Threat briefing · updated 3 November 2026
What AI did to cybersecurity in the last twelve months.
A dated record of the incidents and reports that changed the picture, in plain language, for people who run a business rather than a security team. Every entry names its source. Where a figure rests on one report, we say so. We update this page as the news does.
Timeline
November 2025 to October 2026.
The pattern: first a state actor with a budget, then criminals with a laptop, then anyone with $50.
- Nov 2025 reported
An AI runs 80 to 90% of an espionage campaign
Anthropic reported a state-linked group that wrapped a commercial coding agent in its own framework and set it on about 30 organisations: tech firms, banks, chemical manufacturers, government agencies. Humans stepped in at a handful of decision points. The attackers got past the model’s safeguards by splitting the work into pieces that each looked like legitimate security testing.
- ~30 organisations
- 80 to 90% of tactical work by AI
- safeguards split into harmless-looking tasks
- Feb 2026 annual report
Your own AI tools become the way in
CrowdStrike’s 2026 Global Threat Report documented attackers planting malicious instructions in legitimate AI tools at more than 90 organisations during 2025, then using those tools to generate commands that stole credentials and cryptocurrency. Separately, a zero-click flaw in Microsoft 365 Copilot showed that a planted email could make an assistant leak company data with nobody clicking anything.
- 90+ organisations
- prompt injection, in production
- zero-click data leak via an assistant
VentureBeat on the CrowdStrike 2026 Global Threat Report · Cloud Security Alliance, 2026
- May 2026
AI finds the holes, too
Google’s threat intelligence group intercepted the first known zero-day exploit script written with generative AI, caught during the attacker’s planning. The same spring, Microsoft’s research lab reported 16 new vulnerabilities found by agents in its own networking and authentication stack, four of them critical. Finding a new hole is no longer a rare skill.
- first AI-written zero-day exploit, intercepted.
- 16 vulnerabilities found by agents in one vendor’s own stack.
Google Threat Intelligence Group, 30 Sep 2026. · Microsoft Security blog, 7 Oct 2026.
- Jul 2026 1 to 4 July · confirmed 13 Aug
A government is mapped in four days
Autonomous agents ran 12 attack waves against Taiwan’s government. They mapped 21 connected systems, compromised 85 accounts and took 2,564 personnel records, then reached a nuclear safety agency, seven energy companies and IT suppliers. Taiwan confirmed the attack. The same month, a security firm watched a criminal agent notice a failed payload, fix it and re-send a corrected multi-step version in 31 seconds.
- 21 systems
- 85 accounts
- 2,564 records
- ~4 days
- 31 seconds to self-correct
Tenable, 14 Aug 2026 · CNN, 13 Aug 2026 · attribution rests on one firm’s report
- Sep 2026
Thousands of passwords in under six hours. And 95 million euros on a phone call.
Google reported a criminal group that took over a company’s cloud, installed a multi-agent framework there, and harvested thousands of third-party credentials in under six hours, with the agents fixing their own problems and rotating IP addresses as they went. Two weeks later Reuters reported that Fideuram, Intesa Sanpaolo’s private bank, had transferred 95 million euros after its chairman received a WhatsApp message in the group CEO’s name and a call in the AI-cloned voice of a lawyer he knew.
- thousands of credentials
- under 6 hours
- no human intervention
- 95 million euros transferred
- ~53 million recovered
The Hacker News, 8 Sep 2026 · Reuters, 25 Sep 2026, via Biometric Update
- 30 Sep 2026
The patch window closes
Google’s count of zero-days exploited in the wild rose from 8 a month in 2025 to 11 a month in 2026, and 22 in August. Most of the growth, though, was in known flaws weaponised faster: a BeyondTrust vulnerability was exploited four days after disclosure, with five more groups following inside a week. Edge and security appliances made up 14% of exploited flaws. Their advice: stop mass-patching by calendar, triage by threat, and sandbox your own AI workloads.
- 8 to 11 zero-days a month
- 22 in August
- exploited 4 days after disclosure
- edge devices 14% of exploits
- 14 Oct 2026
84% of ransomware victims saw AI in the attack
A survey of 1,200 IT and security professionals across nine countries found AI used in attacks against 84% of ransomware victims. 44% said attackers exploited the victim’s own AI agents or systems. 59% had paid a ransom at least once, and more than a third faced threats against employees.
- 84% saw AI used
- 44% own AI exploited
- 59% paid at least once
- n = 1,200
Semperis via CBS News, 14 Oct 2026 · one vendor survey
- 20 Oct 2026
100+ companies, $50 each
A researcher found about two dozen exposed control panels of Cairn, an open-source agent framework built for authorised penetration testing, and watched one operator use it against more than 1,200 websites. Agents reached over 100 companies, including Deere, SharkNinja and Cummins, planted web shells, and took just under 23 hours per successful break-in. Total spend: about $5,000 in tokens, roughly $50 per hack.
- 1,200+ sites attempted
- 100+ companies reached
- ~$50 per break-in
- ~23 hours each
- one operator
- 23 Oct 2026
Ransomware crews adopt the agents
Affiliates of the INC and The Gentlemen ransomware groups ran a framework called Phantom: a human wrote a prompt per victim and approved each step; commercial models did the intrusion. About 62 organisations were targeted, mostly industrial, manufacturing, energy and healthcare in the US, through FortiClient EMS, SimpleHelp, cPanel and VPN gateways. When a model refused, the operator reworded the request as an authorised red-team test.
- ~62 organisations
- AI-executed, human-approved
- edge devices as the way in
What it means
For a business that is not a bank or a ministry.
You are now worth attacking
At $50 a break-in, the maths no longer favours only the big targets. The October campaign went after online shops. The agents did not choose victims. They scanned for whatever was reachable.
Days, not quarters
A fix that waits for the next maintenance window is a fix that arrives after the exploit. Edge devices, VPNs and remote-support tools need to be known, listed and patched first.
Your AI tools are part of the surface
Assistants that read your email and files will act on what they read. A document in a shared drive can carry instructions. Who granted which app access to what, and when, is now a security question.
People, with better fakes
The Fideuram transfers were approved by a chairman who heard a voice he knew. A process that lets one person move money on one call is the finding. The voice is just the trigger.