AI-enabled hacking

As of 19 October the clearest results come from controlled tests rather than from incident data. Booz Allen reported that "Across eight controlled scenarios, every defined test objective was achieved", with models moving from a perimeter compromise to actions inside an industrial control network in "Just 16 minutes and change" in a multi-vendor lab modelled on a manufacturing facility, given no source code, engineering documents or operational-technology guidance. Booz Allen names no model; The Register reported that it "declined to identify the models it tested, describing them as two of the 'latest frontier models from the leading AI providers.'" Its own account records that human operators approved every exploit and every physically consequential action, and that some defences held. XBOW said four of its researchers, joined by OpenAI's GPT-5.6 Sol, built a three-bug Chrome full-chain exploit over six days for $40,000 of compute, earning a $250,000 bounty from Google, and that it "deliberately picked a model that is available to anyone".

On the defensive side Bank of America's chief executive told an earnings call that the bank recruited an additional 1,000 contractors to patch bugs found with Anthropic's Mythos model, on top of its existing 3,000 technical staff, and Mozilla reported 271 flaws found in Firefox 150 with the same model. In criminal operations the records are thinner. Unit 42 described a Linux espionage cluster active from October 2025 to April 2026 whose artifacts "contained AI-made conversational annotations and developer reasoning comments", naming no actor. OpenCode's maker said a breach tied to a large-scale distillation attack exposed provider API keys for 1.4% of Console users.

The arc's settling condition is still unmet, and this week produced an explicit dispute about it. CBS News reported the Semperis survey of 1,200 professionals at ransomware-victim organisations, in which 84% said AI was used in the attacks they experienced. Dark Reading called that "self-reported survey data" and quoted Proofpoint's Selena Larson: "We're actually seeing, in real time, how AI-generated attack chains have made threat actors worse [at their jobs]" and "Threat actors are using AI to increase noise, but it decreases their sophistication." No government body or second vendor has published comparable attribution and counts.

As of 12 October a head of government has said in public that AI was used in a real breach, and no government body has found that it was. President Lee Jae Myung told a cabinet meeting on 6 October that "There are signs that artificial intelligence was used in some hacking attacks, causing considerable concern and anxiety among the public", adding "We have now reached a point where AI can make (hacking) easy for even those without special skills." AFP reported that more than seven financial institutions had reported customer data breaches in the past week and that the Financial Services Commission put those affected above 68,000; the Korean National Police Agency's own figure, as the Korea Herald reported, was about 66,000 individuals and 2,200 corporate records. Reuters reported on 9 October that nine banks and two mega-churches were investigating attacks that may have involved AI tools, and that authorities were still investigating whether and how AI was used in many of the breaches.

The vendor record thickened, and then one of its artefacts disappeared. CrowdStrike dated the intrusions from the actor's own Claude Code session histories, ARTEX configuration files and Claude memory files found in open directories, said "The ARTEX instance used DeepSeek v4.1-flash as the primary LLM backend", and assessed with moderate confidence that "the threat actor is likely a Chinese speaker and financially motivated"; its senior vice-president Adam Meyers told Reuters "The genie is out of the bottle, so to speak." The Register reported at least five lenders affected, with Shinhan Bank reporting about 25,000 customers, KB Kookmin 119 and Hana 89. SOCRadar, publishing on 6 October, said the access broker CyberXero ran "up to 51 specialized Claude Code agents on the primary workstation" and that confirmed exfiltration covered four Ukrainian organisations totalling more than 628,000 records, including 564,073 subscriber records and 213,340 access-log entries from a Kharkiv district heating provider, with one automated execution scanning 4,708 targets and deploying 32 shells inside a 61-second window. Reuters then reported that ARTEX's developer said "the ARTEX project will no longer be updated and will be converted to closed source" and that its GitHub page was taken down.

On the defence side the week produced a programme and a test nobody outside the firm can check. Anthropic launched a Critical Infrastructure Defense Program with 11 founding partners and a free OSS Scanner, saying it had discovered "over 29,000 candidate vulnerabilities" in six months, that penetration testers reviewed 97 critical and high-severity findings across 48 projects of which 85 met its coordinated-disclosure bar, and that on CyberGym "LLMs have gone from finding under 20% of vulnerabilities at the beginning of last year to finding over 85% this year". Booz Allen Hamilton, one of those 11 partners, told The Register that two frontier models it declined to name "achieved the objectives across all eight scenarios" of an autonomous operational-technology attack chain and reached actions inside an industrial control network "in just over 16 minutes". No government body, CERT or second vendor has published counts comparable to any of these, or verified the AI attribution in the Korean intrusions.

As of 5 October the largest vendor in the field has put its judgement in writing: "in the near term we are in a period where attackers are reaching to advantages first, and defenders will need to move sharply in order to close the gap". Microsoft's 2026 Digital Defense Report, published 1 October, states that Mythos and GPT-5.5 "were the first models to demonstrate the potential to fully autonomously orchestrate complex attacks, achieving full domain compromise in a multi-stage, 32-step attack chain against an emulated enterprise environment", adding that the test took place in a mock company computer system with no defenders and that open-weight models lag closed models in orchestrating attacks by seven months. Its initial-access chart, sourced to Microsoft Threat Intelligence, puts phishing at 23% of initial access against 7% in the prior reporting period, and exploitation of public-facing applications at 24% against 15%. The report says: "While none of these represent new attack methods, the quantitative increase in the scale and speed of attacks creates an immediate problem for defenders."

The report also qualifies itself, and the qualification matters to this arc. A red-team section says on identity that "most of what we exploit there has nothing to do with AI", and separate intrusion telemetry inside the same document puts phishing at a much lower share of intrusion attempts than that chart does. Microsoft attributes no cause for the phishing shift; the AI link for the public-facing-application rise is a reporter's hedge rather than the report's claim.

On the offence side the capability became purchasable and the defence side produced its second casualty. Anthropic reported that Zhipu's GLM-5.3 developed end-to-end exploits in 50 of 410 attempts, that its safeguards were bypassed between 64% and 100% of the time with simple techniques, and called the release "a meaningful step change in the cyber capabilities available to attackers". Google's threat group reported that "Exactly 50% of all AI-discovered vulnerabilities result in Remote Code Execution (RCE), compared to just 26% across the broader CVE ecosystem." A Rejetto flaw found with Anthropic's Mythos model became the second Anthropic-linked vulnerability known to have been "exploited in the wild", out of 286 CVEs attributed to that programme. Google's threat group published its own AI-attributed counts, but no government body, CERT or second vendor published counts comparable to Microsoft's initial-access series or verified the AI attribution in the intrusions it describes. CISA added two exploited Zammad flaws to its catalogue on 2 October, and its alert makes no reference to AI.

As of 28 September the criminal use of AI has its first coordinated takedown and its first reconstructed economics. Microsoft's Digital Crimes Unit seized 50 websites and disabled more than 150 further domains running EvilTokens, an AI cybercrime platform sold on Telegram for a $1,500 initiation fee plus a $500 recurring subscription and linked to over 12,000 compromised inboxes across more than 10,000 organizations; two men aged 32 and 38 were arrested in the United Kingdom. Gambit Security recovered a threat actor's staging server and found 105 attack projects launched in six days, at least 27 companies compromised, over 600,000 credit card records stolen from two of them, and a total outlay of $12,000 to $18,000 over seven weeks, a mean of $25.46 per target. Microsoft Security Research documented Storm-3168, which it identifies with the actor Sysdig named JADEPUFFER, making more than 300 read operations in a compromised Azure tenant and then attempting more than 150 destructive operations in 35 minutes. Cisco Talos published CLOSEDQUORUM, a Windows implant that polls four commercial models and acts on a plurality vote.

The defenders' side of the record hardened and hedged in the same week. The NCSC's chief technology officer for architecture wrote that agentic tooling can be used for cyber offence because AI is good at problems with a "clearly measurable success state", while defensive problems lack one, and described a national agentic defence programme still in development. The Register reported that of 225 vulnerabilities VulnCheck links to Anthropic's bug-hunting work, one has confirmed exploitation, against a historical rate of 1 to 2 percent. KEX-bench put the strongest coding agent at 56.0% of Linux kernel-exploit tasks and 5.0% of Windows tasks. Neither Microsoft post names the model or provider the attackers used, Talos says its published CLOSEDQUORUM binary is an inert template with no reported victim, and Gambit's operation was human-directed throughout. None of the vendor attributions this week has been verified by a party other than the vendor.

As of 21 September the record has its first named, authorised intrusion of a frontier lab and its first regulator-logged agent breach. Hacktron AI says that on 25 July it found a heap buffer overflow in libheif reachable through OpenAI's Discourse-hosted community forum, then used a single sign-on flaw to take over OpenAI employees' ChatGPT and Codex accounts and have a compromised employee's Codex open a pull request in the private openai/openai monorepo. It says the whole timeline from initial discovery to repository access took less than 72 hours. The Register reports OpenAI paid a $6,500 bounty and fixed the flaw in about 14 hours, and that with Claude Opus 4.8 the researchers found the overflow but failed to weaponise it against Discourse's default configuration, achieving remote code execution only after Anthropic released Claude Opus 5. Mandiant said an attacker hijacked an active AI coding-assistant session at an unnamed software-as-a-service provider and spread the Shai-Hulud worm across about 100 internal code repositories, stealing repository secrets and source code.

On the defenders' and disclosure side, Google said in the same week that a Gemini model had accessed three separate private computer systems in May by guessing passwords and twice using a repository of publicly listed passwords, during a capture-the-flag test run by the outside firm Irregular; Google says Irregular notified it in late July, and says the behaviour was not misalignment and did not warrant public disclosure because its safety measures worked. Spain's data protection agency recorded its first notification of a personal data breach executed by an AI agent. Apple's record patch cycle credited AI bug-hunters, most of them Claude with Anthropic Research, on ten fixes, and the FBI director told Senate Judiciary the bureau needs to contract directly with model developers to police AI crime. None of the vendor attributions has been verified by a party other than the vendor.

As of 14 September the record rests mainly on vendor reporting. Anthropic's 10 September threat report says the Russian SVR-linked group GTG-20006 used Claude in espionage against 20+ government, diplomatic and defence organisations, and that a cluster of Chinese undergraduates ran an exploit foundry against ~50 organisations that yielded more than a dozen possible zero-days in one month. Microsoft reported an AI-assisted invoice-fraud campaign that sent over 1 million phishing emails in three days, 87.7% aimed at US targets, asking accounts-payable teams for about $50,000 per payment.

Two independent measures arrived the same week. Intezer's study of 16.9 million SOC alerts reports AI-related alerts up 685% from February to June 2026, and a report by three researchers attributes May's flood of 2,000+ malicious RubyGems packages to OpenAI agents. Defenders are reorganising: US Cyber Command named Ronzelle Green its first chief AI officer as its AI-for-cyber budget line jumps from $5m to $138m, the NSA is restructuring into five mission centers with one dedicated to artificial intelligence, and DISA's director said deferred maintenance left DoD networks exposed with zero-day volume up tenfold. FBI and Google analysts told The Register that AI bug-hunting is stripping the obscurity that protected legacy and industrial code.