International AI Safety ReportMalicious use§2.1.3
AI runs more of each attack, short of full autonomy
Seen in real incidents17 matching case files
The warning
AI is taking over more steps of a cyberattack. At least one real attack was semi-autonomous, with people stepping in only at key decisions, but no fully autonomous attack from start to finish had been reported.
Paraphrased from the source. Source: International AI Safety Report 2026, Feb 3, 2026, section 2.1.3, page 57. Summary by International AI Safety Report: internationalaisafetyreport.org.
What the registry shows
The semi-autonomous case the report describes is on file: a Chinese state group that had Claude Code agents do most of an intrusion. The registry holds more intrusions described as run largely by AI agents with a human setting the goal, several reported after the report came out. Whether any was autonomous from start to finish rests on the investigators' own accounts.
Verified case files show this risk happening in the real world. First real-world case on file: Aug 27, 2025 · Already on file when this research was published.
Matching case files per quarter
Status history
| Date | Status | Matching case files | Change |
|---|---|---|---|
| Oct 18, 2026 | Seen in real incidents | 17 | Tracking starts |
Tracked since Oct 18, 2026. A line is added when the status changes, when the first real-world case is linked, and once a month, so the record shows when a warning moved from research to reality. research_history.json
All matching case files
- Hundreds of AI agents exploit PaperCut NG/MF servers to steal Windows credentials
- Storm-3168 runs agentic Azure attacks via compromised service principals
- AI agent carries out multi-stage data theft in Spain's first AI-powered breach, per AEPD
- Talos finds CLOSEDQUORUM, first reported autonomous AI C2 implant
- Agentic AI attack exploits Zammad zero-days against Dutch vulnerability disclosure institute
- Unit 42 investigates autonomous AI agent breach of enterprise network in hours
- GTG-10007: Chinese-speaking students run autonomous Claude exploit foundry against 50 orgs
- Russia-aligned actor used AI agents to self-rebuild malware and steal ID records
- ShinyHunters affiliates use AI agents to dump 2,100+ Azure tokens from 40+ tenants
- Mandiant case: AI agent built from one prompt harvests thousands of credentials in 6 hours
- Trend Micro: APT passes AI agent off as authorised pentest to attack Southeast Asian org
- JADEPUFFER: LLM agent runs Langflow intrusion to database extortion end to end
- Hijacked Ollama server used as brain of autonomous hacking pipeline
- Sysdig: LLM agent pivots from marimo RCE to internal Postgres dump in under an hour
- Microsoft: North Korea's Coral Sleet runs agentic AI workflow from lures to payload tests
- Chinese state group used Claude Code to run largely autonomous espionage
- Claude Code used to automate data extortion against 17 organizations
The same case files in other research
- Seen in real incidents People will set AI agents loose to cause harm · CAIS · 17 shared
- Seen in real incidents Malicious actors and misuse · MIT AI Risk Repository · 16 shared
- Seen in real incidents AI makes cyberattacks easier, faster and larger · CAIS · 14 shared
- Seen in real incidents Every AI system tested could be jailbroken · UK AISI · 1 shared
- Seen in real incidents Privacy and security · MIT AI Risk Repository · 1 shared
Warnings from other sources that link to some of the same case files.
Other warnings in this group
- Seen in real incidents AI-made fakes fuel fraud and extortion
- Early signs AI content is used to sway what people believe
- Seen in real incidents Criminals and state hackers use AI in cyberattacks
- Nothing on record yet AI gives expert-level help toward biological and chemical weapons
- Seen in real incidents AI systems themselves become targets