AI used to run a cyber attack
An attacker uses an AI agent or model to carry out an attack.
NIST AI 600-1 · Information SecurityEU GPAI Code App. 1.4
Incidents per quarter
2025-Q3: 2 · 2025-Q4: 0 · 2026-Q1: 1 · 2026-Q2: 0 · 2026-Q3: 6 · 2026-Q4: 16
Developers
Where the chain broke
| Layer | Held | Did not hold | Not mentioned | Attacker's own | Not read yet |
|---|---|---|---|---|---|
| L1 Model Model provider | – | 1 | 1 | – | 23 |
| L2 Harness Agent framework vendor | – | – | 2 | – | 23 |
| L3 Application Deployer | – | – | – | 2 | 23 |
| L4 Infrastructure / target Organisation hit | – | – | 2 | – | 23 |
Controls for this risk, by layer
HeldFailedGot aroundMissing
| Control | Held | Failed | Got around | Missing | Not mentioned | Did not hold, last 6 quarters | Added in fixes | Most common reason |
|---|---|---|---|---|---|---|---|---|
| Content safety classifiers L1 Model | – | – | – | – | 2 | – | ||
| Safety training and refusal L1 Model | – | – | 1 | – | 1 | – | A cover story or retry undid the refusal | |
| Cyber and weapons safeguards L1 Model | – | – | – | – | 2 | – | ||
| Dangerous-capability testing before release L1 Model | – | – | – | – | 2 | – | ||
| Outside red-teaming L1 Model | – | – | – | – | 2 | – | ||
| Staged or restricted release L1 Model | – | – | – | – | 2 | – | ||
| Abuse monitoring and account enforcement L1 Model | – | – | – | – | 2 | – | ||
| Reasoning monitoring L1 Model | – | 1 | – | – | 1 | – | The reasoning showed it; nothing acted | |
| Safeguards kept on in testing L1 Model | – | – | – | – | 2 | – | ||
| Known flaws patched L4 Infrastructure / target | – | – | – | – | 2 | – | ||
| Multi-factor sign-in and password policy L4 Infrastructure / target | – | – | – | – | 2 | – | ||
| Network segmentation L4 Infrastructure / target | – | – | – | – | 2 | – | ||
| Intrusion and endpoint detection L4 Infrastructure / target | – | – | – | – | 2 | – | ||
| Backups and recovery L4 Infrastructure / target | – | – | – | – | 2 | – | ||
| Phishing and fraud filters L4 Infrastructure / target | – | – | – | – | 2 | – |
15 of 15 controls for this risk not yet seen holding.
Fixes reported and what followed
| Incident | Fix adds | After |
|---|---|---|
| LR-2026-0265 2026-10-28 · Anthropic Fix reported | Vulnerability scanning of AI components | LR-2026-0280 |
| LR-2026-0239 2026-10-23 · DeepSeek Advice in source, not a fix by the party | Least-privilege access for the agentShort-lived, scoped credentialsSecrets kept out of the model's contextHuman approval for high-impact actionsNetwork egress controlLive behaviour monitoring | – |
| LR-2026-0168 2026-10-12 · Anthropic Advice in source, not a fix by the party | Not tied to a control | – |
Incidents
HeldFailedGot aroundMissingNot mentionedNot read yetAttacker's ownOrder: model · harness · application · target
Also under this risk as a secondary risk: LR-2026-0281, LR-2026-0273, LR-2026-0268, LR-2026-0262, LR-2026-0257, LR-2026-0253, LR-2026-0248, LR-2026-0260, LR-2026-0256, LR-2026-0237, LR-2026-0212, LR-2026-0202, LR-2026-0196, LR-2026-0192, LR-2026-0235, LR-2026-0189, LR-2026-0153, LR-2026-0138, LR-2026-0137, LR-2026-0136, LR-2026-0135, LR-2026-0125, LR-2026-0123, LR-2026-0140, LR-2026-0102, LR-2026-0250, LR-2026-0197, LR-2026-0069, LR-2026-0071, LR-2026-0054, LR-2026-0243, LR-2026-0059, LR-2026-0086, LR-2026-0089, LR-2026-0088, LR-2026-0027, LR-2026-0025, LR-2026-0090, LR-2026-0049, LR-2026-0087, LR-2026-0063, LR-2026-0047, LR-2026-0013, LR-2026-0191, LR-2026-0129, LR-2026-0033, LR-2025-0041, LR-2025-0042