Security researchers have disclosed three cyber attacks targeting organisations in Japan in which artificial intelligence was used either to drive parts of the operation or to support a human operator. In one case, the researchers said the attackers used 44 AI agents to automate elements of the hacking workflow.

The report is based on analysis of three exposed server environments that researchers say were used by threat actors during the attacks. While the activity was observed in Japan, the broader significance for European businesses is that attackers appear to be testing more automated, scalable ways to run cyber operations.

What happened

According to the researchers, the investigated infrastructure was linked to three separate attacks against organisations in Japan. The researchers said AI played a central role in the operations, either by coordinating tasks or by assisting human operators.

Based on the source material available, the claim that one operation used 44 AI agents comes from the researchers' analysis and should be understood as a research finding rather than an independently verified industry-wide pattern. Even so, it points to a practical trend: cybercriminals may increasingly use AI tools to speed up reconnaissance, content generation, targeting, workflow orchestration and post-compromise activity.

Why it matters for European businesses

For European companies, the most important issue is not the geography of the attack but the operating model behind it. If attackers can automate more of their workflow with AI, they may be able to launch campaigns faster, personalise phishing content more convincingly and scale attacks across more targets with less manual effort.

This has several business implications:

• Faster attack cycles: Automated tooling can reduce the time between reconnaissance and attempted compromise.
• More convincing social engineering: AI can help generate messages, lures or fake content that are harder for staff to recognise.
• Higher attack volume: Smaller and mid-sized businesses may face more opportunistic attacks if the cost of running campaigns falls.
• Pressure on detection teams: IT and security teams may need to monitor for more varied and rapidly changing attacker behaviour.

The development is also relevant for companies adopting AI internally. Businesses increasingly use AI agents and workflow automation for customer service, marketing and operations. That makes governance, access control and monitoring more important, because the same automation principles that improve productivity can also be abused by attackers.

Who may be affected

The immediate targets in the reported cases were organisations in Japan, but the lessons are broader. European businesses that may be most affected include:

• SMEs with limited security resources, because they may be easier to target at scale.
• E-commerce companies, which often rely on multiple connected systems, customer accounts and payment-related workflows.
• Marketing and sales teams, which are frequent targets for phishing, brand impersonation and account takeover attempts.
• IT and digital teams, especially those managing exposed servers, cloud workloads, SaaS integrations and identity systems.
• Companies in regulated sectors, where a compromise can trigger compliance, reporting and operational risks.

What companies should consider

The report does not by itself create new legal obligations, but it does reinforce the need for practical cyber hygiene and incident readiness. European businesses should consider:

• Reviewing externally exposed systems to reduce unnecessary attack surface and identify misconfigurations.
• Strengthening phishing defences with staff awareness, email protections and clear reporting processes.
• Using strong identity controls such as multi-factor authentication, least-privilege access and regular credential reviews.
• Monitoring unusual automation patterns in logs, cloud environments and user behaviour that could indicate scripted or AI-assisted activity.
• Testing incident response plans so teams can react quickly if a campaign moves faster than traditional attack patterns.
• Applying governance to internal AI tools by limiting access, defining approved use cases and monitoring integrations with sensitive systems.

For business leaders, the key takeaway is straightforward: AI is not only becoming a productivity tool for legitimate organisations, but also a force multiplier for attackers. Companies do not need to assume every threat is fully autonomous, but they should plan for more scalable, faster and more adaptive cyber campaigns.