International AI Safety ReportMalicious use§2.1.3
Criminals and state hackers use AI in cyberattacks
Seen in real incidents87 matching case files
The warning
There is strong evidence that criminal groups and state-backed attackers use AI in their operations, especially to find software flaws and write malicious code, though it is not yet clear whether AI has made attacks larger or more damaging overall.
Paraphrased from the source. Source: International AI Safety Report 2026, Feb 3, 2026, section 2.1.3, page 57. Summary by International AI Safety Report: internationalaisafetyreport.org.
What the registry shows
Matches the registry closely: AI-written ransomware and stealers, malware that asks a model what to do while it runs, and state groups using chatbots for reconnaissance, phishing and exploit work. Like the report, the case files show use, not overall effect.
Verified case files show this risk happening in the real world. First real-world case on file: Jan 10, 2025 · Already on file when this research was published.
Matching case files per quarter
Seen in real incidentsLab test or researcher demonstration
Status history
| Date | Status | Matching case files | Change |
|---|---|---|---|
| Oct 18, 2026 | Seen in real incidents | 87 | Tracking starts |
Tracked since Oct 18, 2026. A line is added when the status changes, when the first real-world case is linked, and once a month, so the record shows when a warning moved from research to reality. research_history.json
All matching case files
- Hundreds of AI agents exploit PaperCut NG/MF servers to steal Windows credentials
- Storm-3168 runs agentic Azure attacks via compromised service principals
- AI-powered espionage campaign targets government Linux infrastructure
- AI agent carries out multi-stage data theft in Spain's first AI-powered breach, per AEPD
- US advisory: attackers use AI-generated exploit scripts against exposed Siemens S7 PLCs
- Unknown actor uses AI-driven ARTEX against South Korean finance
- Aurora ransomware operators abuse Cursor Agent AI for reconnaissance and exploitation
- ChatGPT feature abuse paired with ClickFix delivers trojan to users searching via Google
- ClaudeFix: shared Claude chats used to deliver ClickFix malware instructions
- Talos finds CLOSEDQUORUM, first reported autonomous AI C2 implant
- Agentic AI attack exploits Zammad zero-days against Dutch vulnerability disclosure institute
- Meta AI model exploits third-party security flaw during evaluation
- New NGate variant hides in trojanized NFC payment app, possibly built with AI
- RatHat malware C2 panel uses AI to build malware and rank victims across ~100 deployments
- China-linked TA419 impersonates AI experts to phish US AI policy insiders
- UAT-11985 uses AI-assisted event lures for Google AitM phishing in Taiwan
- Unit 42 investigates autonomous AI agent breach of enterprise network in hours
- Attackers use AI tools for data exfiltration against Latin American organizations
- GTG-10007: Chinese-speaking students run autonomous Claude exploit foundry against 50 orgs
- GTG-30006: Iranian accounts built phishing portals and SECOMS64 implant with Claude
- GTG-50029: lone French-speaking hacktivist breaches 14 European political entities
- Russia-aligned actor used AI agents to self-rebuild malware and steal ID records
- ShinyHunters affiliates use AI agents to dump 2,100+ Azure tokens from 40+ tenants
- Sandworm-linked cluster used Gemini to write password-spraying scripts against Ukraine
- SilkParasite: China-nexus Central Asia espionage with AI-assisted lures and RAT code
- NSA, CISA, FBI warn of AI-generated scripts probing Siemens S7 PLCs as fake OT monitors
- Trend Micro: APT passes AI agent off as authorised pentest to attack Southeast Asian org
- Trend Micro: Earth Krahang and Earth Naga fold generative AI into exploits and loaders
- TuxBot v3: Keksec-linked IoT botnet built with LLM help keeps safety disclaimers
- JADEPUFFER: LLM agent runs Langflow intrusion to database extortion end to end
- Chiba police arrest 19-year-old who built ransomware with AI after Asahi attack news
- Sophos finds ransomware-linked actor using Cursor and Claude agents to build EDR evasions
- Nimbus Manticore's MiniFast backdoor shows AI-assisted coding during Iran conflict
- GTIG intercepts first AI-developed zero-day: 2FA bypass in popular open-source admin tool
- North Korea's APT45 fed Gemini thousands of prompts to validate exploits and grow arsenal
- Russia-nexus CANFAIL and LONGSTREAM malware pad code with LLM filler to fool analysts
- PROMPTSPY Android backdoor lets Gemini drive the victim's screen and block uninstall
- PRC-nexus UNC2814 posed as C/C++ security auditor to get Gemini hunting TP-Link bugs
- Talos IR: public-sector credential theft via phishing page vibe-coded on Softr AI builder
- Unit 42: Go dropper asks GPT-4 whether to deploy Sliver based on host telemetry
- AI-generated ClickFix sites on typosquatted domains deliver SmartRAT
- Microsoft: North Korea's Coral Sleet runs agentic AI workflow from lures to payload tests
- HP Wolf: AI-generated 'vibe-hacking' infection scripts slip past email gateways
- Iran-nexus Dust Specter hits Iraqi officials with malware showing generative AI traces
- Hacker uses Claude to breach Mexican agencies and steal 150GB of tax and voter data
- COINBAIT crypto-exchange phishing kit built with Lovable AI app builder
- Google: state hackers use Gemini across all attack stages; 100K-prompt extraction try
- HONESTCUE loader asks Gemini to write fresh C# second-stage code and compiles it in memory
- CERT-FR: 42 attacker groups actively use generative AI, none yet autonomous against France
- VoidLink cloud malware framework found to be built mostly by an AI agent
- Unit 42 tests WormGPT 4 and KawaiiGPT, criminal LLMs that write ransomware scripts
- Chinese state group used Claude Code to run largely autonomous espionage
- China-nexus actor bypassed Gemini refusal with CTF pretext to get exploitation guidance
- Iran's MuddyWater leaked C2 domain and encryption key to Gemini while debugging malware
- Google flags PROMPTFLUX and other malware that call Gemini at runtime
- QUIETVAULT stealer uses local AI CLI tools to hunt secrets and leaks GitHub and npm tokens
- SesameOp backdoor used OpenAI Assistants API as covert command-and-control for months
- Kaspersky: BlueNoroff GhostCall and GhostHire campaigns sped up by generative AI
- North Korea-linked cluster used ChatGPT for C2 tooling in phishing of Seoul's diplomats
- Russian-speaking criminals assembled RAT and credential stealers from ChatGPT snippets
- Scam networks in Cambodia, Myanmar and Nigeria used ChatGPT for investment-fraud personas
- UNK_DropPitch used ChatGPT to craft phishing and tooling against Taiwan's chip sector
- Microsoft blocks phishing campaign using LLM-generated obfuscated SVG files
- SentinelLABS finds MalTerminal, GPT-4-driven malware generator likely predating Nov 2023
- Kimsuky uses ChatGPT-forged South Korean military ID in spear-phishing
- Lone criminal sold Claude-built ransomware variants on forums for $400 to $1,200
- Claude Code used to automate data extortion against 17 organizations
- ESET finds PromptLock, ransomware that uses a local gpt-oss model to write scripts · Lab test or researcher demonstration
- Proofpoint: Lovable AI builder abused for Tycoon MFA phishing hitting 5,000+ organisations
- AI-written npm package @kodane/patch-manager drains Solana wallets after 1,500 downloads
- LameHug: APT28-linked malware queries Qwen LLM to generate commands
- GLOBAL GROUP RaaS deploys AI chatbot negotiators to press seven-figure ransoms
- Cato CTRL: new WormGPT variants are jailbroken wrappers on Grok and Mixtral
- ScopeCreep: Russian-speaking actor built Windows malware with ChatGPT throwaway accounts
- VAGue Focus: China-linked accounts used ChatGPT to social-engineer US officials and press
- OpenAI bans APT15 and APT5 accounts using ChatGPT for pentest automation and US recon
- Wrong Number: Cambodia task scam used ChatGPT to translate SMS lures into six languages
- FBI warns AI-voice vishing campaign impersonates senior US officials to hijack accounts
- Anthropic bans actor using Claude to build IoT security-camera credential scraper
- Novice coder grows doxing toolkit and evasive malware builder with Claude's help
- Recruitment-fraud ring used Claude to polish fake hiring-manager lures in Eastern Europe
- AkiraBot uses GPT-4o-mini to spam 80,000 websites through contact forms and chat widgets
- Xanthorox AI: self-hosted five-model criminal platform marketed as WormGPT killer
- Cambodia-based romance-baiting scam used ChatGPT to generate multilingual social lures
- Kimsuky and BlueNoroff used ChatGPT to debug RDP brute-force code and research intrusion
- GhostGPT: uncensored chatbot sold on Telegram to write malware and phishing for criminals
- Check Point: FunkSec ransomware group built its Rust encryptor with AI assistance
The same case files in other research
- Seen in real incidents AI makes cyberattacks easier, faster and larger · CAIS · 87 shared
- Seen in real incidents Malicious actors and misuse · MIT AI Risk Repository · 87 shared
- Seen in real incidents People will set AI agents loose to cause harm · CAIS · 15 shared
- Seen in real incidents Every AI system tested could be jailbroken · UK AISI · 5 shared
- Seen in real incidents AI developers' own safety measures fail · CAIS · 1 shared
- Seen in real incidents AI system safety, failures and limitations · MIT AI Risk Repository · 1 shared
Warnings from other sources that link to some of the same case files.
Other warnings in this group
- Seen in real incidents AI-made fakes fuel fraud and extortion
- Early signs AI content is used to sway what people believe
- Seen in real incidents AI runs more of each attack, short of full autonomy
- Nothing on record yet AI gives expert-level help toward biological and chemical weapons
- Seen in real incidents AI systems themselves become targets