Threat Intelligence Brief: AI-Enabled Attack Evolution

Key judgments

Confidence is stated per judgment. Overall confidence in this brief is medium: most of the visibility comes from a few vendors who can only see their own platforms.

Judgment	Basis	Confidence
State and criminal actors now use AI at most stages of an intrusion, mainly to speed up work they already do.	Google Threat Intelligence Group (GTIG) reporting on multiple state-linked and criminal actors; Anthropic reporting on a state-sponsored campaign.	High
Malware that queries a language model while it runs exists, but most samples remain experimental.	GTIG marks PROMPTSTEAL as seen in live operations and PROMPTFLUX and PROMPTLOCK as experimental.	Medium
Agentic tooling now carries out most tactical steps in some intrusions, with humans approving the key decisions.	Anthropic estimates AI performed roughly 80 to 90 percent of tactical work in one campaign. GTIG says it has not yet seen fully autonomous pipelines against targets in the wild.	Medium
AI shortens the gap between a published weakness and working exploit code.	GTIG reports a zero-day exploit it believes was developed with AI, and actors turning public disclosures into n-day exploits.	Medium to low
AI platforms and their supporting packages are now an entry point in their own right.	GTIG reports compromised AI-related packages and malicious agent skills used for initial access.	Medium

What has been observed, and what has not

Vendor reports blur two things that matter to a defender: capability that was demonstrated, and capability that was used against a victim. The table separates them.

Activity	What the source reports	Status
PROMPTSTEAL	Data-collection malware attributed to APT28 and used against Ukraine. It asks a hosted model to write Windows commands for gathering system and document data. GTIG calls it the first observation of malware querying a model in live operations.	Observed in operations
QUIETVAULT	Credential stealer that takes GitHub and NPM tokens, then uses AI command-line tools already on the host to search for more secrets.	Observed in operations
PROMPTFLUX	Dropper that asks a model to rewrite its own code to evade signatures. GTIG says it does not demonstrate an ability to compromise a victim and that key functions were disabled.	Experimental
PROMPTLOCK	Ransomware that generates its own scripts at runtime. GTIG describes it as a proof of concept.	Experimental
AI-orchestrated espionage	Anthropic attributes a campaign against roughly 30 entities to a Chinese state-sponsored group with high confidence. It validated a handful of successful intrusions. The operators posed as a security firm and split the work into small, innocent-looking tasks. The model sometimes overstated results, including credentials that did not work.	Observed, reported by the platform provider
AI-developed exploit	GTIG identified a zero-day exploit that bypassed two-factor authentication in an open-source administration tool. It has high confidence an AI model was used, based on code style, and does not believe its own Gemini model was involved.	Observed; attribution rests on code characteristics
Rapid cloud credential theft	Mandiant investigated an actor that compromised a victim’s cloud environment, then used an AI coding assistant and an agent framework to build and run a mass credential-harvesting campaign in under six hours. Reported via press coverage of the GTIG tracker.	Observed, single case
Fully autonomous intrusion	GTIG states it has not yet observed actors deploying fully autonomous pipelines against targets in the wild.	Not observed

Where the exposure appears

1. Identity and secrets

The most consistent pattern in the reporting is credential theft. QUIETVAULT hunts for tokens. The six-hour cloud case ended in harvested third-party credentials. GTIG also found an exposed command server whose dashboard tracked more than 23,800 harvested secrets, including cloud and AI-service API keys. That figure counts secrets on one server, not confirmed victims.

One detail changes detection. In the cloud case the attacker operated from inside the victim’s own environment, so the traffic came from legitimate addresses. Controls that score reputation by source IP see nothing unusual. The signal is behavior: bulk enumeration, new keys, and API calls that no workflow explains.

2. The vulnerability window

Exploitation of vulnerabilities is now the leading way into a breach. The Verizon Data Breach Investigations Report puts it at 31 percent of breaches, ahead of credential abuse at 13 percent. Mandiant’s M-Trends puts exploits at 32 percent of identified initial infection vectors, the top vector for the sixth consecutive year, and estimates mean time to exploit at minus seven days: exploitation, on average, starts before a patch exists.

Neither report attributes this shift to AI. The AI-specific evidence is narrower: actors using commercial and open-weight models to turn public disclosures into working code. That is an assessment of direction, not a measured change in speed. Defenders should plan as if the window is shrinking, because the cost of being wrong is asymmetric.

The remediation side is weak. Verizon found only 26 percent of critical CISA Known Exploited Vulnerabilities were fully remediated, down from 38 percent, with median time to full resolution rising to 43 days from 32.

GTIG found that almost every notable tool in the criminal AI marketplace advertised support for phishing. Deepfake lures were observed in a North Korean campaign aimed at the cryptocurrency sector. Voice phishing is the second most common initial infection vector in M-Trends at 11 percent, and Verizon reports click rates in mobile-based simulations 40 percent higher than email. Helpdesk and call-back procedures are now part of the attack surface.

4. Your own AI estate

GTIG notes that frontier models themselves remain resilient to direct compromise, but the orchestration layers around them can be vulnerable. It reports a group claiming compromises of widely used packages including LiteLLM, and malicious packages disguised as agent skills. Inside the enterprise, Verizon reports regular AI use by employees rose from 15 to 45 percent in a year, 67 percent of users reach AI services through non-corporate accounts on corporate devices, and source code is the most common data type sent to external tools.

What should change

Change	Why the evidence supports it	Signal to watch
Prioritize by exploitation evidence, not severity score. Pre-approve an emergency path for exploited, internet-facing systems.	Exploitation is the top entry point and the window to exploit is shrinking. Only a quarter of known-exploited flaws were fully remediated.	Time from exploitation notice to mitigation on exposed systems
Shorten the useful life of secrets. Move developer and pipeline tokens to short-lived credentials and inventory every long-lived key.	Credential theft is the common objective across AI-enabled malware, agentic campaigns and supply-chain worms.	New API keys, token use from unfamiliar hosts, secrets in repositories
Monitor the cloud control plane for behavior, not reputation.	Attackers operating from inside a victim tenant look legitimate to network controls.	Bulk enumeration, mass secret retrieval, new automation identities
Add voice and mobile to social-engineering controls. Require call-back and out-of-band checks for helpdesk resets.	Voice phishing is the second leading initial vector. Criminal AI tooling targets phishing first.	Reset requests followed by new device or MFA registration
Govern AI tooling as privileged infrastructure. Treat model gateways and API keys as high-value secrets, and vet agent skills and packages before use.	Orchestration layers and supporting packages are being targeted, and shadow AI use is widespread.	Unapproved AI accounts, new skills or packages in build environments, AI key exposure

Hunting hypotheses for the next cycle

Look for cloud API activity that reads many secrets or lists many resources in a short period from an identity that rarely does either.
Look for developer workstations running AI command-line tools that read credential files, followed by outbound writes to public code repositories.
Look for repeated failed authentication using credentials that were never issued. Anthropic found the model sometimes produced credentials that did not work, so failures can precede success.
Look for scripts on administration tools or web shells with unusually tidy structure and explanatory comments. Treat this as a weak lead, never as proof of AI use.
Look for helpdesk resets that are followed within minutes by new MFA enrollment.

Intelligence gaps

Prevalence is unknown. Each vendor sees only its own platform. Anthropic notes its visibility is limited to its own models. GTIG is a vendor that operates a competing model, and its reporting should be read with that in mind.
Attribution of AI use is inferential. The AI-developed exploit rests on code style. Stylistic evidence can be wrong.
Success rates are not published. Anthropic reports a handful of successes among roughly 30 targets, but no equivalent figure exists for most other activity.
Defender outcomes are not measured. None of the sources shows whether AI-assisted intrusions are detected faster or slower than other intrusions.

Claim discipline: figures are reported as published by the named sources. Interpretation and recommendations are the author’s analysis.

Sources

Google Threat Intelligence Group, “GTIG AI Threat Tracker” (first edition on adversarial misuse and AI-enabled malware: PROMPTFLUX, PROMPTSTEAL, PROMPTLOCK, QUIETVAULT, FRUITSHELL), Google Cloud Blog. cloud.google.com
Google Threat Intelligence Group, “Adversaries Leverage AI for Vulnerability Exploitation, Augmented Operations, and Initial Access”, Google Cloud Blog. cloud.google.com
Help Net Security, “Threat actors are giving AI agents a bigger role in cyberattacks” (secondary report of the latest GTIG tracker, including the Mandiant six-hour case and the 23,800-secret dashboard). helpnetsecurity.com
Anthropic, “Disrupting the first reported AI-orchestrated cyber espionage campaign”. anthropic.com
Verizon, Data Breach Investigations Report, latest edition, including executive summary: initial access, KEV remediation, third-party and shadow-AI findings. verizon.com
Google Cloud / Mandiant, M-Trends, latest edition: initial infection vectors, time to exploit, hand-off times. cloud.google.com