Three AI-assisted attacks on Japanese organisations expose gaps in agent audit trails

The episode also raises the question of whether current agent frameworks can show which agent acted, who approved it and why.

Researchers at TrendAI described three cyberattacks on Japanese organisations in which AI played a role, one of which used an open-source penetration testing tool to coordinate 44 agents across at least 19 organisations, 16 of them in Japan, during a short window in October 2026. A second campaign was run by a human operator assisted by a large language model and targeted a GIS server with default credentials, leading to theft of cadastral records and Windows credentials over 24 days in August and September 2026. The third used AI mainly to write tools and scripts for attacks on edge devices from Cisco, Citrix, F5 and Yamaha. Separately, an MIT Technology Review analysis argues that the four most widely used agent frameworks do not reliably emit the records needed to show which agent acted, who approved it and why, and urges OpenTelemetry-based standards for agent identity and human intervention logging.