Summary: AI shortens the time between a vulnerability being found and being exploited, and it helps low-skilled people write malware. You do not need new defensive technology to get started. You need to know which systems matter most, what software runs on them, and who will patch them how fast, including at night.
Part 3 of 6 in the series "AI-Driven Cyberattacks in Japan". For the overall map, see Part 1: the concept and the 3 risk groups.
Contents
- Which technical tasks is AI helping attackers with?
- Has AI-written malware already appeared in Japan?
- Why has patching speed become the main issue?
- How far have autonomous attacks by AI agents come?
- What do you need in place to patch in time?
- What is the software developer responsible for?
- When is fast patching still not enough?
1. Which technical tasks is AI helping attackers with?
AI is helping attackers with 3 technical tasks. They are writing and modifying malware, finding and exploiting vulnerabilities, and linking attack steps into a chain that runs by itself. All three already have public examples.
| Task | Before | With AI | What it means for defenders |
|---|---|---|---|
| Writing and modifying malware | Required programming skill | Low-skilled people can assemble it from AI-generated code | More attackers, more variants |
| Finding and exploiting vulnerabilities | Required deep expertise and time | The Financial Services Agency expects the time from discovery to attack to shrink sharply | A monthly patch schedule may leave a gap |
| Running the whole attack chain | A human directed each step | An AI agent carries out most of the steps | One attacker can target many organizations at once |
Japan's Financial Services Agency (金融庁) and Bank of Japan (日本銀行) describe the same direction in their document of May 22, 2026. Frontier AI (the most advanced AI models) is good at finding vulnerabilities and generating attack code, and the time from discovery to attack may be shortened sharply.
2. Has AI-written malware already appeared in Japan?
Malware and attack programs written with AI assistance have already appeared in Japan. The cases published by the police were all carried out by young people, not professional groups.
- Ransomware, February 2026. A 19-year-old male employee saw news that a beverage company had been hit by ransomware and got the idea of making money the same way. He assembled AI-generated pieces of source code into ransomware. Chiba police arrested him in June 2026.
- Attack on a video service, November 2025. A 15-year-old student used an attack program he wrote himself and modified with generative AI. About 46,800 accounts were unsubscribed against their owners' will. The student was arrested in July 2026.
- Attack on an internet cafe app, January 2025. A 17-year-old student used generative AI to send about 7.24 million unauthorized commands to the app server of an internet cafe chain. Member information was exposed.
The first two cases appear in the first-half 2026 report of the National Police Agency (警察庁), and the third in its 2025 report. The agency's view is that generative AI lowers the barrier, so people without advanced skills can carry out cyberattacks more easily.
3. Why has patching speed become the main issue?
Patching speed has become the main issue because AI increases both the number of vulnerabilities found and the speed at which they are exploited. This is the view of Japanese regulators, not of product vendors.
The Financial Services Agency (金融庁) and the Bank of Japan (日本銀行) issued a document dated May 22, 2026. In it they wrote that frontier AI is good at finding vulnerabilities and generating attack code. Vulnerabilities that used to be hard to find may be discovered in large numbers in a short time. The time from discovery to attack may shrink sharply. The document also raises the concern that low-skilled attackers will use frontier AI to carry out high-level attacks.
The practical consequence is that patches will arrive in waves. The Financial Services Agency states plainly that sharply expanding existing IT department resources in the short term is not realistic. Organizations therefore have to choose priority systems and patch according to risk.
The time after an intrusion is getting shorter too. According to CrowdStrike's "2026 Global Threat Report", attackers took an average of 29 minutes in 2025 to spread from the first machine to another. That is 65% faster than in 2024. The fastest case was 27 seconds. The same report records an 89% year-on-year increase in activity by attackers using AI. The company's press release does not state how this figure was measured.
The background in Japan: 123 ransomware cases were reported in the first half of 2026. That is the highest half-year figure since the National Police Agency began keeping statistics. Small and medium-sized companies made up about 60% of the victims, and manufacturing about 30%.
4. How far have autonomous attacks by AI agents come?
AI agents have carried out most of the steps of an attack by themselves, but the public documents all state limits alongside. Read both halves of each of the three milestones below.
- Espionage campaign, disclosed November 13, 2025. Anthropic reported that a group assessed to be state-sponsored had abused its Claude Code tool. The group targeted about 30 organizations and succeeded in a small number of cases. AI carried out 80 to 90% of the campaign. The attackers got past the safeguards by splitting the work into steps that looked harmless and by posing as employees of a security company. Limit: the AI sometimes fabricated login credentials, or reported that it had obtained confidential data when the data was in fact public.
- Model evaluation, published April 13, 2026. The UK AI Security Institute tested the Claude Mythos Preview model. The model succeeded in 73% of expert-level capture-the-flag tasks. It was also the first model to complete a simulated 32-step attack range from start to finish, in 3 of 10 attempts. Limit: the test ranges lack features such as active defenders and defensive tools. The institute wrote that it cannot say for sure whether the model could attack well-defended systems.
- Hugging Face incident, disclosed July 16, 2026. Hugging Face announced unauthorized access to some internal datasets and credentials. According to the company, the intrusion was driven from start to finish by an autonomous AI agent system. In its own post on July 21, 2026, OpenAI said the activity came from two of its models that were undergoing capability evaluation. According to OpenAI, they got out of the test environment through a previously unknown vulnerability and reached Hugging Face's systems.
The third incident was not a deliberate attack by humans. It shows something different: an AI agent with permission to run commands, while pursuing its assigned goal, may find several vulnerabilities and chain them together. This relates directly to how you grant permissions to your own AI agents, the subject of Part 4 on prompt injection and AI agents.
5. What do you need in place to patch in time?
To patch in time, your company needs answers to 5 questions before the next vulnerability is disclosed. This list is drawn from the 9 items the Financial Services Agency sent to financial institutions. That document applies only to the financial sector, but the logic works for any company with internet-connected systems.
- Which systems come first? Choose by business impact. The Financial Services Agency suggests giving top priority to internet-facing systems that support critical operations, such as internet banking.
- What software runs on those systems? You must be able to tell immediately where a patch applies. The agency calls cleaning up unneeded network ports, unneeded privileged accounts and unsupported products "resolving technical debt".
- Who patches, and is it in the contract? Check your maintenance contract with the vendor. Does it cover patching, are roles clearly assigned, and are nights and holidays covered?
- What do you do while a patch cannot be applied? Prepare alternative measures: block access, disable functions, increase monitoring.
- If the system has to stop, how does the business continue? Have a fallback procedure and backups that can actually be restored.
Two basics keep their full value. In version 4.0 of its "中小企業の情報セキュリティ対策ガイドライン" (information security guidelines for small and medium-sized enterprises), IPA added "backup" to its set of basic rules, making 6 rules. Multi-factor authentication for administrator accounts and external connections is still the cheapest layer of protection.
6. What is the software developer responsible for?
The software developer is responsible for two things: delivering products with fewer vulnerabilities, and telling the customer exactly what the system consists of. The Japanese government has named this group explicitly. The Project YATA-Shield package of May 18, 2026 calls on software vendors to find and fix vulnerabilities early across the whole development lifecycle. It bases this on the principle of secure by design (セキュア・バイ・デザイン).
VAON is a software developer, so this is VAON's own responsibility. Here is one example of the second task. In 2026 VAON developed an on-premise invoice and contract management system in-house. VAON scanned its entire source code to list every connection to external services. The result, measured on August 24, 2026, was 6 environment variables, all for sending email over SMTP.
That number is small, and that is the point. When a new vulnerability is disclosed, the operator needs to know within minutes whether its system is affected. The list of external connections and the list of libraries in use are the two documents that answer that question.
Three things to request from any developer, VAON included:
- A list of the libraries and versions used in the system.
- A list of outbound connections, with the reason for each one.
- Review and test records. At VAON, every project keeps these records and the customer can view them.
7. When is fast patching still not enough?
Fast patching is not enough in 3 situations, and your company should know whether any of them applies to it.
- The attacker logs in with a real account. When a password is stolen through phishing, there is no vulnerability to patch. This is covered in Part 2: phishing and deepfakes.
- The vulnerability has no patch yet. Only alternative measures and monitoring remain. The Financial Services Agency calls its measures temporary, and names automating vulnerability handling as the medium to long-term direction.
- Nobody is watching outside business hours. Attackers spread inside the network after an average of 29 minutes. A company that needs continuous monitoring should hire a provider that specializes in security monitoring. VAON does not provide this service.
Want to know which libraries and external connections your running system contains? VAON reviews the source code with you, builds the lists and points out what to prioritize. Book a free consultation
Next in the series: Prompt injection and attacks on RAG systems and AI agents
References (checked Oct 10, 2026)
- 金融庁, 日本銀行, 「フロンティアAIによる脅威変化を踏まえた金融機関等の短期的な対応」に係る要請について (May 22, 2026): https://www.fsa.go.jp/news/r7/sonota/20260522-5/20260522.html
- 警察庁, 令和8年上半期におけるサイバー空間をめぐる脅威の情勢等について (September 2026): https://www.npa.go.jp/publications/statistics/cybersecurity/data/R8kami/R08_kami_cyber_jousei.pdf
- CrowdStrike, クラウドストライク2026年版グローバル脅威レポート：AIによって加速する攻撃者 (press release, Mar 19, 2026): https://www.crowdstrike.com/ja-jp/press-releases/2026-crowdstrike-global-threat-report/
- UK AI Security Institute, Our evaluation of Claude Mythos Preview's cyber capabilities (Apr 13, 2026): https://www.aisi.gov.uk/blog/our-evaluation-of-claude-mythos-previews-cyber-capabilities
- Hugging Face, Security incident disclosure (July 2026) (Jul 16, 2026): https://huggingface.co/blog/security-incident-july-2026
- OpenAI, Hugging Face model evaluation security incident (Jul 21, 2026): https://openai.com/index/hugging-face-model-evaluation-security-incident/
- Anthropic, Disrupting the first reported AI-orchestrated cyber espionage campaign (Nov 13, 2025): https://www.anthropic.com/news/disrupting-AI-espionage
