Recorded Future says AI mostly accelerates familiar cyberattacks
Original title: AI Is Both Target and Tool for Threat Actors
Of 103 incidents, 32 used AI in malware or operations, including one Taiwan campaign with up to eight agents.
Insikt Group reviewed 103 malicious incidents from July 31, 2025, to July 31, 2026, in which AI was a vector, tool, or target. Most used AI to speed familiar activity such as supply-chain compromise, phishing, and extortion, while full automation remained rare. Developer tools were a prime target: compromised AI packages and the Shai-Hulud worm were used for credential theft, persistence, and spread, including against Claude Code. State-linked cases were mostly AI-assisted development, with a Taiwanese government campaign using up to eight agents and limited human intervention.
Unconfirmed: Twenty-three malware-related incidents are unattributed or state no motive; forecasts of wider autonomy are Insikt Group’s assessment.
- Thirty-two incidents were scored on Recorded Future’s AI Malware Maturity Model.
- Nine of those 32 were tied to state-sponsored intelligence collection.
- A late February 2026 AI proxy-package compromise added credential theft and a backdoor.
- An April package compromise harvested credentials and accessed cryptocurrency wallets.
- About one-third of incidents across both datasets were financially motivated.
Impact: Credential theft, persistence, and data theft via compromised AI tools
- Products
- Claude Code
- Malware
- Shai-Hulud
- Organizations
- Recorded FutureInsikt Group
- Countries
- Taiwan
From the original article
9 min read at recordedfuture.com
Discover 2026 trends in AI-enabled cyber threats, supply-chain vulnerabilities, state-sponsored agentic attacks, and key mitigations.
By Insikt Group® · recordedfuture.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.