Hackers Used 44 AI Agents To Automate Cyberattacks, Researchers Say

A cybercrime operation has used 44 AI agents to automate hacking activities, highlighting how artificial intelligence could make sophisticated cyberattacks faster and easier to execute.

The operation, dubbed CyberStrikeAI, was among three separate cyberattack cases investigated by TrendAI. The AI agents reportedly worked across multiple stages of an attack, from reconnaissance and vulnerability discovery to exploitation, maintaining access, stealing data and generating reports.

In a short period in October, the platform ran at least 19 organisations, including at least 16 in Japan, through a process of checking for weaknesses, researchers said. Each got a report in the same format with its own evidence log, which TrendAI said points to a structured, automated process and not a hacker's scattered notes.

The findings point to a growing shift in cybercrime, with AI systems moving beyond helping hackers write code or analyse vulnerabilities to coordinating complex, multi-step operations.

AI Moves Beyond Assisting Hackers

In a separate case, researchers documented a human operator using a large language model (LLM) to accelerate attack planning and develop tools. One intrusion involved the theft of property and commercial records, Windows credentials and email data.

A third case involved an experienced operator using AI to develop scripts and tools for campaigns targeting exposed network devices and servers.
Although the three cases demonstrate different ways in which AI can be incorporated into cyberattacks, researchers have not established that they were linked to the same operators. The specific AI models used in the CyberStrikeAI operation were also not identified.

The cases illustrate how AI can assist attackers at several points in the hacking process. Instead of relying entirely on manual work, operators can use AI to help discover potential targets, identify weaknesses, write code and organise the results of their activities.

Growing Cybersecurity Concerns

This development comes amid wider concerns about the use of AI to automate cybercrime, including credential theft and ransomware operations. AI-assisted attacks have also been reported against websites and internet-facing systems.

However, the use of AI does not necessarily mean that every stage of an attack can run independently or succeed without human involvement. The extent of automation and the role played by human operators can vary between campaigns.

"We are seeing attackers still use easy, reliable paths with vulnerabilities that have existed for years. But once they get into a system, they're able to scale their intrusions better-leveraging AI to increase the speed and scale of ransomware attacks," Nicholas Butts, Director of AI and Cybersecurity Policy at Microsoft told this writer on the sidelines of the NDTV World Summit 2026 last week.

"And while nation-state actors are also experimenting with it, they are still far away from the best humans. It's really important that even from a defensive perspective, once we start using AI to fight AI, we use it to create speed and scale while keeping humans in charge of trust and decision-making," he added. 

Butts also believes that AI is still not a better hacker than the best human hacker.

For cybersecurity teams, the challenge is that automation can help attackers scale their operations, potentially allowing them to examine more targets and attempt more attacks in less time.

The findings spotlight the need for organisations to secure exposed systems, patch known vulnerabilities, strengthen access controls and monitor suspicious activity.