“Keep going, bro. You’ve got this!” A data-driven look at how adversaries are weaponizing AI
Summary: Cisco Talos collected a corpus of prompt logs left on endpoints by cloud-based AI tools such as Claude Code, CodeX, Cursor, and Gemini, and sorted the activity into three categories: AI as malicious software engineer, AI to scale criminal campaigns, and AI for bug bounty or vulnerability research. Talos found guardrails largely failed against simple claims of ownership or CTF and bug bounty labeling, and in one case an actor controlling nearly 2,000 Android TVs used a model to build DDoS tooling after describing it as stress testing.
What's compelling: The actors did not need sophisticated encoding - a plain claim of ownership or a bug bounty label was often enough to get a model to comply, and one actor already held nearly 2,000 Android TVs before the tooling was finished. Talos expects vulnerabilities to surface faster and exploitation to arrive sooner, with attackers who need no rest or downtime.
Read the original at Cisco Talos ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026