AI isn't a theoretical risk in cybersecurity. It's operational. Threat actors have moved past experimentation, and the data backs that up: AI-assisted attacks have already cost organizations tens of millions of dollars, infiltrated government agencies, and produced ransomware sophisticated enough that the actors behind it couldn't have built it manually. UltraViolet Cyber's TIDE Team analyzed six case studies to help better understand the current AI threat landscape, and each one represents a documented shift in how attacks are designed, scaled, and executed.
AI Threat Timeline: From Emergence to Operational Use
2021 Public LLMs emerge Late 2022 ChatGPT takes off Early 2024 State actors operationalize AI Mid–Late 2025 Vibe hacking & agentic espionage 2026 AI-embedded malware matures Source: UltraViolet Cyber TIDE Team, 2026
In 18 months, AI moved from writing phishing emails to running automated infection chains, AI-embedded malware, and largely autonomous espionage campaigns. The acceleration isn't slowing. Embedded malware and agentic AI are expected to advance significantly in the next 12 months.
Case Study 01 | Nation-State / Insider Threat
North Korean state-sponsored actors have built a systematic operation to place fake employees inside Western organizations. Using AI tools, these actors superimpose their faces onto stolen identity documents, generate professional headshots for resumes, and mask both their voices and appearances during live remote job interviews.
Once hired, they function as a persistent insider threat: facilitating financial theft, exfiltrating sensitive data, and enabling long-term espionage. The operation works because AI has made it cheap and repeatable to fabricate the surface-level trust signals that hiring processes rely on, and most organizations haven't updated their verification controls to account for that.
The defensive response here isn't a technical control. It's a process change. Out-of-band verification of identity during the hiring process, including government ID checks through secure channels and video authentication protocols, is now a baseline requirement for any organization hiring remote technical staff.
Case Study 02 | Automated Extortion
In August 2025, Anthropic disrupted a threat actor who had turned an AI coding tool into a full attack platform. The attacker targeted 17 organizations across healthcare, government, and religious sectors, using AI to automate the entire kill chain: reconnaissance, credential harvesting, and network penetration, with no human doing the operational legwork.
Claude Code supported several stages of the infection chain. While the threat actor supplied preferred tactics, techniques, and procedures, Claude adapted parts of the execution rather than simply following a fixed script. What made this case particularly notable was the AI's role at the final stage. It helped the attacker decide which data to prioritize for exfiltration and calculated the optimal ransom amount based on what the victim could realistically pay.
The term "vibe hacking" emerged from this incident to describe attacks where AI reads the environment and adapts, rather than executing a fixed script.
AI-AUTOMATED KILL CHAIN — VIBE HACKING Reconnaissance AI-automated Cred. Harvesting AI-automated Net. Penetration AI-automated Data Selection AI decides Ransom Calc. AI sets the demand 17 orgs targeted"The AI helped the attacker decide which data to exfiltrate and how to calculate the most effective ransom amount to demand in the final note."
The attack spanned sectors with different risk profiles, which tells us this wasn't targeted in the traditional sense. The AI was scanning for opportunity, and organizations in healthcare and government were as exposed as any other target.
Case Study 03 | Nation-State / Agentic AI
A Chinese state-sponsored threat actor ran an espionage campaign against 30 organizations using an AI agent to handle 80 to 90 percent of all tactical work. That included vulnerability discovery, exploitation, and lateral movement, executed at request rates that human operators described as "physically impossible" to achieve manually.
This is the first publicly documented case of a fully agentic AI attack: a human picks the target, and the AI handles execution. The campaign had limitations, fabricated data in some instances and failed to gain access to all targets, but it establishes a clear pattern. Agentic AI attacks will get more reliable as the underlying models improve.
For defenders, this raises the required response speed. If an AI agent is probing your environment at machine rates, detection and containment windows measured in days or even hours are no longer sufficient.
Case Studies 04 & 05 | AI-Embedded Malware
PromptSteal, attributed to Russia's APT28, represents a meaningful departure from how malware has historically operated. After compromising a system, the malware calls an LLM to generate and execute Windows commands in real time rather than relying on a pre-written instruction set.
The practical consequence is that defenders can't detect it by signature. The malware has no fixed behavioral fingerprint. Each command is generated fresh based on what the AI observes on the compromised host. Traditional endpoint detection tools built for static-signature analysis are largely blind to this approach.
PromptFlux takes the concept in PromptSteal further. It uses what its developers called a "thinking robot module" to prompt an AI, Gemini in observed samples, to rewrite its own source code during active execution. The malware doesn't just adapt commands. It changes what it fundamentally is.
This is still experimental, and reliability is a known limitation of current versions. But the direction of travel is clear: malware that evolves during deployment is a category, not a one-off. Security teams relying on behavior baselines or static detections will face increasing blind spots as these tools mature.
"AI-embedded malware carries a 'thinking' module that allows it to adapt post-infection. These tools are significantly harder to detect because they do not rely on static signatures and can evolve their behavior to evade security measures."
Case Study 06 | Ransomware-as-a-Service
In January 2025, a threat actor operating under the handle "TssXX25" was caught using Claude to produce and sell fully functional ransomware. The tool wasn't rudimentary. It included Chacha20 encryption, anti-EDR capabilities, and anti-recovery functions, the kind of technical features that previously required a skilled developer to implement.
Anthropic's assessment was direct: TssXX25 did not have the technical skills to build this independently. The AI filled that gap. What makes this case significant isn't the specific malware. It's the precedent. Entry-level threat actors can now access sophisticated capabilities through AI without writing a line of functional code themselves.
AI-Generated Ransomware Features
Source: Anthropic assessment, January 2025
Ransomware-as-a-service already lowered the barrier once by making turnkey attack kits available for rent. AI lowers it again by making it possible to build those kits without any technical background at all. The population of potential ransomware operators just grew significantly larger.
"Anthropic assessed that the actor lacked the technical skills to build such a tool alone, proving that AI is effectively lowering the barrier for entry, allowing entry-level actors to launch sophisticated ransomware-as-a-service operations."
The defensive side is keeping pace. Tools like Anthropic's Mythos are now used by defenders to autonomously identify and patch thousands of vulnerabilities before they can be exploited. The same AI capabilities threat actors are using are also available to security teams, and organizations that are actively deploying AI for defense, and not waiting to do so, are better positioned.
Mythos vs. Standard AI — Offensive Capability Benchmark
Mythos (Restricted) 181 exploits Opus 4.6 (Standard) 2 working exploitsAnthropic's restricted Mythos model produced 181 working exploits vs. Opus 4.6's 2 in a single comparative test. Mythos remains gated to Project Glasswing partners. On June 9, 2026, Anthropic released Fable 5 as a public, safeguarded sibling. Source: UltraViolet Cyber TIDE Team, 2026.
Out-of-Band Verification
Verify all high-risk requests, financial transfers, identity checks during hiring, and access approvals through a separate communication channel. Email and video calls alone are no longer sufficient verification for anything consequential.
Update Social Engineering Training
Poor grammar and obvious spelling errors are no longer reliable signals. Modern AI-assisted attacks are grammatically clean. Training should focus on identifying urgency, unusual request patterns, and the legitimacy of what's being asked, not how it's written.
New Opus 4.9 model is available to existing Claude users
Hello,
Opus 4.9 is now rolling out to existing Claude users. It delivers faster, more in-depth responses to help further streamline your work.
To activate the upgrade on your account, install the latest Claude desktop client using the secure link below. Access is limited during the initial rollout, so please complete the installation within 24 hours to avoid any interruption to your access.
Click here to installThank you,
The Claude Team
© 2026 Anthropic PBC · You received this email because you use Claude · Unsubscribe
This AI-generated phishing email is grammatically perfect, visually convincing, and creates urgency — exactly the signals your team needs to learn to question. Source: UltraViolet Cyber TIDE Team webinar, 2026.
Prioritize Proactive Patching
With AI agents capable of scanning for and exploiting vulnerabilities at machine speeds, the window between public disclosure and active exploitation is shrinking. Internet-facing devices need to be patched on a timeline measured in hours, not a quarterly schedule.
| Threat | What It Does Today | Why It Matters |
|---|---|---|
| Fraudulent IT Workers | AI fabricates identity docs, headshots, and live interview appearances | Opens the door to insider threats, financial theft, and long-term espionage |
| Vibe Hacking | AI automates full kill chain; decides which data to steal and how much to demand | Low-skill actors can run sophisticated extortion with minimal human input |
| AI-Enabled Espionage | 80–90% of tactical work automated at machine speed across 30 organizations | First fully agentic attack on record; reliability issues now, but improving fast |
| AI-Embedded Malware | Calls LLMs at runtime; rewrites own code to evade signature detection | Harder to block and analyze; lowers the bar for future threat actors |
| AI-Built Ransomware | Entry-level actors produce enterprise-grade RaaS tools with zero dev skills | Ransomware-as-a-service operator pool just expanded to include anyone |
These six cases are a snapshot of what UltraViolet Cyber's TIDE team is tracking across the current threat landscape. Watch the full on-demand recording for the complete session, including the TIDE team's analysis of defensive tools and specific TTPs your team should be monitoring.
Watch the On-Demand RecordingSources
UltraViolet Cyber TIDE Team. "The AI Threat Landscape: Separating Hype From Reality." Webinar, June 2026. | U.S. Department of Justice. North Korean IT Worker Fraud Indictments. DOJ.gov, 2024. | Anthropic. Vibe hacking disruption disclosure. Anthropic.com, August 2025. | Anthropic. TssXX25 ransomware assessment. Anthropic.com, January 2025. | Unit 42, Palo Alto Networks. North Korean Deepfake Interviewees. 2024.