Japan will look for ways to get details of undisclosed software flaws early from US AI developers and other overseas tech companies, Nikkei reports, as Tokyo scrambles to respond to a spike in cyberattacks.
Tokyo’s emergency cybersecurity package is official. Prime Minister Sanae Takaichi ordered it on October 26th and aimed to have it ready around the following week, her office says. The plan to seek flaw details from foreign companies isn’t in her published remarks, and Nikkei‘s opening names no companies directly – for now.
In case you were unaware, hundreds of Japanese websites went offline for maintenance when the PHP flaws went public in October, while US sites tended to fix them behind the scenes. Official advice was much the same in both countries. Takaichi told site owners on X that temporarily taking a site down was one effective option if they couldn’t patch quickly, and the FBI gave the exact same advice.
Some companies had a head start. Wiz, one of the groups that reported the flaws, says it worked before public disclosure with Google Cloud, Cloudflare, AWS, Microsoft and others on detections and mitigations for anyone who couldn’t update right away. Meanwhile, security firm Calif reported a remote-code bug to PHP on August 11th, about 10 weeks before the fix shipped on October 21st, the PHP Foundation says.
OpenAI also reported the same root cause to PHP independently, the foundation says. Wiz says it used Gemini 4 Argon and GPT-5.6 Sol, and that frontier AI models turned a flaw more than a decade old into a working exploit.
An earlier Nikkei report says the government has asked Anthropic and OpenAI for greater access to advanced models used to find security weaknesses. However, that covers the models themselves, not flaw details.
Takaichi also told ministers to bring forward vulnerability checks of government systems using advanced AI, and to send information from hacked companies to the National Cybersecurity Office.
Adding Japan would widen a circle that has already slipped. The PHP Foundation says Calif mistakenly published a video of its exploit after the bug IDs began circulating, and that Chainguard, a distributor given the patch in advance, broke the embargo more than six hours early. So you can’t really blame Japan for asking for this – they’re just trying to get ahead of things in case it ever happens again.
