Case certfr-genai-threat-2026State actor AI opsFrance
CERT-FR: 42 attacker groups actively use generative AI, none yet autonomous against France
ANSSI's CERT-FR published CERTFR-2026-CTI-001, a TLP:CLEAR synthesis reporting that 42 groups use GenAI such as Gemini for profiling, lures and malware, while no attack on a French entity is attributed to autonomous AI.
MediumAttack using AIStatus: OngoingVerified case file
Open in the interactive mapCite this case
- Reported
- Feb 4, 2026
- Location
- France
- Target
- French public and private entities
- Severity
- Medium
- Triggered by
- Multiple state-linked groups (China, Iran, North Korea, Russia)
- Actor type
- State-sponsored
- Reported loss
- None reported
- CVE
- None
What happened
ANSSI's CERT-FR published CERTFR-2026-CTI-001, a TLP:CLEAR synthesis reporting that 42 groups use GenAI such as Gemini for profiling, lures and malware, while no attack on a French entity is attributed to autonomous AI.
Impact: Advisory-level; documents attacker GenAI adoption across state groups and sets expectations for French defenders.
Who triggered it
Actor: Multiple state-linked groups (China, Iran, North Korea, Russia)
Attribution: CERT-FR synthesis of vendor and partner reporting; press coverage cites 20 Chinese, 10 Iranian, 9 North Korean and 3 Russian groups.
Motive: Espionage, fraud and sabotage enabled by AI productivity gains
How it happened
Attack vector: GenAI services used for reconnaissance, social engineering content and malware development; models also targeted via poisoning and data exfiltration
Root cause: Dual-use AI services are accessible to attackers at each stage of the intrusion chain
Timeline
- CERT-FR publishes CERTFR-2026-CTI-001 (12 pages)
- Report circulates publicly; press coverage breaks down the 42 groups by country
Response
ANSSI recommends regular reassessment and hardening of AI deployments; no specific French victim named.
Current status: Ongoing
Sources (open in a new tab)
Cite this case
CERT-FR: 42 attacker groups actively use generative AI, none yet autonomous against France. AI Threat Watch, case certfr-genai-threat-2026, Feb 4, 2026. https://aithreat.io/cases/certfr-genai-threat-2026/
Permanent link: https://aithreat.io/cases/certfr-genai-threat-2026/