AI Didn't Make Cyberattacks New — It Made Them Cheap

• 600 disclosed breaches hit Japan from January through September 2026 — the fastest pace on record.
• Every disclosed entry point was old news: known vulnerabilities, stolen credentials, exposed vendors.
• AI changed the economics, running recon through exfiltration while humans decided only a handful of times.
• Mid-size organizations attackers once skipped became profitable targets.
• Defense priorities stayed the same — what disappeared is the time to delay them.

Disclosures from late September into early October spanned different industries and different sizes of organization, but the entry points didn't vary. A government operations platform saw attackers exploit a vulnerability in the VPN appliance used for outside maintenance, with a possible leak of roughly 246,000 staff records. Five companies — including securities firms and a watchmaker — reported unauthorized logins to the admin panel of the same shared FAQ system they used for customer support, with inquiry records potentially exposed. A survey platform saw members' loyalty points converted into gift codes without their consent. None of this required a sophisticated technique to find — it required only effort, and effort is exactly what got cheaper.

What ties these cases together is that attackers walked through open doors instead of breaking down walls. Unpatched devices, reused credentials, vendor-run systems that sit outside a company's own monitoring — these are the weaknesses covered on the first few pages of any security textbook, not novel techniques.

What was abnormal was the rate of increase. Multiple security firms flagged a surge in incidents starting in July, and investigators quoted in coverage noted that hacking used to require specialized skill — AI removed that requirement. The weaknesses stayed exactly the same while the incident count spiked. That mismatch is what the economics of attack explain.

To an attacker, an attack is an investment. Researching a target, finding a weakness, breaking in, locating valuable data, and getting it out — that chain of work used to require a skilled person's time. Attackers spent that time on targets where the payoff justified it: large enterprises, financial institutions. Mid-size organizations stayed relatively safe not because their defenses were strong, but because attacking them didn't pay.

AI broke that assumption. A report Anthropic published in November 2025 described a state-linked group using AI agents to run 80–90% of an attack's workflow, with humans stepping in to make a decision only 4 to 6 times per operation. Anthropic's September 2026 threat report goes further, concluding that "sophisticated attacks no longer require a sophisticated attacker."

When human labor time collapses toward zero, cost per attack collapses with it. Targets that used to be unprofitable become viable. Instead of spending months stalking one large company, an attacker can scan thousands of weaker organizations automatically and exfiltrate from whichever one opens first. The targeting logic itself changed — that's where fall 2026 stands.

This is why the entry points in the previous chapter look old while the incident count looks new. The vulnerability hasn't changed. The math behind deciding whether to exploit it has. Reconnaissance that once meant a team spending weeks mapping which of ten thousand companies run an unpatched VPN appliance can now run continuously, all day, across every target in range — and that is precisely the labor cost that collapsed.

The same threat report breaks down exactly which stage of an attack AI handled.

Start with key collection. One criminal group automatically downloaded and analyzed roughly 1.8 million public Android apps, extracting API keys and auth tokens embedded inside them. Keys developers assumed were safe because they sat inside a compiled app got harvested mechanically, at a scale no human team could match.

Next came post-breach expansion. The same report describes an intrusion that escalated from a single stolen developer token to full administrative control of the victim's cloud environment in about three hours — investigation and privilege escalation that would take a human team days, finished in hours. In a separate case, an attacker who breached a SaaS provider went on to pull data from roughly 200 of its downstream customer organizations. One way in became the way into many organizations beyond it.

Then came adaptation against defenses. A separate attack group ran malware that automatically rewrote and redeployed itself through AI whenever a security product flagged it. Defenders couldn't write detection rules faster than the attacker could change shape. Vulnerability hunting followed the same pattern — one group pointed AI at device firmware repeatedly and surfaced more than 10 unknown vulnerability candidates in a single month.

One caveat matters here: as of October 2026, no individual domestic incident has been confirmed to involve AI. Reporting that links Japan's cases to AI is an inference from the surge in incident count and from confirmed cases overseas, not a confirmed fact about any one breach. What is consistent, without requiring that inference, is this: the entry points disclosed in Japan are exactly the category of old-school weakness that AI has made cheap to find and exploit.

Hearing that AI-driven attacks are rising tempts a reasonable-sounding but wrong conclusion: that the fix is a new AI-powered defense product. Since the entry points are old weaknesses, the first moves stay exactly what they always were. What changed is how long you can afford to wait before making them. A weakness that used to sit quietly for years, written off as "maybe someday," now gets found within a short window of being exposed, because the scanning that finds it is automated too.

A realistic priority order looks like this. First, protect credentials: never write keys into code or documentation, require a second factor such as a passkey on every admin login, and scope permissions narrowly by use case rather than broadly by convenience. Second, patch known vulnerabilities fast — an internet-facing device like a VPN appliance turns a delayed update directly into an open door. Third, inventory every entry point, including the ones you don't operate yourself: an admin panel run by a vendor is still your entry point.

Fourth, build the ability to notice an intrusion once it happens. In several of this round's incidents, detection took weeks to months after the breach itself. Logging who read how much data, and flagging reads that run well above normal volume, keeps a breach from running undetected long enough to become a disaster. Fifth, stop holding data you don't need — years of stored ID-document images can't leak if you never kept them.

One more thing matters as much as the list itself: usability. Push security too hard and the field finds a workaround — a password rule that's too strict gets written on a sticky note, an approval step added on top of another becomes a rubber stamp. A passkey that only needs a fingerprint or a face works precisely because secure and easy point the same direction. Choosing that kind of setup, where the safe path is also the convenient one, turns out to be the strongest defense available.

Here is how the defenses above are built into OS iXanagi, the system we make. Not promises to be careful — only what the system itself enforces.

Protect the keys. Keys for payments and outside services are stored sealed with strong encryption. Writing a key into the code is forbidden, and automated checks look for it. Keys handed to outside tools such as a browser extension can be narrowed to what they may do, which brands they reach and when they expire. When the owner's role is lowered, the keys that person issued weaken with it.

Narrow the way in. Apart from the entry points deliberately made public, no request gets through without signing in. Which company's data a request touches is decided by the signed-in person's membership, not by what the request says. Loading a page never reaches into internal network addresses, and the number of requests in a short time is capped at the door.

Don't hand the AI too much power. The AI drafts and proposes, but sending, publishing, money and deletion happen only with a person's approval, or within a scope, budget and time limit a person delegated. What runs after approval is fixed code, not the AI. Who asked, what the AI did and who approved it are all recorded.

Don't keep what you don't need. Audio recordings are not kept once transcribed, and the data you entrust is never used to train AI.

To be able to say these defenses work, we attack the system ourselves and record that each attack was stopped. Some things no design fully prevents — a large flood of traffic, or a sign-in credential leaking in the first place. We list those plainly on our security page.

If you're a consumer, three things help right now: stop reusing passwords, turn on passkeys or two-factor authentication everywhere it's offered, and treat any email or text claiming to be from a company that just disclosed a breach with suspicion. A leaked name and email address becomes raw material for the next scam, not the end of this one.

If you run a small or mid-size organization, start by listing every door reachable from outside: VPN appliances, remote desktop access, cloud admin panels, and any system a vendor operates on your behalf. For each one, check three things — is it current, does the admin login require a second factor, and who's actually responsible for it. That check alone would likely have prevented a number of this round's incidents.

If you're a developer, scan your own repositories and apps today, by machine, for embedded keys. Attackers are already doing that search by machine, and they don't need to sleep. When you find a key, don't just delete it — revoke it. A key that was ever published stays usable in someone else's hands even after you remove it from your code.

The next chapters in this series take each of these weak points in turn and go deep on what gets exploited and how to close it.

Was this round of domestic breaches actually AI-driven?

As of October 2026, no individual domestic incident has been confirmed or disclosed as AI-driven. AI's involvement is inferred from the surge in incident count and from confirmed cases overseas. That said, the disclosed entry points match exactly the kind of attack AI is well suited to automate.

Does defending against AI-driven attacks require AI-driven defense?

It has its uses, but it isn't the priority. Since entry points are known vulnerabilities and stolen credentials, what's needed first is the basics: patching, stronger authentication, least-privilege access, and detection. AI-driven defense pays off on top of that foundation, not instead of it.

Are small and mid-size companies really targets now?

Yes, increasingly. AI has driven down the cost per attack, pulling in organizations that used to be unprofitable targets. Size isn't the selection criterion — an open door is.

Where should we start?

List every externally reachable entry point — VPN, remote access, cloud admin panels, vendor-operated systems — and check whether each one is current and whether admin logins require a second factor.

• Trend Micro research, via Kyodo News, "Domestic unauthorized access incidents on pace for a record high," 2026-10-06
• NHK, "Why do personal data leaks keep happening? 'An unusual situation,' with possible AI misuse flagged," 2026-10-06
• Anthropic, "Countering misuse of AI: September 2026" (2026-09-10)
• Anthropic, report on AI-orchestrated cyber espionage (2025-11)
• Digital Agency, "Notice regarding a possible personal information leak from unauthorized access to the Government Solutions Service," 2026-09
• ITmedia NEWS, "Citizen Watch: vendor breach may have leaked personal data of roughly 100,000 people," 2026-10-06
• Monogatari Corporation, "Apology regarding a possible personal data leak from third-party unauthorized access to the 'Yakiniku King' official app member management system," 2026-10-05