Teen Exploits Streaming Flaw, Cancels 46,812 Accounts

For engineers and security teams, this incident underscores a recurring pattern where accessible generative-AI tools accelerate creation of working exploit scripts, increasing the effective attack surface for online services.

What happened, According to The Japan Times, the Tokyo Metropolitan Police Department (MPD) arrested a 15-year-old high-school student from Tokorozawa on suspicion of obstructing business after an incident on Nov. 4, 2025 that reportedly canceled 46,812 accounts on the Bandai Channel video service. The Japan Times reports the MPD says the suspect sent falsified requests to a server managed by Bandai Namco Filmworks between 17:00 and 20:46 local time, which led the company to briefly suspend the service. The Japan Times reports the boy admitted to the allegation and told police he had no grudge against the operator.

The Japan Times reports the MPD said the teen identified a vulnerability by analysing company data traffic and used the ChatGPT chatbot to create a malicious program that automated account cancellations. Reporting adds that Bandai Namco Filmworks initially blocked the suspect's access, but the MPD alleges he continued unauthorized cancellations after changing his IP address about 30 times, and that the company reported the damage to police in November.

Companies and defenders have repeatedly seen low-effort, high-impact abuse when automation and weak access controls intersect. Public reporting frames this case as an example where an attacker with modest programming experience and AI-assisted code generation allegedly scaled disruptive actions rapidly against a consumer service.

Practitioners should note the technical vector reported here is not described in detail in the sources, but the observable pattern-automated scripted requests exploiting a vulnerability plus frequent IP switching-maps to common classes of abuse mitigations: input validation, authenticated action gating, rate-limiting, anomaly detection on account actions, and IP/identity hygiene. Industry deployments that rely solely on unauthenticated endpoints for account management have repeatedly been vulnerable to scripted abuse.

Observers should follow any follow-up reporting from law enforcement or Bandai Namco Filmworks for technical postmortems, indicators of compromise, and whether regulators or industry groups update guidance on AI-assisted exploit generation. Also monitor legal handling of minors in cybercrime cases and any vendor advisories addressing AI-assisted attack techniques.