Skip to content
PERMISSION/PROTOCOL
Back to incident tracker

2026-10-27

HighPrimary

CyberStrikeAI Agents Executed an Intrusion Workflow Against Organizations Primarily in Japan

TrendAI reconstructed a 44-agent CyberStrikeAI campaign from attacker-side records, separating attempted attacks from limited evidence of deep compromise.

CyberStrikeAITool execution / MCPAttacker-operated multi-agent intrusion campaign reconstructed from exposed infrastructurePublic-facing legacy web systems at organizations primarily in Japan, with additional targets in Taiwan and Hong Kong

What happened

CyberStrikeAI agents shared and automatically executed reconnaissance, vulnerability discovery and validation, exploitation, command-and-control, persistence and exfiltration tasks, then wrote results and evidence reports. These workflow roles do not establish that every action succeeded at every target.

Why it matters

At least 19 organizations underwent validation activity, including at least 16 in Japan. TrendAI found attacker-side evidence of deep compromise for a small proportion, with one company showing the clearest intrusion chain. Victim-side confirmation, total data loss and the success of individual attempts remain unresolved.

Missing authorization check

Independently authenticated target-specific authorization before network exploitation, credential use, persistence changes or data exports in any governed agent runtime.

Would PP block it?

In an integrated governed runtime, an independent execution boundary could require grants bound to the exact target, operation, credential scope, data destination and expiry, with signed receipts for governed actions. That conditional integration does not stop an external attacker from operating its own platform or reaching exposed victim services.

Incident analysis

Timeline and technical read

Timeline

  1. 2026-10-23

    TrendAI identifies this date as publication of the original Japanese article.

  2. 2026-10-27

    TrendAI publishes the English investigation distinguishing autonomous Case A execution from human-led Cases B and C.

Technical breakdown

  • TrendAI examined exposed files on attacker-controlled servers, including a CyberStrikeAI console, target reports and evidence indexes; it did not obtain victim-side logs, disk images or network records.
  • A credential-search agent entry marked 8/44 confirmed a 44-agent configuration distributing work across specialized roles.
  • Agents automatically wrote results to a database and produced structured evidence reports across at least 19 identifiable organizations.
  • The workflow covered reconnaissance through exploitation, command-and-control, persistence, exfiltration and reporting, but many target records explicitly reported no session, web shell or exfiltration.
  • The clearest intrusion chain began at an unauthenticated public administration interface on a legacy web system, not a novel vulnerability.
  • The report does not establish the operators' identities, the models used, full damage or a shared operator with the other infrastructures.

Authorization boundary

Where the authorization boundary should have been

This incident is categorized as Tool execution / MCP. The relevant Permission Protocol gate is Tool-Call Gate. The read is conditional: the block only applies where the real action boundary is routed through a gate.

If enforced at
Conditional on integration: the governed agent runtime's network, credential, host-mutation and data-export execution boundaries
Still needs
Permission Protocol is not a perimeter defense, does not close unauthenticated administration interfaces, patch vulnerable web systems or constrain attacker infrastructure outside its integration. Patching, access controls, network defenses and victim-side investigation remain necessary.
Receipt required for
In an integrated runtime: target-specific network operations, credential use, persistence modifications and data exports

No prevention claim applies to an attacker-operated platform that does not use Permission Protocol's enforcement boundary.

Start small

Put the relevant gate at this action boundary.

This incident maps to Tool-Call Gate. Start with the boundary that controls the actual action, then require a signed receipt before execution.

Replay this incident with a signer in the loop