The report
TrendAI reports that a recovered multi-agent CyberStrikeAI framework supported reconnaissance, credential probing and attempted persistence against organizations primarily in Japan. The notable evidence is the attacker-side structure of the workflow, not a claim that every agent decision succeeded or every targeted organization was breached.
Three different levels of AI use
The technical report discusses multiple operators and campaigns. One recovered framework deployed dozens of cooperating agents and recorded attempts against at least 19 organizations. Separate material concerns an operator who sought help from an LLM while carrying out otherwise conventional exploitation. A further cluster includes scanning and script characteristics that suggest automation but do not independently establish model authorship.
Those distinctions matter. An agent creating a plan is one observation; tool output showing a shell or file read is another; victim logs confirming unauthorized access are stronger still. An attempted credential login can fail even when the workflow continues to describe the step as successful.
The canonical CyberStrikeAI Case therefore records the agent-led campaign without absorbing the other operators as one attributed intrusion. TrendAI does not establish that the recovered framework was operated by a particular Chinese state actor, and shared tradecraft or a common AI toolkit would not establish common control by itself.
What would change the assessment
A defensible escalation from attempted activity to confirmed compromise would require target-side authentication, web-shell, process or data-access records aligned with the attacker trace. AI involvement should be determined from actual model calls and delegated tool execution, not from code style or the fact that a script was generated quickly. These checks preserve the real significance of emerging agent-assisted offensive workflows without inventing downstream victims.