AI-Powered Cyber Attacks
When have AI models been used to carry out cyber attacks, by whom, and how much of the work did the AI do? Every campaign we could find, dated, labelled and linked to its source.
31verified attack campaigns
13reporting organisations
On one timeline
One line per kind of step. Filled dots are counted; open dots are claimed, lifted or not yet in effect. Hover or tap a dot.
Every campaign
Newest first. Each verified entry counts once; claimed entries are shown and labelled but not counted.
What counts
A case counts when an AI developer, a government security agency or an established security firm publishes its own report that an AI model was used to carry out, automate or materially assist a specific cyber attack, intrusion or malware campaign, with the attacker's use of AI observed rather than assumed. Each campaign counts once, from its first report. General warnings, forecasts, proof-of-concept research with no real victims, and unconfirmed media claims are listed under related, not counted.
- 21 Oct 2026Microsoft Threat IntelligenceAI-driven, large-scale nation-state campaign using ARTEX enables supply chain compromiseChina-aligned Storm-0940 used the ARTEX agentic AI framework to automate scanning, password spraying and OAuth abuse against hundreds of organisations, including downstream customers after the ConnectWise supply-chain compromise, gaining privileged cloud access at several in under three hours.VerifiedAI-orchestrated attackOfficial document →Archived copy
- 7 Oct 2026CrowdStrike · security-firmUnknown Threat Actor Uses AI-Driven ARTEX to Target South Korean FinanceA likely Chinese-speaking, financially motivated actor used the Chinese open-source agentic pentest tool ARTEX with DeepSeek, plus Claude Code sessions, against South Korean financial organisations, ending in data theft.VerifiedAI-orchestrated attackOfficial document →Archived copy
- 22 Sep 2026Gambit Security · security-firmAutonomous AI Agents are breaking into hundreds of Online Retailers for $25 a target in an ongoing campaignA financially motivated, Chinese-speaking operator ran open-source AI agent tools, using DeepSeek, GLM and Claude Opus models, that carried out almost the whole attack chain against online shops, stealing card data and planting card-skimming scripts.VerifiedAI-orchestrated attackOfficial document →Archived copy
- 10 Sep 2026AnthropicDetecting and countering misuse of AI: September 2026 (GTG-50029)A single French-speaking hacktivist used Claude to build a website exploit and run reconnaissance with sub-agents, then breached European political and media organisations and leaked data.VerifiedAI-assisted attackOfficial document →Archived copy
- 10 Sep 2026AnthropicDetecting and countering misuse of AI: September 2026 (GTG-50014)Suspected ShinyHunters affiliates used Claude agents to speed up scanning, exploitation and account takeover; agents did nearly all the work in one SaaS supply-chain theft, and stolen AI API keys funded further attacks.VerifiedAI-orchestrated attackOfficial document →Archived copy
- 10 Sep 2026AnthropicDetecting and countering misuse of AI: September 2026 (GTG-20006)A Russian state-linked espionage actor, consistent with reporting on Midnight Blizzard, used Claude workflows for infrastructure, phishing, C2 and data theft, and had agents rebuild its malware whenever security products flagged it.VerifiedAI-orchestrated attackOfficial document →Archived copy
- 10 Sep 2026AnthropicDetecting and countering misuse of AI: September 2026 (GTG-10007)Chinese-speaking operators, likely based in Changsha, used Claude to coordinate an offensive programme with multiple AI agents, including vulnerability research and intrusions. Anthropic banned the accounts.VerifiedAI-orchestrated attackOfficial document →Archived copy
- 9 Sep 2026Google Threat Intelligence GroupGTIG AI Threat Tracker: From Prompting to AutonomyMandiant saw a suspected financially motivated actor take over a cloud resource, deploy a multi-agent attack framework and, using an AI coding chatbot and agent instructions, plan, build and run a mass credential-harvesting campaign in under six hours.VerifiedAI-orchestrated attackOfficial document →Archived copy
- 2 Sep 2026Palo Alto Networks Unit 42 · security-firmAn AI-Assisted Cyber Attack: Inside a Unit 42 InvestigationIn an incident Unit 42 handled, an attacker used frontier AI models and agent frameworks to map the network, pull secrets from code repositories, take root credentials and hijack CI/CD pipelines, compressing about two weeks of work into under 10 hours, then had an agent write an 80-page audit of the victim.VerifiedAI-orchestrated attackOfficial document →Archived copy
- 27 Aug 2026Gambit Security · security-firmAurora ransomware targets ESXi, abuses Cursor Agent for exploitationAn operator of the Aurora ransomware group used Cursor Agent running Claude Sonnet, given stolen credentials or tunnels, to scan internal networks, enumerate rights and run exploitation steps inside victim organisations, alongside a Linux/ESXi ransomware variant.VerifiedAI-assisted attackOfficial document →Archived copy
- 30 Jul 2026Palo Alto Networks Unit 42 · security-firmChinese-Speaking Threat Actor Harnesses AI Models for Autonomous CyberattacksA Chinese-speaking actor ('knaithe'/'KnYuan') ran DeepSeek inside the open-source Hermes Agent as an autonomous operator, controlled over Telegram, to find exposed servers, pick public exploits and attack them. Its confirmed data theft (Citrix NetScaler) came from parallel manual work.VerifiedAI-orchestrated attackOfficial document →Archived copy
- 1 Jul 2026Sysdig · security-firmJADEPUFFER: Agentic ransomware for automated database extortionAn LLM-driven operator broke into an internet-facing Langflow server (CVE-2025-3248), harvested cloud and AI keys, pivoted to a production database server, encrypted and deleted its configuration data and left a Bitcoin ransom note. The agent fixed its own failed steps within seconds.VerifiedAI-orchestrated attackOfficial document →Archived copy
- 12 May 2026Google Threat Intelligence GroupGTIG AI Threat Tracker: Adversaries Leverage AI for Vulnerability Exploitation, Augmented Operations, and Initial AccessA suspected China-linked actor ran the agentic hacking tools Hexstrike (with a memory system) and Strix against real targets, letting the AI choose recon tools and find and validate vulnerabilities on its own.VerifiedAI-orchestrated attackOfficial document →Archived copy
- 12 May 2026Google Threat Intelligence GroupGTIG AI Threat Tracker: Adversaries Leverage AI for Vulnerability Exploitation, Augmented Operations, and Initial AccessCriminals planning a mass-exploitation operation built a zero-day exploit (a 2FA bypass in a popular open-source web admin tool) that Google assesses with high confidence was found and weaponised with an AI model. Google alerted the vendor and may have stopped its use.VerifiedAI-assisted attackOfficial document →Archived copy
- 6 Apr 2026Microsoft Defender Security ResearchInside an AI-enabled device code phishing campaignMicrosoft described a large device-code phishing campaign that used generative AI to write lures tailored to each victim's job and automated infrastructure to generate live codes, compromising organisational accounts at scale.VerifiedAI phishing or fraudOfficial document →Archived copy
- 20 Feb 2026Amazon Threat IntelligenceAI-augmented threat actor accesses FortiGate devices at scaleA Russian-speaking, financially motivated actor used at least two commercial AI services to plan attacks and build tools, then broke into FortiGate firewalls through exposed management ports and weak passwords, stole configurations and moved into internal networks.VerifiedAI-assisted attackOfficial document →Archived copy
- 3 Feb 2026Sysdig · security-firmAI-assisted cloud intrusion achieves admin access in 8 minutesAn attacker used AWS credentials found in public S3 buckets and, with LLM-written code and LLM-driven decisions, reached administrator access in under 10 minutes, moved across 19 AWS identities, abused Amazon Bedrock models and launched GPU instances.VerifiedAI-assisted attackOfficial document →Archived copy
- Feb 2026Gambit Security · security-firmThe AI-Assisted Breach of Mexico's Government InfrastructureA single unattributed attacker used Claude Code to find flaws, write exploits, escalate privileges and run most commands inside Mexican government networks, and used OpenAI's GPT-4.1 API to analyse data from hundreds of servers.VerifiedAI-orchestrated attackOfficial document →Archived copy
- 13 Nov 2025AnthropicDisrupting the first reported AI-orchestrated cyber espionage campaignA group Anthropic assesses with high confidence was Chinese state-sponsored used Claude Code as an autonomous agent to run most of an espionage campaign: reconnaissance, exploit writing, credential theft and data extraction, with humans stepping in at a few decision points. It succeeded in a small number of cases.VerifiedAI-orchestrated attackOfficial document →Archived copy
- 6 Nov 2025Google Threat Intelligence GroupGTIG AI Threat Tracker: Advances in Threat Actor Usage of AI ToolsGoogle listed AI-enabled malware seen in operations: QUIETVAULT, which uses AI command-line tools on the victim machine to hunt for secrets, and FRUITSHELL. It also said state groups used Gemini across the attack chain: APT41 for C2 code, North Korea's UNC4899 for exploit research, Iran's TEMP.Zagros for custom malware.VerifiedAI-assisted attackOfficial document →Archived copy
- 7 Oct 2025OpenAIDisrupting malicious uses of AI: an update (October 2025)OpenAI banned three clusters: a Russian-speaking criminal building a remote-access trojan and credential stealers; Korean-language operators (overlapping Trellix reporting on XenoRAT attacks on South Korean diplomatic missions) developing malware and phishing; and China-linked UNK_DROPPITCH/UTA0388, which wrote multilingual phishing emails and C2 code.VerifiedAI-assisted attackOfficial document →
- 27 Aug 2025Wiz · security-firms1ngularity: supply chain attack leaks secrets on GitHub: everything you need to knowPoisoned versions of the Nx npm package ran a script on developers' machines that prompted installed AI command-line tools (Claude, Gemini, Amazon Q) with safety-bypass flags to search for secrets, then posted the loot to public GitHub repositories.VerifiedAI-enabled malwareOfficial document →Archived copy
- 27 Aug 2025AnthropicDetecting and countering misuse of AI: August 2025A cybercriminal tracked as GTG-5004 used Claude to develop, market and distribute several ransomware variants with evasion and encryption features, selling them on criminal forums.VerifiedAI-enabled malwareOfficial document →Archived copy
- 27 Aug 2025AnthropicDetecting and countering misuse of AI: August 2025A cybercriminal Anthropic tracks as GTG-2002 used Claude Code to automate reconnaissance, steal credentials and break into networks, then to choose which data to take and to write extortion demands. Anthropic banned the accounts.VerifiedAI-orchestrated attackOfficial document →Archived copy
- 17 Jul 2025CERT-UA · governmentUAC-0001 cyber attacks on the security and defence sector using LAMEHUG, a tool that uses an LLM (CERT-UA#16039)Ukraine's CERT-UA reported emails from compromised accounts carrying LAMEHUG malware, which asks the Qwen 2.5-Coder-32B-Instruct model (via the Hugging Face API) to write Windows commands that collect system data and documents for theft. Attributed with medium confidence to Russia's APT28.VerifiedAI-enabled malwareOfficial document →Archived copy
- 5 Jun 2025OpenAIDisrupting malicious uses of AI: June 2025 (Operation 'ScopeCreep')A Russian-speaking actor used ChatGPT, one account per small change, to build and debug Windows malware and its C2 server. The malware was hidden in a fake Crosshair-X gaming tool on a public code repository; OpenAI had the repository taken down.VerifiedAI-enabled malwareOfficial document →Archived copy
- 15 May 2025FBI (IC3) · governmentSenior US Officials Impersonated in Malicious Messaging Campaign (PSA I-051525-PSA)The FBI warned of an ongoing campaign since April 2025 in which attackers sent texts and AI-generated voice messages posing as senior US officials, then sent malicious links to take over the targets' accounts.VerifiedAI phishing or fraudOfficial document →Archived copy
- 21 Feb 2025OpenAIDisrupting malicious uses of our models: an update (February 2025)OpenAI banned accounts linked to North Korean groups (Kimsuky/VELVET CHOLLIMA and an actor linked to APT38) that used ChatGPT to build RDP brute-force tools, obfuscated payloads and crypto-themed phishing. While debugging, the actors revealed staging URLs for malware binaries that security vendors had not yet seen.VerifiedAI-assisted attackOfficial document →
- 30 Jan 2025Google Threat Intelligence GroupAdversarial Misuse of Generative AIGoogle found government-backed groups from more than 20 countries using Gemini for target reconnaissance, vulnerability research, payload development, scripting and phishing. Iran's APT42 used it to craft phishing campaigns.VerifiedAI-assisted attackOfficial document →Archived copy
- 9 Oct 2024OpenAIInfluence and cyber operations: an update (October 2024)OpenAI banned accounts of China-linked SweetSpecter, which researched vulnerabilities and scripting with ChatGPT while spear-phishing OpenAI staff with SugarGh0st malware; Iran-linked CyberAv3ngers, which asked for PLC default passwords and attack scripts; and Iran's STORM-0817, which debugged Android surveillance malware and its C2 server.VerifiedAI-assisted attackOfficial document →Archived copy
How this thread is kept
Every entry links to the official document itself: the order, law, filing or statement, with an archived copy where one exists. Steps known only from news reports are left out, so our count can be lower than press tallies. New entries are added when we find their official text. How the Record works · Report an error or a missing campaign