Skip to content
kevinferron.com

T3 · Security in the age of AI · Interactive, in your browser

What attackers are documented doing with AI

The documented cases, from one operator doing a team’s work to agents running a campaign, with what each report says it cannot see.

What was observed and what was predicted stay in separate columns.

The documented milestones, by date

Filter by kind, then open an entry to see what happened, who reported it, how sure they were, and what they said AI did not do.

Every kind. Showing 22 of 22.

2024

2025

2026

The dates are the dates of the reports or of the events they describe. A counterweight is a report that cuts against my argument; each sits at its own date. Every report is a source’s own account of what it can see: Anthropic, OpenAI and Google each report on misuse of their own models only.

Who did the work in one campaign

Anthropic’s estimate for the campaign it labels GTG-1002. It is a range, so the bar is too.

Anthropic’s estimate
  • AI, at both ends of the estimate
  • Where the two ends disagree
  • People, at both ends

By Anthropic’s estimate, AI did 80% to 90% of the tactical work in GTG-1002, and people did 10% to 20%.

People made about 4 to 6 critical decisions per campaign. Anthropic says “perhaps”, so every dot is drawn the same, dashed, and none is a count.

Anthropic describes how it reached the estimate only as an analysis of operational tempo, request volumes and activity patterns. It gives no further method.

The bar is drawn as a range because Anthropic gives a range. The striped part is where the two ends of its estimate disagree. Anthropic sees only its own model’s use, so this is one campaign it detected, not a rate across attackers.

What AI found and patched in a defence contest

DARPA’s AI Cyber Challenge, the 2024 semifinal against the 2025 final, as DARPA states the shares of the synthetic vulnerabilities set for the contest.

Semifinal, August 2024

Found37%
Patched25%

Final, August 2025

Found86%
Patched68%

What the final’s 68% is a share of: DARPA’s page is not consistent. One sentence says patched “68% of the vulnerabilities identified”. Its counts say the teams found 54 of the 63 synthetic vulnerabilities and patched 43, and its editor’s note says they “discovered 86% of the synthetic vulnerabilities and patched 68%”. 43 of 63 is the 68%; 43 of the 54 found is a different, higher share. I read it as a share of all 63. The page does not say what the semifinal’s 25% is a share of.

  • Real, non-synthetic vulnerabilities also found, final only: 18
  • Average time to a patch, final only: about 45 minutes
  • Average cost per competition task, final only: about $152

Organiser-reportedBoth rounds are DARPA’s own figures, on synthetic vulnerabilities set for a contest, and DARPA states no false-positive rate. The results page I read does not say the two rounds are like for like, so read the gap as a direction, not a rate of improvement.

The documented cases come first, and they are Anthropic’s, which sees only its own model’s use. In August 2025 it described a criminal who used an AI coding agent to run a data-extortion operation against at least 17 organisations in a month. Three months later it described a campaign it assesses with high confidence was run by a state-sponsored group, in which, by Anthropic’s estimate, AI did 80% to 90% of the tactical work. People chose the targets and approved the escalations, at 4 to 6 decision points, a figure Anthropic hedges with “perhaps”. The page draws that share as a range because Anthropic gives a range.

Others report the same direction in their own words. Google’s threat intelligence group said in November 2025 that within the last year adversaries had begun deploying AI-enabled malware in live operations, which it still called nascent. Anthropic’s September 2026 report, covering December 2025 to August 2026, says the autonomous operating model has proliferated across every class of actor it investigated, and that none of the operations it describes needed a new technique.

The counterweights sit at their own dates on the timeline. OpenAI said in October 2024 that it had not seen evidence of meaningful breakthroughs in new malware, and in October 2025 that it found no evidence of new tactics or that its models gave threat actors novel offensive capabilities. Google’s group said in January 2025 that AI was “not yet the game-changer it is sometimes portrayed to be”. Anthropic said its own model frequently overstated findings and occasionally fabricated data in the espionage case, which it calls an obstacle to fully autonomous attacks.

The assessed and predicted entries stay in their own column. The UK’s NCSC predicts that AI will almost certainly make parts of intrusion operations more effective and that AI-assisted vulnerability research will highly likely be the most significant development, while rating fully automated end-to-end advanced attacks as unlikely to 2027. Those are predictions, not measurements. Anthropic’s own assessment is that AI “has inverted the cost back onto defenders”, a possibility it states “at least in theory”.

On the defence side, DARPA reported that AIxCC’s systems found 37% of the synthetic vulnerabilities and patched 25% at the 2024 semifinal, and found 86% and patched 68% at the 2025 final. Those are the organiser’s figures, DARPA states no false-positive rate, and I do not know that the two rounds are like for like. Three more entries are vendors’ accounts of their own products and telemetry (XBOW, Anthropic’s Mythos Preview and Microsoft’s signals). The page labels them vendor self-reported, because nobody has independently verified them.

My viewMy view: I keep the observed and the predicted apart because they are different kinds of evidence, and the observed column is the one that matters most to me. In it, one operator doing a team’s work and agents doing most of a campaign’s tactical steps are documented by the people who saw them, even though each of them sees only its own model. The counterweights are real, and I read them, as the hub does, as describing what actors did with those models at the time. None of the entries shows when an attacker strikes, only how much of the work a machine can do, which is why a later chapter turns to watching at that pace.

Exercise

Try the timeline.

  1. Filter to the offense that was observed, then to the offense that was only assessed or predicted, and compare how many entries each has.
  2. Open a counterweight and read what its source said AI did not do.
  3. Move the share bar between the ends of Anthropic’s range and ask what you would need to know to pick one end.

Sources

  1. Anthropic, August 2025 Threat Intelligence Report: August 2025. Aug 2025; read 2026-10-24.

    Pages 1 to 20 of 25. Anthropic reports on misuse of its own model and sees only that model’s use.

    • Pages 4 to 5: the data-extortion case
    • Page 19: two of four accounts banned before any prompt; page 3: the case studies likely reflect consistent patterns
    • Pages 4 to 5, 8 and 15 to 17: the data-extortion case, the single-operator implication, the ransomware seller

  2. Anthropic, November 2025 Disrupting the first reported AI-orchestrated cyber espionage campaign (full report). Nov 2025; read 2026-10-24.

    Read in full. Anthropic reports on misuse of its own model and sees only that model’s use.

    • Pages 2 to 3 and 7: attribution with high confidence, the share of tactical work, the decisions left to people
    • Page 4: overstated findings and fabricated data, an obstacle to fully autonomous attacks
    • Pages 2 to 3, 7 and 8: attribution, targets, the share of tactical work, the decisions left to people
    • Page 4: frequently overstated findings and occasionally fabricated data, an obstacle to fully autonomous cyberattacks
    • Page 7: AI executed about 80 to 90 percent of the tactical work independently; human effort estimated at 10 to 20 percent; the method, described only in outline

  3. Anthropic, November 2025 (news page) Disrupting the first reported AI-orchestrated cyber espionage campaign (news page). 13 Nov 2025, edited 14 Nov 2025; read 2026-10-24.

    The news page, used for the estimate of human decision points. Anthropic reports on misuse of its own model.

    • The news page: “perhaps 4-6 critical decision points per hacking campaign”
    • The news page: human intervention at “perhaps 4-6 critical decision points per hacking campaign”

  4. Google GTIG, November 2025 GTIG AI Threat Tracker: Advances in Threat Actor Usage of AI Tools. 5 Nov 2025; read 2026-10-24.

    The summary, the malware table and four cases.

    • Summary and key findings: AI-enabled malware in live operations, still nascent
    • Table 1 and the PROMPTFLUX and PROMPTSTEAL sections
    • Summary and key findings: the shift within the last year, “still nascent”; Table 1

  5. Anthropic, September 2026 Detecting and countering misuse of AI: September 2026. Sept 2026 (the page shows no day); covers Dec 2025 to Aug 2026; read 2026-10-24.

    The introduction and the cyber section in full; other sections by heading only. Anthropic reports on misuse of its own models.

    • Trends and prevailing trends: proliferation across every class of actor; no entirely new technique
    • The case on self-rebuilding malware: inverted the cost back onto defenders, at least in theory
    • Trends, the token-theft case and the synthesis: proliferation, 2,100 token sets, 40 tenants, about 34 hours; no new technique; the caveats on human decisions
    • The case on self-rebuilding malware: AI has inverted the cost back onto defenders; an adversary can in theory close the loop

  6. OpenAI, October 2024 Influence and cyber operations: an update. Oct 2024; read 2026-10-24.

    The executive summary and the cyber cases. OpenAI reports on misuse of its own models.

    • Page 4: not seen evidence of meaningful breakthroughs in new malware
    • Pages 3 to 5: the operations disrupted, no evidence of breakthroughs in new malware, the uplift judgement

  7. OpenAI, October 2025 Disrupting malicious uses of AI: October 2025. Oct 2025; read 2026-10-24.

    Pages 2 to 17. OpenAI reports on misuse of its own models.

    • Pages 5 and 16: no evidence of new tactics or novel offensive capabilities
    • Pages 3, 5 to 9 and 16: networks disrupted, no evidence of novel capabilities, refusals, building-block code

  8. Google GTIG, January 2025 Adversarial Misuse of Generative AI. 29 Jan 2025; read 2026-10-24.

    The summary and the per-country findings.

    • Key findings: not yet the game-changer
    • Key findings: not yet the game-changer, productivity gains rather than novel capabilities; the jailbreak attempts

  9. UK NCSC, 2025 Impact of AI on cyber threat from now to 2027. 7 May 2025; read 2026-10-24.

    An assessment in NCSC’s probability language; every judgement in it is a prediction. The probability yardstick’s percentage ranges are an image and were not read.

    • Key judgements: more effective and efficient intrusion operations, vulnerability research, fully automated attacks unlikely to 2027
    • Key judgements: vulnerability research, disclosure to exploitation, the digital divide, and fully automated attacks unlikely to 2027

  10. DARPA, AIxCC results AI Cyber Challenge marks pivotal inflection point for cyber defense. 8 Aug 2025, with an editor’s note correcting 70 to 63 synthetic vulnerabilities; read 2026-10-24.

    The organiser’s own results page. It states no false-positive rate and not the total compute cost.

    • The results page: the final figures and the restated semifinal figures
    • The results page restates the August 2024 semifinal figures: 37% found, 25% patched
    • The results: 54 of 63 found (86%), 43 patched (68%), 18 real vulnerabilities, about 45 minutes a patch, about $152 a task, the editor’s note
    • The results page: the final figures and the restated semifinal figures; the editor’s note

  11. XBOW, the road to the top The road to Top 1: How XBOW did it. 24 Jun 2025; read 2026-10-24.

    A vendor’s account of its own product. Self-reported, not independently verified or audited.

    • The post: a vendor’s account of its own product
    • The post: the leaderboard rank, the submission count and the review before submission

  12. Anthropic, Project Glasswing Project Glasswing: Securing critical software for the AI era. 7 Apr 2026, with an update dated 6 Oct 2026; read 2026-10-24.

    Anthropic’s own account of its own model’s findings. Not independently verified.

    • The announcement: a vendor’s account of its own model
    • The announcement: “thousands” of high-severity zero-days, nearly all found autonomously

  13. Microsoft, Digital Defense Report 2026 Microsoft Digital Defense Report (landing page, now carrying the 2026 report). data July 2025 to June 2026; fetched 2026-10-24.

    The landing page only, not the full report. Microsoft’s own telemetry and claims; no method is set out on the page.

    • The key figures: a vendor’s own telemetry
    • The key figures and the AI section: 5.3 hours, compressing attack timelines, 165+ trillion signals a day

  14. UK NCSC, 2024 The near-term impact of AI on the cyber threat. 24 Jan 2024; read 2026-10-24.

    An assessment in NCSC’s probability language; every judgement in it is a prediction. The probability yardstick’s percentage ranges are an image and were not read.

    • Key judgements and assumptions: volume and impact, reconnaissance and social engineering, advanced uses unlikely before 2025

  15. Google Project Zero, Big Sleep From Naptime to Big Sleep: Using Large Language Models To Catch Vulnerabilities In Real-World Code. posted 1 Nov 2024; read 2026-10-24.

    Google’s own account of its own agent; self-reported by the maker and not independently verified.

    • The SQLite finding, the fuzzing comparison and the “highly experimental” hedge

  16. Google, summer 2025 security updates Cybersecurity updates ahead of Black Hat and DEF CON. 15 Jul 2025; read 2026-10-24.

    Google’s own account of its own agent. It does not say how the agent predicted imminent use, who the actors were, or what the evidence was.

    • The Big Sleep section: the SQLite flaw known only to threat actors and the claim to have foiled its use

  17. Anthropic, August 2025 (news page) Detecting and countering misuse of AI: August 2025. 27 Aug 2025; read 2026-10-24.

    The news page for the August 2025 report. Anthropic reports on misuse of its own model and sees only that model’s use.

    • The news page, “Vibe hacking” section

  18. OpenAI, February 2026 Disrupting malicious uses of AI (February 2026). 25 Feb 2026; read 2026-10-24.

    The hub page and the first pages of the report. The case studies in what was read are scams and influence operations; no cyber-intrusion case.

    • The hub page and report pages 2 to 4: AI combined with traditional tools; the case studies read are scams and influence operations

  19. Anthropic, Mythos Preview Claude Mythos Preview (Frontier Red Team post). 7 Apr 2026; read 2026-10-24.

    Read in part: the OpenBSD and FFmpeg findings, severity validation and the suggestions for defenders. Anthropic’s own account of its own model. Not independently verified.

    • The validation of severity, the share unpatched and the suggestions for defenders

  20. OpenAI, Patch the Planet Patch the Planet: global response coordination as agents uncover critical vulnerabilities. 21 Oct 2026; read 2026-10-24.

    Read in full. OpenAI’s own account of its own model’s findings. Not independently verified.

    • The post: the critical flaw, the independent finding, “to our knowledge”, the expectation and the always-on scanning question

Everything here is paraphrased from the sources, not quoted at length, and each claim is attributed to one. A prediction is kept as its source’s prediction, with its hedge. Vendor figures and a vendor-sponsored study are labelled as such. Where a source is silent or could not be read, the page leaves the fact out.