Breaking into websites used to demand rare skills and plenty of time. A Japanese-led international investigation suggests artificial intelligence is now doing much of that work for attackers.
Japan’s Computer Emergency Response Team Coordination Center (JPCERT/CC) said on Saturday that it had identified around 1,000 servers that seem to have served attackers as staging posts for AI-assisted intrusions since early autumn. Working alongside cybersecurity companies abroad, the centre began digging in early October and is currently monitoring between 600 and 700 of the machines, which may sit in physical data centres or run as virtual systems.
On the majority of the machines, analysts found automated hacking kits driven by AI; one named example is Artex, a penetration-testing tool. Such software is built so organisations can probe their own defences, but here it seemed to be aimed at sites around the world, hunting for weaknesses and trying to grab configuration files. Investigators also found traces of an AI coding assistant made by the US firm Anthropic on one server, a sign that the tools had been repurposed to boost the attackers’ reach.
Several publicly reachable servers held software for picking apart the inner workings of smartphone apps, along with programs for testing system flaws. That fits a pattern Japanese researchers have described in recent weeks: attackers study a company’s mobile app, work out how it talks to back-end systems, and then try to slip in through those interfaces.
The findings follow a run of data breaches disclosed by Japanese companies this autumn. Security firms have also reported servers equipped with the same kind of tooling being used against banks in South Korea.
JPCERT/CC analyst Ken Sajo cautioned that criminals are only beginning to harness AI. “More sophisticated attacks will increase in the future,” he said. For defenders, the lesson is to examine their own apps and APIs as closely as an automated adversary would.
