44 AI Agents Used in Cyberattacks

In a cybercrime operation named CyberStrikeAI examined by TrendAI researchers, 44 AI agents were used to automate cyberattack activities. Over a brief period in October, the platform targeted at least 19 organizations—16 of which were located in Japan—and generated reports containing separate evidence logs for each.

The CyberStrikeAI operation, which is one of three separate cyberattack cases examined by TrendAI researchers, revealed that AI agents operated across multiple stages such as reconnaissance, vulnerability detection, exploitation, maintaining access, data exfiltration, and report generation. Researchers stated that the platform scanned at least 19 organizations for vulnerabilities in October and presented each with a report in the same format containing its own evidence log. This points to a structured and automated process rather than scattered notes.

The findings indicate that AI systems in cybercrime are beginning to move beyond assisting with code writing or vulnerability analysis to coordinating complex, multi-stage operations. In other cases, it was documented that a human operator used a large language model to accelerate attack planning and develop tools, and an experienced operator also developed scripts for campaigns targeting network devices and servers. However, researchers did not confirm that these three cases were linked to the same operators and did not identify the specific AI models used in the CyberStrikeAI operation.