SoftBank President Reports Discovery of Thirty-Five Thousand New Vulnerabilities Using GPT-6 Astra
November 12, 2026 · 3 min read
Also published in हिन्दी
The president of SoftBank disclosed that a diagnostic scan of the company's internal systems using the GPT-6 Astra model identified thirty-five thousand additional security vulnerabilities. This revelation occurred during a financial briefing held on November 9, 2026, where the executive addressed the escalating frequency and sophistication of cyberattacks targeting the corporation and its subsidiaries.
The executive explained that reconnaissance activities directed at SoftBank systems have doubled from a monthly average of approximately three hundred million incidents last year to roughly six hundred million recently. Since August, the volume of these probing attempts has increased by one hundred million each month. The speed of actual intrusions has also accelerated dramatically, with a recent ransomware attack against the subsidiary IDC Frontier completing in just seven minutes. Due to this velocity, the company has shifted its operational protocol from holding deliberative meetings after receiving warnings to immediately cutting off communications before attempting remediation.
A primary driver for this surge is the proliferation of artificial intelligence models specialized for cyberattacks. The president noted that AI models designed specifically for offensive operations began appearing around May and June, followed by the release of open-weight versions in July. New models continue to emerge on a weekly basis, and each time the company tests its systems against these newer iterations, previously undetected flaws are uncovered. The executive described the current situation as exhausting, acknowledging that future model releases will likely reveal even more weaknesses.
In response, SoftBank has deployed its own defensive artificial intelligence strategy through a service called Patching as a Service, which utilizes AI models from OpenAI to assist with vulnerability diagnosis and patch application. As of October 30, this service has secured contracts with seven thousand six hundred and seventy companies. Internally, the corporation applied this same methodology to approximately seven hundred of its proprietary systems on June 15, initially identifying ten thousand five hundred vulnerabilities that were patched over three months. However, the subsequent scan using the GPT-6 Astra model in September exposed the additional thirty-five thousand issues.
The scope of the diagnostic efforts has expanded significantly following the breach at IDC Frontier. While the subsidiary had applied patches to its proprietary code, the intrusion vector was an open-source software component that had been excluded from earlier scans. Although leadership had issued early instructions to include open-source materials, on-site teams had deprioritized this task. Consequently, the company now includes over eighteen hundred systems in its assessment roster, encompassing both proprietary and open-source software.
Despite these advances, full automation of the security workflow remains incomplete. The process involves three stages: vulnerability diagnosis, patch application, and verification of normal operation. While the first two stages are automated, the final verification step still requires human intervention to ensure that interconnected systems function correctly together. This manual confirmation consumes substantial time, and while management has requested full automation within the current fiscal period, no specific date for achieving this goal has been established. The president characterized the current era as a transitional phase similar to roads shared by human-driven and autonomous vehicles, describing it as a critical moment requiring persistent effort.