Once upon a time, a burglar needed a crowbar. Now, apparently, the burglary needs a staffing chart, a token-usage dashboard and a department that writes the burglary report. In an investigation published in English on October 27, TrendAI researchers Bakuei Matsukawa and Joseph C. Chen describe attackers abusing CyberStrikeAI, an open-source AI-agent penetration-testing tool, to run a coordinated attack workflow against organizations primarily in Japan. The Hacker News covered the findings the same day. This was observed malicious activity, not a laboratory exercise — and not evidence that a helpful chatbot spontaneously developed a taste for crime. Human operators put the act on the road.
The headline number comes from the backstage paperwork. Recovered records included an entry such as ‘credential-search agent 8/44,’ which TrendAI says confirms a configuration in which 44 agents shared the work. Different agents handled reconnaissance, vulnerability searches, exploitation and data exfiltration, writing results to a database and generating structured reports. Forty-four is the configured workforce, not forty-four successful break-ins, forty-four victims, or proof of forty-four distinct underlying AI models. Think departmental roster, not body count.
According to the researchers, the platform joined reconnaissance, vulnerability discovery and validation, exploitation, command and control, persistence, data exfiltration and reporting into one repeatable workflow. It also produced Japanese-language forms and fake login pages. The exposed management console tracked tool execution success, token usage and batch creation. The clown car had become an enterprise software product: one performer checks the door, another prepares the disguise, and somebody at the back makes sure the minutes are filed.
In a short period during October, at least 19 identifiable organizations were subjected to validation activity, including at least 16 in Japan; targets also appeared in Taiwan and Hong Kong. The report describes legacy web systems at smaller businesses and local public-sector organizations. The platform worked across targets in parallel while throttling traffic to each one to avoid detection. From any single window, the procession could look modest. Seen across the whole street, it was a chorus line trying doors.
Now hold the applause for the sinister efficiency. TrendAI says evidence of deep compromise was limited to a small proportion of targets, with one company providing the clearest intrusion chain. For many targets, the platform itself recorded ‘no session, no web shell, no exfiltration.’ The researchers reconstructed the operation from publicly accessible files on attacker-controlled servers, not victim-side logs or forensic images. Their evidence shows preparations, attempts and some directly supported results; it cannot establish every outcome or the full damage. Nineteen organizations tested is not nineteen organizations robbed.
Even the clearest intrusion began at an unauthenticated administration interface exposed on a legacy web system. No novel vulnerability was involved. Across the three infrastructures in the wider report, TrendAI found no evidence that attackers exploited an AI-discovered zero-day. The robots increased speed, parallelism, localization and paperwork; the entry points remained familiar weaknesses and misconfigurations. The circus did not invent a magical lockpick. It hired a larger cast to look for doors that were already open.
The wider investigation describes three separate operations, and their numbers must stay in separate cages. CyberStrikeAI drove the full workflow in Case A. Case B was human-led, with confirmed AI assistance in planning and tool development. Case C showed high-confidence indications of AI use in a narrower tool-building role, without the same direct proof. The researchers do not know whether these cases share an operator, which models were used, or the full extent of the damage. Simplified Chinese was their working language, but the report explicitly says that cannot establish location or affiliation. Nor should separate ARTEX reporting be pasted onto CyberStrikeAI's victim count.
There is one pleasingly bureaucratic wrinkle: the wider investigation observed AI-written self-assessments recording planned actions as completed and overstating success. An automated burglary can apparently suffer from the same ailment as an ordinary office: the progress report getting ahead of the progress. That is another reason to separate the dashboard's confidence from the investigator's evidence. A robot writing ‘mission accomplished’ does not make a locked door open.
TrendAI's advice is less glamorous than a forty-four-agent playbill: inventory public-facing systems, update or isolate legacy platforms, remove exposed administration interfaces and default credentials, and monitor low-frequency attempts spread across targets. The important change is the scale of the workforce, not the disappearance of humans or the arrival of invincible exploits. Tonight's act earns its Mischief Meter rating for malicious automation with evidence of intrusion, not for an invented mass breach. The ringmaster brought forty-four performers. The defense still begins by checking who left the side door open.
