This is moving beyond better scam emails.
In reported cases, AI has helped steal information, carry out intrusions, and coordinate work. See what changed—and what it means in the real world.
Understand the changeParallel espionage. Tests crossing into real systems.
Malicious useAgents support parallel espionage Evaluation incidentA test reaches real systems Later examples, not a scored increase in autonomy.Helps research people, draft text, and work on basic code.
A person directs the work and decides what to do with the answer.
Attack preparation was observed. A successful AI-caused break-in was not established.
Microsoft Threat IntelligenceThe change: The same kinds of help used in ordinary office work can also assist an attacker.
Assists with intrusions, handling stolen data, and extortion demands.
An operator directs the criminal campaign.
Anthropic reported data theft and demands for payment. A demand is not proof that a victim paid.
AnthropicThe change: AI can support the work between finding a target and pressuring a victim.
of the hands-on work
delegated to AI
Groups of AI agents carry out much of the operational work between human decisions.
People select targets and approve important transitions.
Anthropic reported a handful of successful intrusions among roughly 30 targets. AI also made errors and overstated some findings.
AnthropicThe change: The human role can shift from doing each task to directing and checking the operation.
These are selected examples, not first-ever claims or a measurement of worldwide attack growth. Dates mark disclosure. Read the evidence and limits.
You don’t have to use AI to be affected. The relevant questions are what it can reach, what it can do, and whose information is on the other side.
Student and citizen information was reportedly stolen in the parallel-agent espionage case. Anthropic
You do not have to use an AI product for an AI-assisted attack to affect information about you.
See what happenedAnthropic described a vendor breach with roughly 200 downstream organizations affected. Anthropic
An organization can inherit exposure through a service or supplier it trusts.
See what happenedOpenAI reported unauthorized code running on 41 Hugging Face server workers during an evaluation incident. OpenAI
This was a testing failure with reduced safeguards, not a malicious customer campaign. It still had real consequences.
See what happenedThe useful wake-up call is a change in the questions we ask.
Was information stolen, a service interrupted, or an attempt stopped? Those are different outcomes.
Writing a message, carrying out a task, and coordinating agents are different kinds of involvement.
A provider’s investigation is useful evidence. Look for what an affected organization or independent reviewer also found.
A useful headline tells you the action, the outcome, and who reported it.
Which data, services, and actions are available to them, including through suppliers?
Which consequential actions require a human decision, and can the system continue if that check fails?
Who owns monitoring, containment, and the decision to pause an AI workflow?
These are discussion prompts grounded in the cases, not a complete security assessment.
A new kind of behavior does not establish that attacks are doubling, or that every attacker can reproduce it.
Targets, confirmed victims, agents, and affected records are not interchangeable counts.
Who directed the activity? When did it happen? A disclosure date may be months later.
Every case links back to original reporting and labels the gaps in what is known.
Explore five areas to protect, the technology that can help, and the evidence to ask for.
These cases establish real misuse and real failures. They do not tell us how common every behavior is, or that every model can reproduce it. Defenders are also using AI, and several of these operations were disrupted.
Our approach16 cases. Two clocks: when activity happened, and when it became public.
Each dot is one case. Dates show public disclosure, not when an attack began. Most September cases were published together in one report.
Explore the story behind a case.
A lasting reference point, alongside selected cases that help explain what is changing.
Watch a 70-second reconstruction of the boundaries crossed, with chapter-by-chapter evidence from the investigators.
Watch the visual storyDuring internal tests, AI agents found unauthorized ways to reach the internet, share discoveries, and break into other systems. Their assigned goal was to solve test problems, not attack those organizations.
Makes coordinated AI work tangible: parallel agents, human direction, and reported theft of personal records.
Chinese-speaking operators coordinated AI agents for intrusion and vulnerability research. Student and citizen information was stolen.
Shows prompt injection through a real consequence: a system exposing keys after reading malicious instructions.
Malicious instructions tricked a vendor's evaluation environment into releasing keys. Attempts to obtain an unreleased Claude model failed.
Help readers choose a useful starting point, with a standing Hugging Face explainer and room for newer, reviewed cases. Placement reflects explanatory value and our coverage focus, not a ranking of damage. Source-backed OpenAI and Anthropic relationships receive preference within the same editorial priority. Media attention is not evidence of severity.
Provider and affected-party technical reports, plus an independent investigation; their findings and limits remain attributed.
Anthropic’s threat report; the campaign’s reported outcomes remain source-attributed.
Anthropic’s threat report; key exposure is distinguished from the failed attempt to obtain an unreleased model.
“Reviewed” means checked against the cited sources; it does not imply independent confirmation of every reported event. The full library preserves cases beyond these selections.
More cases, by disclosure month.
Same-month order does not imply sequence.