AI attackers use AI models and agents to automate the slow parts of an attack: researching targets, writing lures, and searching for weak spots. Anthropic and Google both reported this in 2025. Most observed use sped up existing methods, but Anthropic documented one campaign where an AI agent did most of the work.
What does it mean when attackers use AI?
AI attackers are people who hand parts of an attack to an AI model or agent. An agent is an AI system that can run tools and take steps on its own, not just answer questions. Attackers use them to save time on research, writing and testing, the same way a business uses them for ordinary work.
The dated reports below run to November 2025. CoSA Lab does not cite a primary report for 2026 yet, so this page describes what changed up to that point.
What did reports show in August 2025?
By August 2025, Anthropic had seen criminals use an AI coding agent to carry out an attack directly. Its August 2025 report describes an extortion case aimed at at least 17 organisations, including healthcare providers and government bodies. The actor used Claude Code to automate reconnaissance, collect credentials and break into networks. Claude also helped decide which data to take and how much ransom to demand.
The same report says AI let people with limited technical skill carry out operations that once needed years of training.
What did Google see in November 2025?
Google’s Threat Intelligence Group reported mostly speed-ups, with a few early experiments. In its November 2025 analysis, state-backed actors from China, Iran, North Korea and Russia used the Gemini model at many stages: research, phishing lures, writing code and planning data theft. Google describes most of this as productivity gains rather than new abilities.
Google also found malware that calls an AI model while it runs, to generate scripts or rewrite its own code. It calls this an early step, and most of the examples were experimental. One family, which Google names PROMPTSTEAL, was used in live operations.
Google also reports that attackers got around model safeguards by posing as students in hacking competitions or as security researchers.
What changed with the GTG-1002 campaign?
The change was how much of the work the AI did without a person steering each step. In mid-September 2025, Anthropic detected a campaign that it attributes with high confidence to a Chinese state-sponsored group. The AI agent carried out about 80 to 90 percent of the work, from mapping target systems to sorting stolen data. Humans chose the targets and approved a few key steps. The campaign targeted about 30 organisations and succeeded in a small number.
Anthropic calls this the first documented case of a largely AI-run attack at that scale. It also says the AI sometimes invented results, which slowed the attackers. Our walk-through of the case covers the phases in detail.
How do AI agents go looking for weak spots?
An attacker’s agent repeats a loop at machine speed: look at a system, note what is running, test it for known flaws, and report back. Humans do the same loop slowly, and they stop when they get tired or bored. An agent can run it against many targets at once.
For a website owner, that raises the value of basics. Outdated software, forgotten admin pages and exposed files are exactly what a tireless scanner finds first.
What is the difference between old and new attacks?
| Before AI agents | With AI agents | |
|---|---|---|
| Research and phishing text | Written by hand, often with errors | Drafted quickly, in many languages |
| Searching for weak spots | Scripted scans plus human judgement | An agent judges results and decides the next step |
| Work per attacker | Limited by hours and skill | Larger share handled by the agent |
| What still needs people | Everything | Choosing targets, approving risky steps, checking results |
The table is a summary of the reports above, not a measurement. Google found mostly faster versions of familiar tactics, and Anthropic found one case of far greater autonomy.
What should a small business do about it?
Reduce what an automated scan can find. Keep software updated, protect logins with two-step verification, and remove files and plugins you no longer need. The weak-spot checklist walks through each check using free tools.
Why do the reports stress that AI also helps defenders?
Anthropic’s report on the GTG-1002 campaign argues that the same abilities that help attackers help defenders, and it urges security teams to try AI for tasks such as vulnerability assessment. Anthropic says its own threat team used Claude heavily to analyse the large amount of data produced during the investigation. For a small business, that points to testing your own site with AI agents, done with permission and limits.
What do the reports say attackers still struggle with?
Both sources describe real limits. Anthropic found that its AI agent overstated findings and sometimes made up data, which forced the attackers to check results. Google found that most AI misuse was ordinary productivity work, and that its experimental self-modifying malware was still at an early stage.
Reading the reports side by side gives a calm view. AI makes some tasks cheaper and faster for attackers. It has not made defence impossible, and the basic protections still stop most of what an automated scan finds. Read the GTG-1002 case in full if you want the detail behind that picture.
Keep the checklist short and repeat it on a schedule. Automated attackers probe constantly, so a one-off clean-up fades as new updates, plugins and staff accounts appear.
Common questions
Are hackers really using AI?
Yes. Anthropic and Google Threat Intelligence Group have each published reports of attackers using AI models, from drafting phishing messages to running parts of intrusions.
Can AI hack a website by itself?
Not reliably. In the one campaign Anthropic documented, humans still chose targets and approved key steps, and the AI made errors that needed checking.
Does AI make small businesses more likely to be attacked?
Automation lowers the cost of probing many sites, which favours attackers who scan widely. The sources reviewed here do not give figures for small businesses.
Sources
- Anthropic: Disrupting the first reported AI-orchestrated cyber espionage campaign(anthropic.com)
- Anthropic: Detecting and countering misuse of AI (August 2025)(anthropic.com)
- Google Threat Intelligence Group: Threat actor usage of AI tools(cloud.google.com)
