Part 6 of a series on Japan’s cybersecurity blind spot. Start with the overview, Japan cyberattacks in 2026: what the breach wave reveals, or read Part 1, Part 2, Part 3, Part 4, and Part 5.

On 13 October, in the middle of the worst run of corporate data breaches Japan has seen, Digital Minister Toshiharu Furukawa sat down at the Digital Agency with Jack Clark, a co-founder of Anthropic, the American company behind the Claude models. According to Nikkei, the two sides agreed to cooperate on security, including the use of Anthropic’s advanced AI against the attacks. Furukawa asked that operators of critical infrastructure be given access to the company’s frontier model, reported Business+IT, and he asked Anthropic to consider building a data centre in Japan, according to Kyodo. The same day, the ruling Liberal Democratic Party hosted Anthropic executives and stressed cooperation between allies and American big tech. As a security decision, I understand it. Anthropic’s tools are among the best available for finding software vulnerabilities, and Japan needs help now. As a statement about who can actually do the work, it says more than any policy document the government has published this year.

I’m not writing this because the meeting was wrong. I’m writing it because the meeting is the clearest public evidence yet of what Japan Inc. actually is. By Japan Inc. I mean the alliance of large incumbent companies, ministries, and the politicians who protect them, and I’ve come to think of it as the operating system Japan runs on. It decides who gets hired, who gets promoted, who makes technical decisions, which vendors win contracts, and which industries are allowed to change. A nation’s talent is whatever its operating system can produce and use. Judged that way, this meeting was not a request for help. It was the operating system reporting its own output.

What sovereign AI is supposed to mean

Japan’s official position is not ambiguous. The Second AI Basic Plan, adopted by the Cabinet on 14 July 2026, lists “Create AI” as a pillar and defines it as building and deploying AI “to secure AI Sovereignty.” When the Digital Agency, the government body responsible for digitizing public administration, selected seven domestic language models for trial in its government AI environment in March, it said the purpose was to create stable demand for domestic AI and to secure “Japan’s autonomy in AI.” Public money backs this through programmes such as GENIAC, the economy ministry’s generative AI development scheme. The message to the public is consistent: Japan is building its own capability, and it will not be dependent on foreign platforms for something this important.

Some of that work is real. NTT’s tsuzumi and Preferred Networks’ PLaMo are described by their developers as trained from scratch in Japan, and Sakana AI, the Tokyo lab most often held up as proof that Japan is back, publishes original research. Individual Japanese engineers can build excellent things. The question is not whether a few people inside the country are capable. It is whether the system around them turns that capability into national strength, and on the evidence of this month, it does not.

What the domestic layer is built on

Look at what several of the “domestic” models actually are. Fujitsu’s Takane, one of the seven models the Digital Agency selected, is based on Command R+, a model from Cohere, a Canadian company, with Japanese training added on top. Another selection, Llama-3.1-ELYZA-JP-70B from KDDI and ELYZA, carries the name of the Meta model it is derived from. Sakana’s own API model, Namazu, is described on Sakana’s product page as built on Kimi K2.6, an open model from Moonshot AI in China, tuned with Sakana’s in-house data for Japanese business work. The same page states that Sakana cannot currently guarantee that data processing is completed entirely within Japan. Sakana’s flagship product for complex work, Fugu, is described by Sakana as a system that orchestrates “the world’s best models” behind a single API. In other words, its job is to route your request to someone else’s frontier model.

None of this is a scandal. Building on open models is efficient, and adapting a strong foreign model for Japanese is a reasonable business. But it means much of what is sold as sovereign AI is a Japanese layer on top of American, Canadian, and Chinese foundations. That is a perfectly respectable product. It is not sovereignty. And when the government faced a real emergency, it did not even use the Japanese layer. It went straight past it to the American company underneath.

Sovereign in location, not in capability

The data centre is the part that will be presented as a win for sovereignty. On 14 October, Kyodo reported that NTT is considering building Anthropic’s first core data centre in Japan, in southern Osaka, at a cost of roughly 1 trillion yen, noting that domestic facilities are seen as desirable from a national security perspective. Having the servers in Osaka matters for latency, data handling, and resilience. It does not change who owns the model, who controls the weights, or who decides which Japanese organizations get access to which capabilities. That would be sovereignty of location, not of capability.

We already know how access decisions are made. In June, the government and Japan’s three megabanks gained access to Claude Mythos, Anthropic’s restricted security model. The Japan Times reported that U.S. Treasury Secretary Scott Bessent had told Finance Minister Satsuki Katayama the access would be granted within weeks. A frontier security capability reached Japan’s financial system through a conversation between finance ministers. Close alignment with the United States may well be good for Japan, and I’m not against it. But a country whose most important new security capability arrives through an ally’s treasury should stop describing its position as autonomy.

Finding is not fixing

The most revealing line in this whole story came from Japan’s own regulator. In May, according to the same Japan Times report, the Financial Services Agency told financial institutions that if frontier AI uncovered a large number of vulnerabilities, they should prioritize and allocate resources strategically, because a short-term expansion of their IT departments was not feasible. Read that again. The plan is to buy a tool that finds problems faster than ever, while acknowledging that the teams needed to fix those problems cannot be expanded in the short term.

This is the outsourcing problem at national scale. In my previous article, I argued that the companies hit this month outsourced the work but not the responsibility: they handed systems to vendors they did not understand, kept tight control over decisions they were not equipped to make, and treated the result as someone else’s problem until it broke. Asking an American company to find Japan’s vulnerabilities follows the same pattern one level up. The finding gets outsourced. The fixing still has to be done by Japanese organizations, with Japanese staff, inside Japanese systems that have been neglected for years. No model, however capable, patches a router that nobody owns.

Who gets left out

Look at who is on the access list: the government, the megabanks, and, if Furukawa’s request succeeds, critical infrastructure operators. Those are the organizations best able to absorb a breach. As I wrote in an earlier part of this series, the companies most exposed are the small and mid-sized businesses that make up 99.7 percent of Japanese enterprises, many running old websites, shared logins, forgotten domains, and email with no authentication. They are not getting frontier models. They are getting the same breach headlines as everyone else and, increasingly, the attacks that run through them into their larger partners.

Nothing announced on 13 October touches that layer. The problem the breach wave exposed is not a shortage of clever detection at the top. It is ordinary neglect at the bottom: unpatched systems, unmanaged vendors, accounts nobody reviews, and leaders who regard their website as a business card rather than a live system. Japan Inc.’s answer to that problem is to bring in the most advanced tool in the world for the organizations that already have the most help.

Functionally, there is no Japanese talent

That heading is deliberately severe, so let me define it. Talent is not a trait people carry around. It is a function: capability that is developed, trusted with decisions, paid what it is worth, and put to work where it matters. Measured that way, Japan, at the level of global technology, functionally has no talent. Not because Japanese people lack ability. Japan could have had world-class technical talent, and it still could, perhaps the best in the world. But the operating system it runs on does not allow that potential to become function, and a nation’s talent is what it can actually field when the attack arrives. On 13 October, it fielded a phone call to San Francisco.

The evidence is in the government’s own data. The internal affairs ministry’s 2025 White Paper on Information and Communications found that only 35.7 percent of Japanese companies lead their own system development with in-house engineers, against roughly 80 to 90 percent in the other countries surveyed. Most Japanese organizations do not employ the people who build and run their systems; they rent them through layers of vendors and subcontractors. In the IMD World Talent Ranking 2025, Japan placed 40th of 69 economies on its ability to develop, attract, and retain highly skilled people. Engineers who are kept at the bottom of a subcontracting chain, rotated out of technical roles every few years, paid on seniority rather than skill, and overruled by executives who do not understand what they are approving do not become global-level talent. They become either compliant or gone.

Why does the operating system work this way? A clear account came out the same week from inside it. In a Gendai Business review of his new book on two decades of regulatory reform, Yutaka Fujiwara, a former economy ministry official who worked on reform under the Koizumi and Abe governments, describes incumbent companies, sector-aligned politicians, and bureaucrats forming small “villages” that protect their own interests, with regulation as the village rule. He argues that reform stalled after 2017 and that drones and autonomous driving, where Japan was competitive a decade ago, are where the cost is now most visible. Fujiwara is not a neutral witness: he helped design the reforms he is defending. But his village is the same machine I see from the client side. Protected incumbents face no pressure to modernize. Their systems age, their vendors stay, and the people who could fix things learn that fixing things is not what the system rewards.

This is why I find the usual defence, that Japan has plenty of talent and simply misuses it, too gentle. Misuse at this scale, sustained for decades, is not an accident layered on top of a capable nation. It is the design. An operating system that cannot produce people it trusts to defend its own networks has failed at one of its basic jobs, and the people paying for that failure are ordinary Japanese workers and customers, whose potential the system spends and whose data it loses.

The fair counterpoint

There is a reasonable defence of the government’s move. No Japanese model has been reported as matching Anthropic’s at finding vulnerabilities, and when attacks are landing daily, using the best tool available is responsible, not shameful. Allies share capabilities. The AI Basic Plan is also more layered than its slogans, combining domestic development with international cooperation. I accept all of that. The problem is not that Japan asked for help. The problem is that it keeps telling the public a sovereignty story that its own actions contradict, that the plan for acting on what the tools find is, by the regulator’s own admission, missing, and that nothing in the plan changes the operating system that made the call necessary.

There is a policy question underneath the security one, too. Jiji reported that the meeting covered AI regulation, including whether Japan should require incident reporting to AI developers, and that Furukawa called mandatory reporting “under consideration.” Rules shaped in consultation with a foreign supplier, for a capability Japan does not produce, are another form of dependence. Again, that may be the right trade. It should be made openly, not under the banner of autonomy.

What would actually help

Honest sovereignty would mean replacing the operating system, not buying applications to run on top of it. It would start at the bottom of the stack, not the top. It would mean paying engineers enough to stay, letting them make decisions rather than execute malformed ones, procuring by capability rather than by vendor size, and holding organizations responsible for the systems they run and the vendors they hire. It would mean putting as much attention on the millions of neglected small-company systems as on the megabanks’ access to a frontier model. None of that requires a trillion-yen data centre. Most of it requires leaders who are willing to understand what they own.

For an individual company, the lesson is simpler. No government agreement is going to fix your domain, your email authentication, your forgotten admin accounts, or the vendor who still holds your DNS. Those are cheap to check and cheap to fix, and they are exactly what this month’s attacks have been landing on. If you want to know where you stand, my external exposure check shows you what your company shows the outside world, using only public information and no testing of your systems.

Disclosure: I use Anthropic’s Claude models in my own work. That is part of why I take the capability seriously, and part of why I think it is worth being precise about what buying it does and does not make Japan.

The next part, Nobody had to hack Japan’s earthquake warning, looks at what the breach wave has done to trust in the alerts people depend on.

Sources