Attackers have started using AI: what Japan's recent breaches revealed

Short answer

In October 2026, JPCERT/CC, Japan's coordination centre for security incidents, said it had confirmed that attackers behind a wave of breaches in Japan used AI to scan for known vulnerabilities and to attack through APIs, the interfaces systems use to talk to each other. AI has not so much created new kinds of attack as made old ones faster, larger in volume and less selective about targets. What defenders need to do has not changed much, but basic fixes that were put off are now found and targeted sooner.

What was announced

• October 13: NICT warned of attacks that take apart publicly available smartphone apps and then attack the servers they connect to. It said AI makes app analysis and vulnerability hunting more efficient, so attacks may reach more systems.
• October 15: JPCERT/CC reported confirming that attackers used AI to scan for known vulnerabilities and attack via APIs. Services aimed at regions outside Japan were also targeted.
• October 23: JPCERT/CC updated its alert with attempts that misused AI-based penetration testing platforms, mainly against web applications exposed to the internet, probing for weaknesses and trying to steal configuration files and backups.
• October 26: a ministerial meeting on cybersecurity ordered the government to bring forward simulated attack testing and vulnerability checks of government systems using high-performance AI.

JPCERT/CC also notes that not every incident used the same method and that the information it has is limited and fragmentary. Reading this as "AI did all of it" goes too far.

What AI changes

When attacks take less effort, the range of targets widens. The alert mentions leaks even from internal systems that were never meant to be used by many people. Being small is no longer a reason not to be targeted. The first things to be hit are known vulnerabilities, old files left exposed, and APIs with weak checks.

Assume your app will be taken apart

NICT says to assume published apps will be analysed and to secure the servers behind them. JPCERT/CC recommends not embedding API secret keys or long-lived credentials in apps, and checking users and permissions on the server rather than relying on obfuscation. Even if the app itself has no flaw, weak checks on the server side can leak data. If you had an app built by a contractor, confirm this as the client.

What a small business should review

JPCERT/CC also recommends reviewing how you would notice unauthorised access and what you would do first. Ask your maintenance contractor where access logs are kept and for how long.