Skip to content
NewA calmer, faster ZeroHour
StoryThreat actorhigh

Insikt review finds 103 AI-linked incidents, including Taiwan agent campaign

3 sources · 3 articlesFirst reported Updated ()1
What's new

First merged summary.

Merged summary · x-ai/grok-4.7 · rewritten as coverage arrivesSummaries by Vani AI

Recorded Future’s year-long review of 103 AI-linked incidents finds automation rare, with a Taiwan campaign using up to eight agents.

Insikt Group reviewed 103 malicious incidents from July 31, 2025, to July 31, 2026, in which AI was a vector, tool, or target. Thirty-two used AI inside malware or operations; nine of those were tied to state-sponsored intelligence collection, according to Recorded Future. Most activity sped familiar phishing, extortion, and supply-chain work, and full automation remained uncommon. A Taiwanese government campaign used up to eight agents with limited human intervention; GBHackers, citing Dream’s recovery of a Hermes and OpenClaw workspace, says early-July waves cracked 85 accounts and took more than 2,500 personnel records. Compromised AI packages, including a late-February proxy package, an April wallet campaign, May’s Shai-Hulud spread to Claude Code, and TeamPCP’s LiteLLM 1.82.7 and 1.82.8, were used for credential theft and persistence.

Key facts
  • Review covered 103 incidents from July 31, 2025, through July 31, 2026.
  • Thirty-two cases used AI in malware or operations; nine were state-linked.
  • About one-third of incidents across both datasets were financially motivated.
  • Taiwan waves July 1–4, 2026: 85 accounts and over 2,500 personnel records.
  • TeamPCP compromised LiteLLM 1.82.7 and 1.82.8 after poisoning Trivy.
  • Published indicators omit hashes, domains, URLs, IP addresses, and file paths.
Analyze this story with Vani AIImpact, who is affected and what defenders should do, in a new chat

Timeline

dated events in the reporting · oldest first
  1. Jul 31, 2025Insikt Group’s AI-linked incident review window begins. · Recorded Future
  2. Jul 1, 2026Taiwan campaign waves begin, agents labeled A through Q. · GBHackers
  3. Jul 4, 2026Reported Taiwan agent waves end after 12 waves. · GBHackers
  4. Jul 31, 2026Insikt review window of 103 incidents closes. · Recorded Future
  5. Nov 11, 2026Recorded Future publishes the Insikt Group review. · Recorded Future

What each outlet adds

beyond the shared facts
  • Recorded FutureMaturity-model scoring and the share of financially motivated incidents.
  • GBHackersDream workspace recovery, account and record counts, and LiteLLM versions.
  • Cyber Security NewsThe other 71 incident categories, ClickFix lures, and omitted indicators.
Products
LiteLLMHermesOpenClawClaude Code
Threat actors
TeamPCPGREYVIBEAPT36The Gentlemen
Malware
CanisterWormShai-Hulud
Victims
Taiwanese government entities
Organizations
Recorded FutureInsikt GroupDreamBitdefenderWithSecure
Countries
TaiwanIndiaUkraine
AI models
ChatGPTGemini

Coverage

oldest first · one row per article · UTC
  1. · 2d ago Recorded FutureFirst report

    Recorded Future says AI mostly accelerates familiar cyberattacks

    Of 103 incidents, 32 used AI in malware or operations, including one Taiwan campaign with up to eight agents.

  2. · 13h ago GBHackers

    AI agents used in campaign against Taiwanese government systems

    Across 12 waves in early July 2026, agents cracked 85 accounts and took more than 2,500 personnel records.

  3. · 13h ago Cyber Security News

    Hackers target AI coding tools to steal credentials, report finds

    Recorded Future counted 103 AI-linked incidents over a year; only 32 involved AI inside malware or offensive operations.