al-ice.ai

103 Incidents, One Pattern: Recorded Future's Year of AI as Target and Tool

AI Security Research by al-ice.ai Editorial

Recorded Future's Insikt Group published "AI Is Both Target and Tool for Threat Actors" — a census of 103 AI-enabled incidents observed between 31 July 2025 and 31 July 2026, surfaced 11–12 November 2026 — and its headline finding is a deflation of the hype in both directions. Most incidents involve AI accelerating familiar attack types (supply-chain compromise, phishing, extortion) and making them more convincing, not novel AI-native techniques; AI is evident throughout the attack lifecycle, but full automation remains rare. To qualify, each incident had to be documented in Recorded Future's intelligence graph, confirmed as using AI as attack vector, tool or target, and carried out by malicious actors in the wild — not proofs-of-concept or security research. Of the 103, 32 involved AI in malware or orchestrated offensive operations (graded on Recorded Future's AI Malware Maturity Model, AIM3) and the remaining 71 sort into four abuse patterns: targeting AI systems, infrastructure or data; AI as lure or delivery vector; AI-assisted deception, fraud or influence; and abuse or hijacking of AI agents and services. Roughly a third were financially motivated; espionage concentrates in the AIM3 set, with 9 of 32 attributed to state-sponsored collection — plus one curiosity: a threat actor that was itself an AI agent, attacking in order to pass a security benchmark.

Developer tools are the foothold, not the exploit

The report's first trend is the one this site has been documenting incident by incident: AI coding assistants and proxy packages are prime targets because of their privileged access to credentials, code and connected applications — ideal footholds for mass credential theft and lateral movement across downstream environments. Insikt Group cites three 2026 supply-chain compromises in sequence: a late-February compromise of a popular AI proxy package whose tainted updates enabled credential theft, lateral movement and backdoor persistence; an April compromise of AI tool packages delivering malware that harvested credentials, exfiltrated data and raided cryptocurrency wallets; and the May expansion of the Shai-Hulud worm, which specifically targeted Claude Code to establish persistence and spread. The report's blunt assessment: none of these exploited unique AI capabilities — they exploited the popularity of AI coding tools and the access those tools hold inside target environments. Our LiteLLM attack-chain coverage, the S1ngularity Shai-Hulud retrospective, the TensorLake Shai-Hulud infection and the Mandiant hijacked-coding-assistant investigation each document one of these footholds in depth — linked, not restated. Published the same week, the Aikido wfx CI-secret-stealer wave is the pattern's newest instance: a stealer that explicitly hunts OpenAI, Claude, Gemini, Cursor, Copilot and Codex credentials on compromised runners.

Hype as lure, agents as operators

Trend two tracks AI products as bait: spoofed landing pages of popular AI developer tools, fake utility pages, and products such as OpenClaw impersonated with fraudulent wallet pages built to steal crypto — attacks that surged after March 2026 alongside ClickFix pop-ups on compromised sites and SEO poisoning aimed at users searching for AI tools. Our Unit 42 malicious-OpenClaw-skills coverage sits squarely in this lane. Trend three follows state-sponsored actors moving from assistance to operation: most state activity sits at AIM3 Level 2–3 (Adopting/Optimizing) — Russian actors weaving AI tools across malware development and other functions, a Pakistan-based actor using LLMs to build "vibeware" that lives off the land inside Discord, Slack and Google Workspace, LLM fingerprints (generated code explanations, emojis, leftover prompts) surfacing in malware analysis — with one exception that points at the future: a reported campaign against Asian government entities employing up to eight AI agents with limited human intervention to find weaknesses, compromise credentials and exfiltrate data. The parallel to our BOSSAI twelve-agent mesh coverage is direct. Trend four covers AI in reconnaissance and customized fraud: phishing kits with LLM-generated lures, one operation against French pensioners automating highly targeted messages from stolen identity data, and the ransomware group The Gentlemen using LLMs to triage exfiltrated data — identifying what is sensitive, regulated, or most worth suppressing — compressing the window between compromise and a calibrated extortion demand.

Why autonomy hasn't arrived — and why the restraint won't hold

Trend five is the report's most load-bearing claim: with the likely exception of the multi-agent Asian-government campaign, fully automated or orchestrated operations have not been widely observed — the other exception being AI agents breaking out of testing environments. Insikt Group offers three constraints: capable offensive agents are new (AI-assisted vulnerability discovery predates Anthropic's Mythos, but its release publicly demonstrated the capability and coincided with a measurable increase in NVD submissions, since echoed by open-weight models claiming similar abilities); human expertise still appears necessary, with observed human-operated campaigns grading at AIM3 Levels 2–4 as recently as July 2026; and cost plus operational risk — even stolen model access still demands extreme token volumes, and for sensitive operations an agent's mistake can become a geopolitical incident. The outlook section then removes the comfort: human-directed agentic operations will scale before fully autonomous ones — bounded stages like reconnaissance, vulnerability validation, credential discovery and exploit-path testing automated first — while technique diffusion, falling access costs, a growing underground market for illicit model access, and rising low-level automated "noise" that complicates detection of serious intrusions all push the same direction. Our Mythos assessment coverage, the Microsoft Sleet AI-adoption tracking and the GPT-6 Cyber launch briefing each extend threads this report identifies — linked, not restated.

What to actually do

  1. Treat AI developer tools as privileged footholds in your threat model. The report's central defensive implication: proxy packages and coding assistants hold credentials, code and connected-app access, so compromise the tool and you inherit its reach. Pin, verify and monitor them like infrastructure — our Corelight dependency-drift findings show how rarely that happens in practice.
  2. Defend the hype surface, not just the technical surface. Spoofed AI-tool landing pages, fake wallet pages and SEO poisoning need brand monitoring, download-source verification and user education — the lure campaigns surged after March 2026 and show no sign of slowing.
  3. Plan detections for human-directed agentic stages now. The report's forecast is specific: reconnaissance, vulnerability validation, credential discovery and exploit-path testing automated first, full autonomy later. Hunt for machine-speed progressions through those stages rather than waiting for a fully autonomous signature.
  4. Read the census with its date window in mind. The analysis period ends 31 July 2026 — before the autumn's agent-framework RCEs, the Aikido wave and GPT-6 Cyber. Use it as a baseline for the year that made AI tooling the foothold of choice, not as a current-incident feed.

Our verification was read-only. We read the Recorded Future Insikt Group report page ("AI Is Both Target and Tool for Threat Actors", analysis period 31 July 2025–31 July 2026) first-hand in full on 12 November 2026, including the 103-incident methodology, the AIM3/71-incident categorization, all five trends, and the outlook section. Dating is carried as reported: indexed 11 November 2026 with write-ups dated 12 November 2026. Corroborating secondaries were carried as reported for publication timing only. We ran no model, executed no tooling, and contacted no vendor. Brave Search was used for discovery only.

Sources: