Japan AISI reports Binance asset outflow after internal AI tool abuse

Japan’s AI Safety Institute (AISI), in its AI Information Bulletin covering information at 15:00 on 5 November 2026, reported Binance’s 4 November preliminary findings on a 29 October asset-outflow incident. It also summarised Google’s 3 November analysis of LLMJacking, in which some affected companies reportedly incurred cumulative AI usage charges of $1m before attackers were blocked.

The bulletin is informational, not a binding Japanese requirement. AISI’s disclaimer says its content does not represent the government’s official view. For firms using AI tools, however, the incidents identify concrete controls around credentials, permissions, spending limits, configuration changes and access logging.

Binance and LLMJacking incidents

According to Binance’s incident update, attackers posed as a fictitious company conducting recruitment interviews and induced employees to execute malicious code. After compromising their devices, the attackers misused an internal AI tool to extend the intrusion to another employee’s device and obtain credentials. They then used stolen credentials and other information to carry out unauthorised processing, resulting in assets leaving wallets.

Binance said it stopped withdrawals, worked with relevant authorities to freeze assets, rebuilt the affected wallet system and internal AI tools, and invalidated related credentials. It is also conducting additional verification with an independent security company and said it would strengthen controls based on the findings.

Google Threat Intelligence Group and Mandiant’s LLMJacking analysis describes attacks observed in 2026 at companies including financial and retail firms. Attackers used stolen API keys and cloud credentials to consume AI services heavily in victims’ environments or resell access. The usage costs were billed to the victims, with cumulative charges reaching $1m at some companies before access was disabled.

Google recommends tighter management of API keys and other credentials, least-privilege access for users and systems, limits on AI usage volumes and fees, and monitoring of configuration changes and access records. It specifically points to early detection of unauthorised AI-tool activation and suspicious API access.

The same AISI bulletin relays the UK National Cyber Security Centre’s view that AI is contributing more to the speed, scale and efficiency of conventional attacks than to the creation of entirely new attack methods.

UK agentic AI measures remain prospective

AISI also included the UK Department for Science, Innovation and Technology’s Agentic AI resilience measures, updated on 3 November. The UK government plans to consult on using powers in the Cyber Security and Resilience (Network and Information Systems) Bill to address incidents where regulated entities are unable to “adequately monitor or control AI agents”.

The proposal would cover four potential measures:

- security and resilience requirements, including agent monitoring and risk assessments;
- notification by reporting entities to other organisations affected by an agent’s actions;
- preservation of evidence about what the agent did and how operators tried to control it; and
- ministerial powers to commission technical reviews, request information and conduct tests after an incident.

These are proposed measures, not current duties. The government says they would be developed with industry and oversight authorities, then introduced through secondary legislation after Royal Assent. The Secretary of State would have to consult relevant persons, and each measure would require Parliament’s affirmative approval before coming into force.