SoftBank Says AI Review Found 35,000 More Security Flaws After Earlier Repairs

A fresh scan exposes a much larger repair task

SoftBank found another 35,000 vulnerabilities in its systems during an artificial intelligence assessment, President Junichi Miyakawa said at a November 9 financial results briefing. The discovery came after the company had spent roughly three months fixing 10,500 weaknesses identified in an earlier review of about 700 internally developed systems.

Miyakawa identified the model used for the later assessment as OpenAI's GPT-6 Astra, which he described as its top model released in September. His account put the new findings at more than three times the number identified in the June assessment, leaving SoftBank with another substantial round of security work.

The disclosure followed a ransomware attack on subsidiary IDC Frontier. Miyakawa apologized for the incident and said the attack took seven minutes. SoftBank has since changed its response procedure: teams now cut communications first and investigate afterward, instead of waiting for a meeting to decide what to do.

A vulnerability is a weakness in software or a system that an attacker may exploit. A patch is a repair for that weakness. SoftBank's experience shows how demanding that repair process has become: its teams had completed one large batch of fixes when a newer assessment found thousands more problems.

Miyakawa, who said he had recently spent most of his time dealing with cyberattack countermeasures, described the strain at the briefing. In remarks translated from Japanese, the SoftBank president said:

Honestly, I am completely exhausted.

Hundreds of millions of attempts to find a way in

SoftBank's systems are facing roughly 600 million to 700 million reconnaissance attempts a month, according to figures presented in accounts of Miyakawa's briefing. He put the previous year's monthly average at about 300 million and said the number had been increasing by around 100 million each month since August.

Reconnaissance means looking for possible ways into a network, such as exposed services or vulnerable software. At 600 million attempts, the monthly volume would be twice the earlier average; at 700 million, it would be about 2.3 times as large.

Miyakawa attributed the rising pressure and faster attacks to the growing use of AI. He said models designed for cyberattacks began appearing around May and June, followed in July by models distributed with publicly available weights. Weights are the learned numerical settings that allow an AI model to operate.

New models were then appearing weekly, he said. Each time SoftBank tested its systems with another model, it found weaknesses that earlier checks had missed. That repeated discovery has turned vulnerability assessment into a continuing task rather than a review that ends when one list of repairs is complete.

Seven minutes changed the response procedure

IDC Frontier's ransomware incident gave SoftBank a concrete measure of the speed it was confronting. Miyakawa said the attack took seven minutes, leaving little room for the company's previous sequence of receiving an alert, gathering people and deciding on a response.

Ransomware is an attack in which criminals use access to systems or data to demand payment. Cutting communications can help isolate affected systems and limit an attacker's ability to move through a network. SoftBank's revised procedure puts that containment step ahead of the fuller investigation.

The change has a practical consequence for operations teams: a decision that previously followed discussion now comes at the beginning of the response. Staff must then investigate what happened and work out how to restore connections safely.

Why the first repairs left an entry point

IDC Frontier had completed assessments and patches for its internally developed applications before the attack, Miyakawa said. The open source application used as the entry point, however, had been left outside the assessment.

Open source software has source code that people can inspect, use and modify under its licence. Companies often combine it with software they build themselves. A security review therefore needs to cover the components a system relies on, as well as the code written inside the company.

Miyakawa said he had instructed staff from the outset to include open source software, but teams had postponed that work. The incident exposed a gap between the scope he had requested and the systems actually examined.

SoftBank has expanded its assessment programme from about 700 internally developed systems to more than 1,800 systems, including open source software. That is more than 2.5 times the original number, widening both the search for weaknesses and the work required to repair and test affected systems.

How the assessments and response unfolded

SoftBank's account describes several overlapping efforts: repairing its own systems, selling a security service to other companies and changing its procedures after the subsidiary's attack. The main dates explain how quickly the workload grew.

• May and June: Miyakawa said AI models specializing in cyberattacks began appearing.
• June 15: SoftBank assessed about 700 internally developed systems and identified 10,500 vulnerabilities.
• July: The company began full provision of Patching as a Service, using OpenAI technology to support assessments and repairs.
• August onward: Reconnaissance attempts increased by about 100 million each month, according to Miyakawa.
• Over roughly three months after the June assessment: SoftBank applied patches for all 10,500 identified vulnerabilities.
• September: Miyakawa said the model he identified as GPT-6 Astra was released; a subsequent assessment found another 35,000 vulnerabilities.
• October 30: Patching as a Service had 7,670 contracted companies.
• November 9: Miyakawa discussed the findings, the IDC Frontier attack and the revised response procedure at the financial results briefing.

The two assessments produced a combined 45,500 findings across successive reviews. SoftBank said it had repaired the first 10,500; the later batch created a new workload alongside the expansion of the assessment programme.

The final check still depends on people

SoftBank divides vulnerability management into three stages: finding weaknesses, applying patches and checking that systems work normally afterward. Its Patching as a Service operation uses AI to support the first two stages, with patch application automated.

The final stage still requires people. A repair can change how software behaves, so staff must check whether connected systems continue to work together. For a company running many linked applications, confirming normal operation takes considerable time.

Miyakawa has asked teams to automate that verification during the current fiscal year. He said there was no clear completion date, and the briefing account gave no completion schedule for repairing the additional 35,000 findings.

The remaining manual work helps explain why finding vulnerabilities faster does not automatically produce an equally fast repair cycle. SoftBank can use AI to generate a larger list of weaknesses and automate patching, while staff still need time to confirm that services remain usable after the changes.

For the 7,670 companies contracted to Patching as a Service as of October 30, this verification stage is part of the practical challenge. A patch must close a security weakness while allowing the customer's systems to keep doing their jobs.

Security pressure accompanies record financial results

SoftBank discussed the cyberattack response alongside record results for the first half of the financial year ending in March 2027. Revenue reached 3.7987 trillion yen, up 11.7% from a year earlier. Operating profit rose 2.1% to 642.1 billion yen, while net profit increased 4.5% to 364.5 billion yen.

The company raised its forecast for the full financial year to revenue of 7.9 trillion yen, operating profit of 1.16 trillion yen and net profit of 610 billion yen. Those figures show a growing business managing a security workload that its president said was absorbing much of his time.

The enterprise division, which includes corporate communications, cloud services, security and AI, generated revenue of 538.9 billion yen, an increase of 11.8%. Its operating profit rose 19.9% to 124.8 billion yen. Within that division, revenue from cloud and AI grew 36.7%, faster than enterprise revenue as a whole.

SoftBank also said its AI data center in Tomakomai, Hokkaido, was progressing toward opening during fiscal 2026. AI therefore featured in the briefing both as an area of business expansion and as a technology changing the demands placed on the company's security teams.

Other divisions also grew. Consumer revenue reached 1.6025 trillion yen, up 8.6%; media and e-commerce revenue was 894.7 billion yen, up 8.7%; and finance revenue reached 241.9 billion yen, an increase of 27.5%.

A broader task than finding more flaws

SoftBank's response now involves three concrete changes: examining more systems, isolating suspected attacks sooner and trying to automate the checks that follow repairs. Each addresses a different part of the problem described by Miyakawa.

The expanded assessment scope addresses the omission exposed at IDC Frontier. The communications cutoff responds to the seven minute attack. Automated verification, once completed, would address the time staff currently spend checking that patched systems still work together.

Miyakawa compared the current combination of systems built by people and advancing AI to a transition in which human drivers and autonomous vehicles share the road. For SoftBank, the immediate task is more specific: complete repairs, keep the wider software inventory under review and shorten the time between discovering a weakness and safely closing it.

Key Points

• SoftBank said a later AI assessment found another 35,000 vulnerabilities after it repaired 10,500 identified in June.
• Miyakawa identified the later assessment model as OpenAI's GPT-6 Astra.
• Monthly reconnaissance attempts reached roughly 600 million to 700 million, compared with an earlier average of about 300 million.
• An attack on IDC Frontier took seven minutes, prompting SoftBank to cut communications before investigating.
• The subsidiary's entry point was open source software excluded from its earlier assessment.
• SoftBank expanded its assessment scope from about 700 systems to more than 1,800.
• Patching as a Service had 7,670 contracted companies on October 30; checks after patching still required human work.
• The company reported record financial results and raised its forecast for the year ending in March 2027.