows credentials and email data. This campaign ran for 24 days across August and September 2026.
In the third case, AI had a narrower role and was used to develop scripts and tools for an experienced human operator. The campaigns targeted internet-facing devices from Cisco, Citrix, F5 and Yamaha through published vulnerabilities, management functions or credentials found in configuration files. TrendAI estimated that the operator conducted at least six campaigns between January and October 2026, opportunistically searching for exposed virtual private network (VPN) devices and WebLogic servers. The researchers noted established automation and evidence-management practices.
TrendAI found no evidence that the three environments belonged to the same operator. The AI models used in the attacks remain unknown, as does the full geographic scope. The first operator also targeted organizations in Taiwan and Hong Kong. Discovery lists from the third case included WebLogic systems associated with organizations in the U.K., France, Italy, Qatar and Colombia. The findings indicate that AI increased the number of systems attackers could assess and helped adapt content to local languages, but the initial openings remained familiar weaknesses such as default credentials, exposed management services and known vulnerabilities.
Other recently documented activity shows similar integration of agentic AI, in which software can plan and perform a sequence of tasks with limited human input. Microsoft's 2026 Digital Defense Report said the median interval from vulnerability discovery to weaponization had fallen to well below 24 hours. The report attributed this acceleration to AI-assisted research, automated decisions and faster development of working attack methods. Threat actors have also begun trading stolen AI provider session tokens and offensive tools named APEX AI, MessiahGPT and DarkGPT.
The same pattern has reached website attacks. Palo Alto Networks Unit 42 reported that a financially motivated operator called BUGSTER configured the Hermes Agent framework with DeepSeek V4 and Cursor, with safety controls disabled, for a WordPress brute-force campaign against an Indian university website. The operation also generated a REST API enumeration report. A second Indian public university lost a database containing more than 5,200 records, including students' personally identifiable information. A third target, an Indian e-commerce site, was examined for a storefront API token, administrator email addresses, phone numbers and payment merchant IDs.
Further campaigns demonstrate how varied these workflows have become. CyberCartel used a four-model system called CARLIY0S against banks and payment providers in Latin America. Another offensive agent was designed to take over exposed AI endpoints and perform as many as 100,000 steps without human approval, using 74 tools to find targets, deploy cryptocurrency miners and return to compromised hosts. An affiliate of The Gentlemen ransomware operation used Anthropic Claude Code during intrusions into at least six organizations in late June 2026, including for reconnaissance, exploitation commands, malicious scripts and firewall changes.
Researchers also documented Zerofot's auto_scan tool, which combined OpenAI Codex and Claude Code to collect thousands of API keys and tokens from exposed hosts. An AI-generated Python framework called RAGE targeted services including Redis, Elasticsearch, Docker, Apache Tomcat, Jenkins, Hadoop YARN, Confluence and Supervisord, with capabilities for exploitation, credential capture and cryptocurrency mining. Hunt.io separately reported an AI-assisted campaign against PaperCut NG/MF servers that compromised hundreds of instances and continued into credential collection, internal network movement and automated post-exploitation.
For website owners and IT teams, the immediate response is not to search for a special category of AI attack, but to close the same openings these automated systems are testing at greater speed. Default passwords should be replaced, internet-facing software and appliances should be updated promptly, unnecessary management interfaces should be removed from public access, and unusual authentication or data-transfer activity should be investigated. AEU-I provides security-first IT, infrastructure and consulting for organizations that need support managing those areas.
The central risk is scale. These cases do not establish that AI created new classes of vulnerability, and the researchers did not identify a shared operator or the models involved.