Japan to implement artificial intelligence for network vulnerability detection and countering hackers

Cyber threats, which are becoming increasingly sophisticated thanks to artificial intelligence, are forcing companies worldwide to respond to a wave of attacks. These attacks range from hacking refrigerators in supermarkets to large-scale cryptocurrency theft on the Binance platform and issues with widely used web software.

This surge in threats places a significant burden on IT departments, where employees are forced to work around the clock to eliminate software vulnerabilities. In response, some companies are beginning to increase investments in AI-based security tools to manage the increased workload.

A recent cyberattack on European supermarkets highlighted the urgency of the problem. It was the second such attack in three weeks, when hackers raised the temperature in refrigerators and freezers, forcing retailers to discard millions of dollars worth of products.

Marnie Wilking, Chief Security Officer at the service platform Booking.com, noted that the situation is an 'endless game of cat and mouse with very high stakes.' She added that even after blocking one route, attackers quickly move to the next, and hundreds of company engineers are now dedicated to developing AI-based defense systems.

According to the international registry of disclosed vulnerabilities, Common Vulnerabilities and Exposures, nearly 37,000 software or computer system vulnerabilities were registered in the third quarter of 2026, triple the figure from the previous year.

Marcus Noga, CTO of the German hosting company Ionos, which serves seven million customers, stated that events of this magnitude occur weekly or even every few days, whereas previously they happened monthly.

Ionos changed its security methods after a sharp rise in vulnerabilities in July, implementing AI-based monitoring systems to detect threats and using AI-supported tools to patch its systems around the clock.

Cyber threats drive up defense spending

Binance, which was hit by hackers who stole $6.3 billion in cryptocurrency, announced plans to increase investment in AI-enhanced detection systems. Port of Rotterdam is working on creating an AI-based 'cyber shield,' and Siemens is testing advanced AI models for defensive security.

The Dutch food retailer Ahold Delhaize, which manages Stop & Shop and Giant Food chains in the US, suffered two hacks in the last month. The first, in mid-October, led to a loss of over 200 million euros in revenue and triggered a profit warning.

As a result of this incident, Ahold shut down its websites and applications for a week after discovering the intrusion. This week, some of its stores in Belgium and Luxembourg were also victims of refrigerator cyberattacks across a dozen European countries.

CFO Jolanda Poots-Bijl stated that the company is adapting to the new reality, noting that small businesses are particularly vulnerable. She emphasized that AI is a defensive tool that helps detect threats and recover much faster than previously possible.

McKinsey predicts that the global market for third-party cybersecurity products and services will grow from $223 billion in 2025 to $346 billion by 2029.

AI tools help researchers reproduce hacks

Refrigerator attacks demonstrate how AI forces companies to promptly fix vulnerabilities once discovered, according to Sean Tufts, Field Technical Director at cybersecurity firm Claroty. Claroty published a study in August, several months before the attacks began, detailing weaknesses in refrigeration equipment controllers.

Following the first wave of attacks on stores in France on October 11, Claroty researchers used publicly available AI tools to reproduce these flaws and capture a test device, thereby highlighting the risk of further attacks. Tufts reported that they managed to recreate the attack for only $6 and 28 minutes.

The disclosure of two vulnerabilities in the PHP programming language, found using AI, on October 21, which underpins many websites, prompted governments and companies from Tokyo to Helsinki to temporarily take their sites offline as a precaution. In South Africa, the presidential administration took its site offline two days later 'as a preventive measure in response to a global cybersecurity event,' although it did not name PHP.

American internet infrastructure firm Cloudflare reported that attempts to exploit PHP vulnerabilities rose from thousands to millions within hours of their disclosure. The company noted that errors found with AI could lead to more future outages.

Kraft Heinz CEO Steve Kehlen stated that the threat is real and growing, emphasizing that cybersecurity is 'more important today than yesterday, and will be even more important tomorrow.' Holcim CFO Stephen Kindler supported this view. The Swiss building materials manufacturer took its website offline around October 21st at 9:30 PM to apply PHP patches and restored service by midnight. He noted: 'We need to get smarter. Both sides are well-equipped. Both sides use AI, and this race continues.'

With the development of artificial intelligence (AI), devices connected to the internet and exchanging data in the so-called 'Internet of Things' (IoT) can become a source of problems. According to a report by Anthropic published in October, AI-based malware can be installed on such devices and spread autonomously.

Computer viruses that move independently from one machine to another are known as 'worms'. They follow a predefined plan, utilizing known security vulnerabilities or poorly protected access points. Typically, solving this issue involves fixing bugs and closing gaps in the security system. However, in the case of AI-based 'worms', the situation becomes significantly more complex and dangerous.

This is because this more advanced type of 'worm' is capable of independently solving problems and adapting to different types of devices. Researchers at Anthropic, the developer of Claude, demonstrated that AI applications can function without the need for a large data center.

In a controlled test environment, researchers created simulations of eight Android devices. The tested AI model was installed on one of these devices, then copied from it and infected the others. In four out of five attempts, the model reached all eight targets, and in one, it infected seven.

If such an AI model were combined with malicious software, the 'worm' could learn to bypass security measures. According to Anthropic developers, this would take approximately one to two days. Furthermore, the AI could potentially connect infected devices into a botnet.

Although an infected device has limited computational capabilities, the more devices that are infected, the faster the 'worm' can spread. Connected devices can theoretically be disconnected from the network, and security vulnerabilities can be patched. Nevertheless, the decentralized structure of such malware will greatly complicate its localization.

Anthropic describes this type of infection as 'digital slime mold,' which grows slowly. The company believes that smaller AI models will be able to achieve this level of propagation capability as early as 2026.