Loading page…
Investigators found security-testing platforms, apparent attempts to steal configuration files and traces of an Anthropic tool.
Listen to this story
The suspected servers contained penetration-testing and app-analysis tools, and investigators believe operators used them to probe websites and attempt to steal configuration files. JPCERT/CC is still tracking 600 to 700 of the roughly 1,000 servers identified, but the findings do not establish how many organizations, if any, were successfully breached. A trace of Anthropic programming support software was found on one server; investigators did not conclude that it powered the suspected activity.
JPCERT/CC started the investigation with overseas cybersecurity firms in early October; the suspected servers had been online since October.
Investigators found tools for inspecting smartphone app internals and suspected attackers targeted interfaces connecting apps to external systems.
Most of the servers reportedly hosted AI-powered platforms such as Artex, a penetration-testing tool.
AI-powered security tools appeared on around 1,000 servers suspected of supporting cyberattacks, according to a Japan-led international investigation described by Kyodo News on November 15. The servers appeared to be searching for weaknesses and trying to steal configuration files—a finding about suspected attack infrastructure, not a count of successfully breached organizations.
The Japan Computer Emergency Response Team Coordination Center, or JPCERT/CC, began the investigation in early October with overseas cybersecurity firms. The suspected servers had been online since October. At the time of the report, the center was tracking 600 to 700 of them.
Most of the servers hosted AI-powered platforms such as Artex, a penetration-testing tool—software for checking systems for security weaknesses. Investigators identified AI tools on the servers and suspected they were being used to search for vulnerabilities and target websites worldwide.
The apparent activity went beyond looking for weaknesses. The servers also appeared to be attempting to steal configuration files, which contain system settings.
On one server, investigators found traces of a programming support tool created by Anthropic. Kyodo described that discovery as suggesting attackers had used AI to strengthen their hacking capabilities.
JPCERT/CC analyst Ken Sajo warned that AI use in cyberattacks was still at an early stage and that more sophisticated attacks would increase in the future.
Loading discussion...
Join the conversation
Explain where you would draw the line.
Be the first to share a perspective or an experience.
Reader comments
Newest comments first. Replies stay oldest first.