Cyber Attacks in the Age of AI

The accessibility and power of AI has triggered a machine-versus-machine arms race. While defenders are leveraging AI to automate triaging alerts and incident response, adversaries are incorporating the same technology to compress their attack lifecycle and evade detection. AI companies, including Anthropic and Google, continuously evaluate their models and implement safeguards using automated red teaming and real-time detections. These safeguards are intended to prevent users from weaponizing agents. However, the efforts have been largely ineffective. Attackers are circumventing them by framing their prompts around legitimate scenarios and impersonating cybersecurity professionals. For example, Google discovered APT31, a PRC threat actor, pretending to be a security researcher to identify vulnerabilities in an open source tool.

Consequently, the number of AI-driven attacks has increased. According to Crowdstrike’s 2026 Global Threats Report published in February 2026, there was an 89% increase in attacks by AI-enabled adversaries year-over-year in 2025, demonstrating how this threat is significantly growing.

Adversary use of AI agents is compressing the attack timeline from reconnaissance to actions on objective. These rapid attacks are more tailored to the target through the use of custom malware and exploits. In addition, AI has lowered the skills needed to launch an attack, enabling novice attackers to carry out sophisticated operations.

The threats don’t stop there. Attackers are using AI not just to write simple scripts, but to automate their attack and evade detection entirely. Anthropic’s analysis of malicious use of AI from early 2025 to 2026 found that 84.4% of actors leveraged AI specifically for defense evasion. Thus, defenders must prepare as intrusions become faster, more sophisticated, and bypass detections by utilizing contextual data and behavioral detections to their advantage.

Increasing the Attack Surface

As organizations integrate AI agents and Model Context Protocol (MCP) into their workflows, these productivity tools inadvertently become high-privilege initial access vectors. The autonomy and access to core systems make these tools an ideal foothold for attackers, allowing them to move laterally and achieve their objectives under the guise of routine operations.

New vulnerabilities and prompt injection attacks are being discovered throughout the AI stack, allowing attackers to carry out operations using legitimate capabilities on an organization’s network. For example, DuneSlide, a pair of critical zero-click remote code execution vulnerabilities (CVE-2026-50548 and CVE-2026-50549) in the Cursor AI IDE, allows for poisoned data to overwrite its own sandbox helper file. When the agent ingests malicious instructions hidden within websites or skill files, it can be forced to execute commands outside its sandbox, providing the attacker full control over the developer's machine. While safeguards exist, many times AI agents blindly follow the instructions they are given, concealing malicious prompts within benign requests.

MCP expands this attack surface by connecting AI agents to external developer tools and sensitive data, providing additional pathways to high-value assets. If attackers poison an MCP configuration, they can hijack the agent's privileges to execute arbitrary commands. Recently, researchers discovered a vulnerability in the Amazon Q VS Code extension (CVE-2026-12957) that automatically executes MCP server configurations without user consent. Simply opening the poisoned repository grants the attacker access to the developer’s active cloud credentials as well as the ability to run commands on the developer’s machine.

Even uncompromised MCP tools are a risk. Invariant Labs reported a critical vulnerability in GitHub’s MCP integration that allowed indirect prompt injections, or “toxic flows,” within GitHub issues to execute. The agent pulled data from private repositories and leaked it into a public pull request. Since the agent performs these actions using authorized channels, the data exfiltration blends into legitimate operational traffic and bypassing security controls.

Image 1: Attack paths using AI tools as initial access vectors for subsequent exploitation

Accelerating the Attacker’s Lifecycle

After establishing an initial access path, attackers are applying AI to accelerate the stages of their attack lifecycle, reducing the time from reconnaissance to active exploitation.

Adversaries can quickly conduct in-depth reconnaissance to boost the chances of their campaigns being successful. They gather intelligence to design customized phishing lures that victims are more likely to click, such as mapping out organizational hierarchies, profiling specific targets, and identifying technologies used by the organization. AI enhances the efficacy of the lures by incorporating cultural nuances and language constructs of their targets. Suspicious indicators, such as incorrect grammar or odd phrasing, are no longer present. For instance, this strategy was employed by Iranian threat actor, APT42, to search for specific emails, profile potential business partners, and generate a phishing lure that aligns with the target’s environment.

As part of their initial process, attackers and researchers utilize AI to discover novel vulnerabilities that may have existed for years. Specifically, the Copy Fail and NGINX Rift vulnerabilities, highlighted in our recent blog, were discovered by researchers at Theori and depthfirst, respectively, using AI-powered vulnerability scanners. With the development of high-powered models that can rapidly identify vulnerabilities, such as Mythos and Daybreak, the number of zero-days is likely to grow. As of May 22, 2026, Anthropic reported that Mythos Preview has already uncovered over 10,000 vulnerabilities across its Project Glasswing partners, increasing the discovery rate for many companies by more than a factor of 10. Additionally, 90.6% of vulnerabilities discovered in open-source software were assessed as true positives, demonstrating the efficacy of AI scanners in accurately exposing hidden vulnerabilities.

Already struggling to keep pace with the influx of newly identified vulnerabilities, defenders face an even greater challenge as adversaries leverage AI to quickly weaponize them into active exploits. This trend has been observed by Hunt.io, one of ExtraHop’s intelligence partners who provides insights into novel malicious infrastructure.

Google Threat Intelligence has reported on this trend as well by disrupting a cybercriminal operation backed by AI. It began with identifying a zero-day vulnerability in an open-source sysadmin tool and then generated a Python script that bypassed 2FA, leaving behind LLM artifacts such as multiple docstrings and detailed help menus. This activity highlights how actors streamline their operations from reconnaissance to development.

Ultimately, AI significantly lowers the technical barrier to carry out cyberattacks. Inexperienced attackers can now employ AI assistants to generate sophisticated tools, eliminating the need to understand complex technologies, write code, or troubleshoot errors. Their techniques become as good as AI’s outputs. With the output consisting of zero-day exploits and custom malware containing evasion techniques, the attackers increase the likelihood of avoiding signature-based detection. Furthermore, attribution is even more difficult. AI-generated tools and code lack unique signatures that were once used to attribute activity to the APT groups behind these attacks.

Removing the Human-in-the-Loop

In addition to accelerating the attack lifecycle, adversaries are leveraging agentic AI to autonomously execute attack chains from start to finish and make decisions in real-time. For instance, Anthropic disclosed that a Chinese state-sponsored threat actor weaponized Claude Code to autonomously carry out 80-90% of the tactical operations in a cyber-espionage campaign, minimizing human oversight.

Similarly, JADEPUFFER, an agentic threat actor (ATA), has emerged as the first documented in-the-wild agentic ransomware. After gaining initial access through an unauthenticated remote code execution vulnerability in Langflow (CVE-2025-3248), the LLM agent autonomously conducted reconnaissance and pivoted to a target production database. When the agent failed to create a backdoor administrator account, it diagnosed the error, rewrote its payload, deleted its previous user, and successfully authenticated in just 31 seconds. The agent then encrypted the Nacos service configurations and deleted the database schemas without a way to recover them even if ransom was paid.

Image 2: JADEPUFFER attack chain

As autonomous agents dynamically generate code to navigate target environments, they successfully evade static signature-based detections. This real-time adaptability results in unpredictable attack chains as the agent actively works to bypass obstacles to achieve its goal.

Evading Detection

With AI agents removing the human-in-the-loop, adversaries are able to bypass defensive measures and avoid detection. A key technique in this evasion approach involves "just-in-time" modifications that dynamically generates unique code for each execution. Unlike reused malware, this approach generates a different signature for every attack. For example, HONESTCUE uses Gemini’s API to generate “just-in-time” code to download and execute fileless malware, leaving no artifacts on disk. As a result, traditional detection becomes increasingly challenging, both from a fingerprinting and technique perspective.

Dynamically generating their malware also allows attackers to weave in decoy logic and evasion prompts to disrupt human and software analysis. Inserting unused or unrelated code blocks makes the code appear benign, obfuscating their actions from humans. This was demonstrated by a Russian-linked actor (UNC6508) who targeted Ukrainian organizations using LONGSTREAM and CANFAIL, two malware families containing filler code to conceal their functionality designed to throw analysts off track. A separate technique, used specifically to evade AI analysis tools, is to hide prompts within the malware that trigger LLM safety refusals. The Hades worm, used in a recent supply chain attack, utilized this technique and contained a JavaScript comment with a prompt requesting information about biological and nuclear weapons. This prevents the malware from being analyzed if the model only reads the beginning of the file and immediately stops due to content guardrails.

Beyond payload obfuscation, AI enables attackers to rapidly deploy and rotate their infrastructure, making it more difficult to block and track. Using generative adversarial networks (GANs), adversaries train models to generate look-alike domains, providing them with multiple options to appear as trusted companies. These techniques allow threat actors, such as North Korean actor Coral Sleet, to scale operations and increase their resilience against detection and takedown.

What This Means for Defenders

Defending against AI-driven attacks might seem overwhelming, but it doesn't have to be. Understanding what threats exist and how they operate is the first step in developing a plan to protect the network.

When attackers compromise agents and use MCP integrations already in the network, they blend in with normal traffic and developer activity. Thus, analysts must look at the bigger picture. Analyzing contextual clues such as threat intelligence, asset information, and the identity of the user, around the traffic patterns provide clarity into abnormal behaviors. For example, if a hijacked agent suddenly queries an unexpected internal database or connects to anomalous external infrastructure, it generates a distinct network footprint. NDRs, such as ExtraHop RevealX, provide analysts with this broader picture because they monitor both internal and external traffic across all phases of the attack chain. Analysts can then piece together these different events with contextual data to investigate if the agent’s behavior deviates from established baselines.

Similarly, as AI dynamically creates malware or autonomously carries out attacks, analysts can’t solely rely on signature-based detections. With every execution, unique indicators are generated, making it near impossible to create a reusable signature. Instead, analysts must turn to behavioral detections. RevealX comes with hundreds of out-of-the-box behavioral detectors, allowing analysts to spot the underlying attack techniques regardless of how unique the payloads are. Additionally, even if the agent attempts to cover its tracks or evade detection by leveraging living-off-the-land techniques, analysts can still analyze this behavior because NDRs provide an unalterable record of the attacker’s actions.

As attackers are accelerating their attack lifecycle with AI, their techniques remain the same. Fundamental security practices, tools, and detections are still greatly valuable. To keep pace, organizations must transition to an agentic SOC, using AI to defend against AI. ExtraHop provides customers the ability to construct automated, accurate workflows using its detailed network telemetry and high-fidelity contextual data. By utilizing ExtraHop’s open-source MCP server with specialized agentic skills, comprehensive API, and pre-built integrations, defenders can stop attacks before total compromise.

Conclusion

Organizations’ attack surfaces are growing with the rapid adoption of AI as it introduces new paths into the network. Adversaries leverage these legitimate pathways to blend into normal operations, while utilizing the same technology to accelerate their time to compromise and evade detection. To defend against these machine-speed attacks, organizations must transition to an agentic SOC model. Deploying defensive AI and correlating high-fidelity network context can help security teams automate triage and disrupt these persistent threats in near real-time. Specifically, the immutable network telemetry provided by ExtraHop’s RevealX allows defenders to neutralize evasive techniques and meet machine-speed attacks with machine-speed defense.

Resources

• Amazon: CVE-2026-12957 and CVE-2026-12958 - Issues in Language Servers for AWS and Amazon Q Developer Plugins
• Anthropic: Building safeguards for Claude
• Anthropic: Disrupting the first reported AI-orchestrated cyber espionage campaign
• Anthropic: Mapping AI-enabled cyber threats: Insights from the LLM ATT&CK Navigator
• Anthropic: Project Glasswing: An initial update
• Armor Code: The GitHub Breach – How it Happened and Actions You Can Take
• Cato Networks: DuneSlide: Two Critical RCE vulnerabilities via Zero-Click Prompt Injection in Cursor IDE
• Crowdstrike: CrowdStrike 2026 Global Threat Report
• CyberQuay, Inc.: The AI Toolbox for Criminals: How Large Language Models Are Reshaping Cybercrime
• depthfirst: NGINX Rift: Achieving NGINX Remote Code Execution via an 18-Year-Old Vulnerability
• ExtraHop: GitHub Repo to MCP Server
• ExtraHop: GitHub Repo to Agent Skills
• Google: Advancing Gemini's security safeguards
• Google: GTIG AI Threat Tracker: Adversaries Leverage AI for Vulnerability Exploitation, Augmented Operations, and Initial Access
• Google: GTIG AI Threat Tracker: Distillation, Experimentation, and (Continued) Integration of AI for Adversarial Use
• Invariant Labs: GitHub MCP Exploited: Accessing private repositories via MCP 
• Microsoft: AI as tradecraft: How threat actors operationalize AI
• Socket: Mini Shai-Hulud, Miasma, and Hades Worms Target Bioinformatics and MCP Developers via Malicious PyPI Wheels
• Sysdig: JADEPUFFER: Agentic ransomware for automated database extortion
• The Hacker News: Critical Cursor Flaws Could Let Prompt Injection Escape Sandbox and Run Commands
• Wiz: MCP Auto-Execution: From Git Clone to Cloud Compromise in Amazon Q VS Code Extension
• Xint.io: Copy Fail: 732 Bytes to Root on Every Major Linux Distribution