A Japanese-led inquiry identified about 1,000 servers suspected of supporting AI-driven attacks on websites worldwide, underscoring that the investigation reaches well beyond Japan.
Kyodo News reported that Japan’s Computer Emergency Response Team Coordination Center (JPCERT/CC) conducted the probe with overseas cybersecurity firms. The suspected servers had been online since October, while JPCERT/CC began its investigation in early October. JPCERT/CC said it is tracking 600 to 700 of the roughly 1,000 servers.
JPCERT/CC said most servers hosted AI-powered platforms, including Artex, a penetration-testing tool, and appeared to search for weaknesses and attempt to steal configuration files.
Some servers accessible to the public also held software for inspecting smartphone apps and testing system security. Investigators suspect attackers used those tools to analyze apps and try unauthorized entry through connections that pass information between apps and outside systems.
Investigators also found traces of a programming-support tool from U.S. company Anthropic on one server. They viewed this as a possible sign that attackers had used AI to strengthen their operations.
JPCERT/CC analyst Ken Sajo said AI use in cyberattacks remains at an early stage and warned that attacks are likely to become more sophisticated. Kyodo’s account said advanced AI has reduced the time and specialist knowledge associated with hacking.
