Hackers used 44 AI agents to probe at least 19 organizations, TrendAI finds

At least 19 organizations faced coordinated checks for security weaknesses during a short period in October 2026, with at least 16 in Japan. TrendAI researchers traced the activity to attackers using CyberStrikeAI and 44 AI agents to divide the work. That scale did not translate into evidence of deep access or data theft across those targets.

The findings expose how attackers used AI to organize an operation, rather than simply ask a chatbot to write code. CyberStrikeAI, an open-source platform for penetration testing—checking systems for security weaknesses—handled a repeatable workflow spanning reconnaissance, vulnerability checks, exploitation and reporting, according to TrendAI’s findings described by The Hacker News.

An attack platform with divided responsibilities

Researchers examined tools, target lists, results, logs and command histories left in exposed attacker server environments. Those records gave them a view of the software directing the activity and the evidence it collected. Their broader investigation covered three environments; the CyberStrikeAI operation was the case in which they confirmed AI drove the attack workflow.

The platform assigned different parts of the operation to agents. One record identified a credential-search agent within the 44-agent system. Its workflow extended beyond finding weaknesses: it also covered command and control, maintaining access, moving data out of systems and producing automated reports. These were stages of the platform’s process, not proof that every stage succeeded against every target.

It could also generate Japanese-language forms and fake login pages. Alongside that local-language capability, researchers found standardized output for the organizations subjected to validation activity. Each had a report in the same format and an index pointing to evidence, showing that the platform organized its findings as well as its attack tasks.

These were outputs of a structured process run by the platform, rather than ad hoc notes left by an operator.

TrendAI, quoted by The Hacker News

A target list is not a breach count

The strongest constraint on the findings is the difference between attempting an attack and gaining useful access. Despite its automation, the platform rarely reached deeply into target systems, according to Security Affairs’ account of the research. In many cases, it had no active session or web shell—a tool for running commands on a compromised server—and showed no evidence of stolen data.

The clearest intrusion began through a publicly accessible administration page on an old web system. It did not require exploiting a newly discovered vulnerability. That example grounds the operation in a familiar security failure: an exposed management interface, rather than evidence that AI had discovered a novel route into the organization.

The researchers’ vantage point also limits what they can conclude. They could inspect attacker-side files, but not the affected organizations’ own logs or network records. They therefore could not confirm every claimed break-in or measure the full damage. The attackers’ identities and the AI models behind the activity remain unknown.

Parallel work, quieter traces

One operational detail matters even without a confirmed breach total. The system worked on several targets at once while keeping traffic to each organization relatively low. Researchers said this made the activity harder to spot by examining a single victim’s logs: the wider operation was distributed across targets, rather than concentrated in one conspicuous stream.