Elusive Thoughts: 44 Agents and Single Attack Platform

TL;DROctober brought reports of attackers chaining AI agents, including a 44-agent platform used against Japanese organisations and ransomware affiliates whose model waits for a human before each step. Details are thin and mostly single-vendor. Plan for machine-speed chaining against exposed edge devices, shrink the management surface, alert on behaviour sequences, and put gates in the execution path, because those never needed anyone's cooperation.

Forty-four agents on a single attack platform. That is the figure TrendAI put on CyberStrikeAI after reading files its operator left in an open directory, and The Hacker News ran it on 27 October. The same month, ransomware affiliates were caught running a framework where the model plans an intrusion and then waits for a human to say yes.

I test systems for a living as a pentest consultant, so I read these reports with one question. Offence has orchestration now. What changes for the people defending?

What was reported, and by whom

CyberStrikeAI. It is an open-source security testing platform. TrendAI says an operator used it to split an attack across 44 agents, from reconnaissance through to automated reporting. At least 19 organisations saw validation activity, at least 16 of them in Japan, with Taiwan and Hong Kong also in the frame. The activity was concentrated in October. The 44 figure rests on TrendAI's analysis alone, and as far as I could find nobody has confirmed it independently.

Phantom. SOCRadar found it on exposed servers belonging to operators working with INC and The Gentlemen affiliates: 8,257 messages across 133 sessions. The products it went after included FortiClient EMS, SimpleHelp, cPanel and VPN gateways from several vendors. SOCRadar's own label for the structure is AI-executed and human-approved.

CrowdStrike. Its 21 October post covers four previously unreported actors who left their frameworks in open directories, with cases from May to August 2026. The agents made operational decisions and ran commands, and CrowdStrike says such intrusions can often reach their objective within an hour. I checked the primary post for attribution. It names Claude Code in the setups of three actors and in one of the fourth actor's two harnesses, which makes "all four used Claude Code" slightly too neat.

North Korea. Via BankInfoSecurity and Security Affairs, CYFIRMA suspects Korean-speaking operators linked to North Korea are scanning 216 hosts for the PHP2Shell flaws from 21 compromised machines. CYFIRMA's confidence in the Lazarus link is moderate, and it concedes a criminal group without state backing fits the evidence. Nothing in those write-ups mentions AI. I include it as the human-paced control sample.

The approval step cuts both ways

Phantom is the clearest case. Each campaign opens with a victim-specific master prompt telling the model to coordinate every action with the operator. The model drafts a step. Then it stops.

TASK Operator writes a victim-specific prompt. Model must coordinate every action with them.

↓

AGENT Plans the next step and generates the command. Machine speed.

↓

GATE / HUMAN APPROVAL The model waits. This runs at the speed of one person, who may be juggling several victims. Attacker bottleneck, and the only point where the chain has a human tempo.

↓

ACTION Command runs against an exposed edge or management system. Output goes back to the agent.

↓

LOOP Next step. Back to the gate.

That gate is the attackers' bottleneck. Everything around it runs at model speed, while the approval runs at the speed of an operator. The Cloud Security Alliance note infers that the design limits the cost of model errors and lets one operator run parallel intrusions. The source does not state those motives, so that is a guess.

It may also be a detection opportunity. This is my inference and no report measured it: if a person approves each step, activity against a target should show pauses at human tempo between stages, and pauses that line up across several targets in the same hour deserve a look. Do not build detection on that alone. The CyberStrikeAI write-ups describe no human role, and CrowdStrike's post describes oversight mainly as setup and tasking. The approval step is reported in one framework, so treat it as a bonus signal.

Assume machine-speed chaining at the edge

Every chain starts with something reachable. TrendAI's researchers, as relayed by eSecurity Planet, say AI multiplies the attackers' headcount while the job is still finding easy openings. So the useful work is boring. The CSA Phantom note says to take management interfaces off the internet, allowlist the management plane by IP, and give admins separate MFA-protected accounts. Credential reuse across VPN, RMM, backup and security consoles was a large force multiplier in the Phantom material. One stolen credential should not open four doors.

Detection changes shape too. CyberStrikeAI throttled traffic per target to stay under thresholds, according to the CSA note on TrendAI's report. A per-source rate limit sees nothing. Correlate low-frequency attempts across assets and over time, and alert on sequences. A new privileged account on a management server is a maybe. The same account followed by a modified VPN connection script is a story. Both items sit on CSA's Phantom hunting list.

Red team your own pipeline with agents

The next pentest I would commission is agent-driven, under written scope, pointed at your own pipeline and its controls. One question: which control only works if the caller behaves? A chained agent skips anything that asks nicely. A wiki page, an advisory check, a pre-commit hook anyone can bypass.

In my own stack the secret scan in pre-commit is advisory, and I never call it a boundary. The CI run is the control, because it blocks merge. The package proxy sits at shell level, so the agent does not know it is there. Unsigned pull requests do not merge and there is no override. The Willow gateway can allow, block, redact or escalate to a human, which is the attackers' approval step with one difference. I choose where it fires. I log tool calls and not prompts.

These gates survive an orchestrated attacker for the same reason they survive an analyst who has never heard of OWASP. They never depended on cooperation.

What I cannot tell you

Almost all of this is vendor research built from infrastructure operators left open. SOCRadar's exploitation counts come from operator records, and CSA knew of no independent confirmation. About 62 organisations were reportedly targeted and only four appeared on leak sites, with no payment records recovered. TrendAI found no evidence that its three Japanese cases share an operator. Because this picture exists through operator mistakes, careful operators are invisible in it, which makes it a floor and not a ceiling.

Verdict

The number 44 matters less than the pause. Orchestration raises the speed and breadth of chained attempts against whatever you leave exposed, and that is an exposure, patching and detection problem you already own. Stop treating the human approval step as comfort. It is an operator's queue, and it may leave a trace.

Fix the edge, alert on sequences, and put your gates where the agent acts. Any control that needs cooperation loses to a machine that never gets tired.

Sources

Elusive Thoughts

30/10/2026

44 Agents and Single Attack Platform