Part 17 of a series on Japan’s cybersecurity blind spot. Start with the overview, Japan cyberattacks in 2026: what the breach wave reveals, or read the previous part, GMO’s own hackers saw it coming. The fix wasn’t fast enough..

Status as of 28 October 2026: the government’s emergency cybersecurity package has been announced but not published. The LDP proposal is a party recommendation, not policy. Sakana Sawara has not been released.

TL;DR: Japan’s answer to its breach wave is a homegrown AI model from Sakana, a ruling-party request for direct lines to OpenAI, Google, and Anthropic, an active cyber defence law that private companies cannot trigger, and an emergency package announced on 26 October with no published contents yet. All of them focus on finding flaws or hitting attackers. This autumn’s damage came from flaws that were already found: patches nobody installed, passwords stored where attackers could reach them, email domains anyone can forge, and software that stopped getting fixes years ago. Welcome the government’s efforts, but don’t wait for them. Every one of those fixes is already inside a company’s own authority.

In the week of 20 October, Japan made two announcements about artificial intelligence and cyber defence that, read together, say more than either does alone. On 26 October, Sakana AI, the Tokyo startup that Nikkei calls the country’s largest unicorn, said it would start pretraining its own AI model from scratch, provisionally named Sakana Sawara, with defence and cyber defence among the intended uses, to reduce Japan’s dependence on American and Chinese models. Six days earlier, the ruling Liberal Democratic Party’s cybersecurity headquarters had published a proposal titled “The eve of a cyber emergency: prepare for AI cyber saturation attacks”, which it handed to Prime Minister Takaichi on 23 October. Among many other things, it asks the government to open direct contact windows with OpenAI, Google, and Anthropic.

One plan is about building Japanese capability, and the other is about borrowing American capability. They look like opposites, but they share an assumption: that Japan’s security problem is a shortage of ways to find vulnerabilities. This autumn’s breach wave says otherwise. The flaws that have hurt Japanese companies and their customers this year were mostly found, published, and patched by someone, somewhere. What failed, again and again, was the step after finding: deciding who fixes it, doing the work, and accepting the cost of doing it now. That step needs people with the authority to act, and neither plan supplies them.

This is Part 17 of the series. Part 6 looked at what “sovereign AI” means when a digital minister’s response to a breach wave is a call to San Francisco. This part looks at what happens when the AI works, and the country still has to install the patch.

What Sakana is actually building

Sakana’s announcement deserves to be taken seriously, so it is worth being precise about it. According to Nikkei’s report, development starts in November, a small model is due in spring 2027, and a larger model follows, at a scale Sakana expects to run to several hundred billion parameters. Its current flagship product, Sakana Fugu, works by combining several existing AI models, some of them foreign, which is efficient but means its performance depends on models Sakana does not control. Sawara is meant to remove that dependence for sensitive uses. Sakana already has a contract with Japan’s Ministry of Defense, signed in July, to test AI for intelligence analysis, and Nikkei frames Sawara as a model that defence and cyber defence users can adopt because a Japanese company built it.

Nikkei is also candid about the gap. The same article notes that Sawara may be smaller than the leading American and Chinese models, and that the frontier moved again in October: an American analytics firm ranked Meta’s newest model and Moonshot AI’s Kimi K3.1 Pro above OpenAI’s GPT-6, and Moonshot’s model has 2.8 trillion parameters. Sakana is the biggest private AI company in Japan and still a fraction of the size of the companies it is measured against. Its own pitch is that it will win on efficiency and price rather than scale. That may be right. It is also a model that will arrive in 2027 into a problem that is happening now.

What the ruling party actually asked for

The LDP document is long, and most of it is reasonable. It is also the most honest description of Japan’s position I have seen from inside the government, because it says the uncomfortable things out loud. The full proposal calls the shortage of “top gun” security talent “a national Achilles’ heel,” and asks for a new pay and personnel system that breaks with what it calls the rigid civil service system, so the government can pay skilled people what they are worth on the market. It names “the so-called Mythos problem,” the risk that frontier AI models make attacks autonomous, and proposes a programme called Project YATA-Shield so that defenders use AI too.

Then come the parts that reveal the plan. The proposal asks for direct contact windows with OpenAI, Google, and Anthropic so their AI can inspect government systems, and goes further: it wants to establish AI that automates the fixing itself, applying the patch, not only finding the hole. For small and medium-sized businesses, which it describes as suffering a chronic shortage of security staff, it proposes a shared monitoring network that watches their systems around the clock “in place of human experts.” And it asks the internal affairs ministry to request that local governments identify all of their web systems, including ones that individual departments set up on their own and ones that contractors run. Read that last one twice. Before AI can patch anything, the proposal has to ask municipalities to find out what they own.

As the Yomiuri reported on 22 October, the government’s worry is speed. The PHP flaw was found by American companies using frontier AI, and an official told the paper that if attackers had found it first, “the damage could have reached all of Japan overnight.” Active cyber defence, the law that lets the government act against attack infrastructure, went fully live on 1 October for 15 critical-infrastructure sectors, but the Yomiuri notes that its limits on targets and procedures may leave it unable to keep up with fast, wide AI-driven attacks. The best defensive AI is American, and American companies restrict who gets it. Hence the request for a direct line.

Then the law met its first real test, and missed. On 27 October, as the GMO attacker began publishing customer data, Fuji TV’s evening news reported that GMO’s chief executive had asked the government to use active cyber defence against the attacker, whose extortion server is in the United States. It could not. The law covers 15 designated sectors, finance among them, and GMO is outside them. The Financial Services Agency had already confirmed customer losses at five FX brokers that ran on GMO’s system. The brokers were inside the fence. The company that ran the servers their trading depended on was not. Japan’s new law protects the bank and leaves out the company holding its keys. The law, as Kyodo noted, is not designed to be activated at the request of private companies. The next day, Prime Minister Takaichi told a ministerial meeting that the government would compile an emergency package of cybersecurity measures by the end of the following week and would “strategically take all response options, including neutralization measures.” That is a faster political response than Japan usually manages. It is still a response aimed at the attacker’s server, not at the unpatched ones.

Finding was never the hard part

Here is the problem with building the response around finding. The PHP flaws that took Japanese websites offline on 21 October were found in August by a security firm, Calif, using an OpenAI model in an audit OpenAI paid for, and found again independently weeks later by Wiz with help from Google and OpenAI models, Reuters reported. OpenAI called it “a new phase, where AI can find security bugs with internet-scale impact.” That is true, and it cuts both ways. If finding is becoming cheap and abundant, then a country’s advantage is no longer in finding. It is in how fast it can turn a finding into an installed fix across thousands of servers that belong to companies, municipalities, and the vendors they rent from.

That is exactly the step Japan struggled with. Part 13 asked who actually installs the PHP patch on a company’s server, and the honest answer for many Japanese organizations was a hosting company or a web vendor that nobody inside the client had a contract with for emergencies. Part 15 showed that the government’s answer to that problem is a request, which under Japanese administrative law nobody is obliged to follow. And Part 16 had the clearest example of a company that knew. GMO Group’s chief executive, Masatoshi Kumagai, wrote on his own blog that the company’s in-house ethical hackers had identified weaknesses before the attack, and that fixing them moved slowly because of worries about disrupting the service and because other work came first. GMO had the finding, from its own people, with no AI required. Nobody has shown that the weakness they flagged was the one the attackers used, but the pattern is the point: the finding existed, and the fix was deferred.

The third example is the one that should worry everyone, because nobody was attacked. At 6:47 on the morning of 23 October, SoftBank stopped sending emergency alert texts to SoftBank, Y!mobile, and LINEMO phones so it could deal with the PHP flaw. For about two days, those customers could not receive earthquake or tsunami warnings by text, and government and municipal evacuation alerts did not resume until 23:17 on 26 October, roughly 88 hours later. SoftBank told customers to install a disaster app in the meantime. That evening, NTT Docomo paused part of its own Area Mail service, including J-Alert missile warnings, river flood forecasts, and local evacuation notices, while keeping earthquake and tsunami warnings running, and restored it at 20:01 on 25 October. Both companies called it a precaution, and taking a system offline to patch it safely is a legitimate choice. But it shows the same gap from the other side. GMO kept a service running and deferred the fix. The carriers made the fix and switched off part of the country’s disaster warning system to do it. In both cases, the flaw was public, and nobody had planned how to patch the system while keeping it working.

A domestic model that finds vulnerabilities faster will lengthen that list. An American model that inspects government systems will lengthen it too. Neither changes who owns the list, who has the authority to take a service offline to fix it, or who pays for the hours. Those are management decisions, and in Japan they are mostly made by people who rent their engineers rather than employ them. The internal affairs ministry’s 2025 white paper found that only 35.7 percent of Japanese companies lead their own system development with in-house engineers, against roughly 80 to 90 percent in the other countries it surveyed. When the people who understand the system work for a vendor two contracts away, a finding becomes an email, the email becomes a quote, and the quote waits for a budget meeting.

It was never only the patch

PHP is the headline because it had a deadline and a Prime Minister. But a patch is one tool, and the breach wave keeps showing the same missing toolkit underneath it. Three pieces of it are cheap, decades old, and visible from outside.

The first is where passwords live. GMO’s attackers drained FX accounts using the brokerage passwords customers had stored on the cloud desktops GMO rented them. Studio, a Japanese website builder that can edit hundreds of thousands of sites, kept customers’ API keys alongside the key to decrypt them. Joshin’s second report on 26 October said up to about 230,000 subscription records included login IDs and initial passwords, the ones many people never change. Password managers, separate credentials for each service, and two-factor login are not new technology. They are the default in any organization that has thought about where its keys are.

The second is email and domain security. SPF lists the servers allowed to send a domain’s mail, DKIM signs each message so the receiver can tell it came from that domain unaltered, and DMARC tells receiving systems to reject mail that fails those checks. Together they stop criminals from sending mail that appears to come from a company’s own address. The internal affairs ministry’s own figures show that about 5.7 percent of mail-receiving .co.jp domains publish a policy telling receivers to reject or block forged mail, and 1.4 percent of local government .lg.jp domains. Three ministries asked card companies to do this in 2023. The setting takes minutes for whoever runs the domain. It does not stop lookalike domains or a hijacked real mailbox, but it closes the easiest door, and in a breach wave full of leaked names and email addresses, that is the door the phishing comes through.

The third is software that has quietly expired. When I checked the homepages of Tokyo Stock Exchange companies on the day of the PHP release, 167 of the 1,732 that answered announced their exact PHP version, and 99 of those ran a version PHP no longer patches. Thirty were still on PHP 5, which stopped receiving security fixes at the end of 2018. The same pattern holds for content management systems, plug-ins, and admin panels that were installed once by a vendor and never touched again. For those companies, the Prime Minister’s request to update was not a request they could meet that week, because there was nothing current to update to.

None of these gaps is new, expensive, or secret. Each has been in government guidance, vendor documentation, and this series for years, and each can be checked from outside in an afternoon. At some point a gap that old, that cheap to close, and that well documented stops being ignorance. It becomes a decision, made again every quarter that nobody fixes it. That is why the AI debate misses the point. A frontier model that finds a new flaw is impressive. It is not what is breaking Japan. What is breaking Japan is the missing toolkit, and nobody needs a model to find it.

The language excuse

On the same broadcast, a security executive explained why Japan is suffering so badly. Japan, he said, is being attacked far more than any other country, and the reason is AI: with AI, attackers can lay bare the vulnerabilities in websites that used to be protected by the Japanese language. You will hear some version of this all autumn. It is wrong, and it is the most dangerous idea in this story.

Japanese never protected a server. The PHP flaw sits in the software that runs the site, and that software is identical in Osaka and Ohio. An attacker scanning for a vulnerable version does not read the page, and neither does the AI that finds the flaw. GMO’s attacker came in through servers, not through prose. The one place language ever slowed attackers down was phishing, where clumsy Japanese gave scams away, and machine translation removed much of that barrier years ago: Google switched Japanese to neural translation in November 2016. Even then, the barrier was a cost for the attacker, not a defence anyone built. Nobody patched anything because the website was in Japanese.

The danger is not that the explanation is wrong. It is what the explanation does. If the Japanese language was the wall, then the breach wave is something that happened to Japan, a kind of technological weather, and the answer is more AI, more government, and more help from abroad. If the cause is unpatched servers, weaknesses that a company’s own engineers flagged and nobody fixed, and vendors nobody can reach at night, then the cause is inside the building and it has an owner. One story makes everyone a victim. The other assigns the work. It is not hard to see why the first one is popular.

It is also a pattern. A government that answers a critical flaw with a request, a company that defers the fix to protect uptime, and an expert who blames the attackers’ new tools for the defenders’ old gaps are all doing the same thing: moving the cause somewhere it cannot be fixed. The language did not protect anyone. It only protected the people who should have been patching from being asked why they were not. And as long as the explanation is AI, nobody has to answer for what the AI found.

Automating the patch is a confession

The LDP’s proposal to automate patching with AI, and to monitor small businesses “in place of human experts,” is the most revealing line in the document. It is not a bad idea in itself; automated patching is routine in well-run systems. But as a national strategy, it reads as a plan to substitute software for the people the system cannot produce, hire, or keep. It also assumes the thing Japan’s breach wave has shown to be missing: systems that someone understands well enough to let a machine change them. An automated patch applied to a server nobody has mapped, running software a vendor customized ten years ago, is how you turn a vulnerability into an outage. The organizations that can safely automate patching are the ones that already know what they run. The proposal itself concedes that many local governments do not.

So when people ask me how Japan will build something domestic when the talent and the understanding are not there, my answer is that the question is slightly wrong in a way that matters. The talent is not absent. It is not where the decisions are made, and it is not paid like it matters, which is the LDP’s own diagnosis. And the understanding that is missing is not understanding of AI. It is understanding of one’s own systems: what is running, who maintains it, and what breaks if it is turned off for a night.

The fair counterpoint

Sakana is evidence that world-class AI work can happen in Tokyo. Its chief executive, David Ha, led Google Brain’s research team in Tokyo, its chief technology officer, Llion Jones, co-wrote the 2017 paper that introduced the Transformer architecture behind today’s language models, and its chairman, Ren Ito, is a former Japanese diplomat, according to Sakana’s company page. Two of the three founders built their careers at Google before choosing to build in Tokyo, which is a point in Tokyo’s favour, not against it. A domestic model is also a reasonable hedge: the United States ordered Anthropic to suspend global access to its newest models for a time in June, and a country whose defence depends entirely on another country’s export decisions is exposed in a way that a smaller, worse, domestic model partly fixes. And the LDP proposal contains real teeth in places, including tougher enforcement by the privacy regulator when companies delay reporting or play down an incident.

None of that changes the order of operations. A model that ships in 2027 does not patch a server in 2026, and a contact window with an American company does not create a person inside a Japanese town hall who knows which systems the town owns.

Don’t wait for the package

Nippon TV News, 26 October, in Japanese: Prime Minister Takaichi orders an emergency cybersecurity package by the end of the following week. Video: 【高市首相】サイバー攻撃による被害相次ぐ中 来週中めどに緊急対策パッケージ取りまとめ指示 from 日テレNEWS.

I welcome every one of these efforts. I also tell my clients and associates not to plan around them. The emergency package was announced on 26 October and is due by the end of the following week, which means that as I write, nobody outside the government knows what it requires, who it covers, or how it will be enforced. Active cyber defence went live on 1 October and, by design, cannot be switched on at a private company’s request. The LDP proposal is a party recommendation. Sakana’s model arrives in 2027. And Japan’s record with security requests, which Part 15 covered, is that a request with no deadline, no count, and no owner mostly goes unanswered. Even a perfect package would reach a company’s servers months after the next flaw does.

That is not a reason for despair. It is the most useful fact in this story, because almost everything that would have made this autumn less painful is already inside a company’s own authority. Nobody needs a mandate to put passwords in a manager, publish a DMARC policy, retire PHP 5, write down which vendor fixes which system at 23:00, or decide in advance which services can go dark for a night. Attackers already have the same AI the government is asking for, and they do not wait for budget meetings. The only timeline a company fully controls is its own, and the companies that come through the next flaw well will be the ones that started before anyone told them to.

What would actually help

For the government, the useful version of this proposal is the boring one: deadlines, counts, and named owners. Require every ministry and local government to publish an inventory of its internet-facing systems and the company that maintains each one, by a date, and count the results publicly. Fund the people who would apply the fixes, not only the tools that would find the problems. Pay security staff at market rates, as the LDP asks, and give them authority over the systems they defend.

For a company, the useful version is smaller and starts today, with or without any AI. Know which systems you run on the internet, what version they are on, and who has a contract to fix each one on the night a patch drops. Decide in advance which services you will take offline to fix, so the decision is not made in a panic or deferred for another quarter. And when your own people, or a vendor, or an outside check tells you something is wrong, put a name and a date next to it. GMO’s lesson is that the finding is worth nothing until someone owns the fix.

This is the work I do. My Diagnostics engagement maps what a company actually runs and who is responsible for it, and the Domain Exposure Check shows, from public information only, what your domain already shows the outside world: email authentication, web server and PHP version exposure, and whether your vendors appear in the Cybersecurity Tracker. Neither needs a frontier model. Both are about the step that Japan keeps skipping.

Sources as of 15:00 JST, 28 October 2026. When the emergency package is published, this article will get a dated update.