02 · The AI Question

What is AI changing in real-world outcomes, and who can see it?

AI's effect on security can't be read off one chart. It shows up where someone can observe it: model providers watching their own models, incident responders taking intrusions apart, victims reporting fraud. This page holds the competing explanations, each with a fixed date for testing it against named series, and the ledger of documented AI-assisted attacks, graded by their evidence, with defensive tools and demonstrations listed apart.

The hypotheses under test

7 explanations of how AI could be changing outcomes, each written down with what the best non-AI explanation predicts instead, the observation that would refute it, the series that tests it and a fixed evaluation date. Several of those series, and some of the readings, already existed when the hypotheses were written: some windows include months already published, and one test rests on event studies read before it was written. A hypothesis is a test made in advance only for data published after its registration date; against older data it is a check, not a prediction. Hypotheses, not findings. None is shown as true or false until its evaluation date, and a reading that fits one is 'not refuted by this series', never proof that AI caused it. Factual premises carry their source and the span they rest on.

H1
No measurable change in outcomes yet
not yet evaluated

If AI is the cause: If AI is already changing outcomes at population scale, at least one outcome series breaks from its own recent trend in the year after registration.

Best non-AI explanation: If AI's effect is still below what these instruments can detect, both series stay within their recent trend and its usual month-to-month swing.

Refuted if: Refuted if either of these holds. (a) Over the twelve months of KEV listings 2026-11 to 2027-10, the mean of the monthly median days from CVE publication to KEV listing runs below the least-squares line through the monthly medians of 2025-11 to 2026-10 by more than the largest gap between any of those twelve baseline months and that line (months with fewer than 5 KEV entries are skipped; fewer than 8 usable months in either window gives no reading). (b) Leak-site victims posted within 30 days of month end over 2026-11 to 2027-04 are at least 50% above the same six months a year earlier. The baseline months existed at registration; every reading that can refute this is of months after 2026-10-22.

Tested on: monthly median days from CVE publication to KEV listing (Live); monthly ransomware leak-site victims posted within 30 days of month end (Live) · registered 2026-10-22 · evaluates on 2027-12-31
H2
Methods changed, intrusion success did not
not yet evaluated

If AI is the cause: AI that makes attacks better raises the share of attempts that reach an intrusion, so documented incidents move up the outcome ladder (attempt → intrusion → victims named → loss quantified).

Best non-AI explanation: AI changes how attackers work without changing how often they get in: ledger rows stay concentrated at attempt and disrupted, and intrusion counts follow non-AI drivers.

Refuted if: Refuted if, among AI-involved ledger rows dated 2026-11-01 to 2027-10-31, the share whose recorded outcome is intrusion or further is at least 10 percentage points above the same share among rows dated before 2026-10-22, with at least 20 rows in the later set (fewer gives no reading).

Tested on: the AI ledger's recorded outcomes, by date (this page) · registered 2026-10-22 · evaluates on 2027-12-31
H3
AI shows up in fraud before intrusion
not yet evaluated

If AI is the cause: AI's first measurable outcome effect is in fraud (deepfake, voice-clone and impersonation losses), because generation is what current models do best.

Best non-AI explanation: Fraud losses grow with the reporting base and with existing scam industries, at the same rate as non-AI fraud categories. A faster rise in AI-tagged losses can also come from more victims noticing and naming AI, since the tag depends on the victim.

Refuted if: Refuted if, in the 2026 IC3 edition (expected in 2027) against the 2025 edition, AI-related adjusted losses grow no faster than IC3 total adjusted losses. The 2025 edition, the only one with the AI descriptor, is the baseline; the first reading is an edition published after registration.

Tested on: IC3's figures, including its AI-tagged ones (Outcomes) · registered 2026-10-22 · evaluates on 2027-06-30
H4
Faster, not costlier
not yet evaluated

If AI is the cause: AI compresses attacker timelines (time to exploit, breakout, dwell) without raising the loss per incident.

Best non-AI explanation: Timelines and losses move together with ransomware economics and enforcement; a speed-up without a cost change is not specific to AI.

Refuted if: Refuted if the median days from CVE publication to KEV listing for KEV entries added 2026-11 to 2027-10 is not lower than for entries added 2025-11 to 2026-10, or if any per-incident loss figure (unit USD per incident, per claim or per payment) in a source edition published between 2026-10-23 and 2027-11-30 is higher than the same metric in that source's last edition published before 2026-10-22.

Tested on: monthly median days from CVE publication to KEV listing (Live); per-incident loss figures (Outcomes) · registered 2026-10-22 · evaluates on 2027-12-31
H5
The change is a change in measurement
not yet evaluated

If AI is the cause: AI-attributed outcomes rise across sources whose counting rules did not change.

Best non-AI explanation: Apparent rises start on the date a source changed how it counts. Example premise: SEC 8-K Item 1.05 disclosures began on a fixed date (SEC press release 2023-139: "The Form 8-K and Form 6-K disclosures will be due beginning the later of 90 days after the date of publication in the Federal Register or December 18, 2023."; source).

Refuted if: Refuted if at least four of these six monthly series are higher over 2026-11 to 2027-10 than over 2025-11 to 2026-10, each still higher after removing every month within six months of a dated change in how that series is counted: SEC 8-K Item 1.05 filings, SEC 8-K Item 8.01 cybersecurity disclosures, ransomware leak-site victims posted within 30 days, breaches added to Have I Been Pwned, breach notices filed with the California AG, and HIPAA breaches reported to HHS OCR. A series with fewer than eight usable months in either window gives no reading for that series, and fewer than five readable series gives no reading. Breach series added after 2026-10-22 are not read by this test.

Tested on: the dated changes in how sources count (Methodology); monthly ransomware leak-site victims (Live) · registered 2026-10-22 · evaluates on 2027-12-31
H6
Cashing out binds, not access
not yet evaluated

If AI is the cause: If AI widens access, leak-site victims and ransom payments both rise with KEV additions.

Best non-AI explanation: If cashing out binds, victims posted can rise while the share that pays falls. Premise: Coveware puts its cases' payment rate at a historical low ("fell to a historical low of 23% in Q3 2025" (source)).

Refuted if: Refuted if Coveware's quarterly payment rate (all impact types) rises in two consecutive quarters among those first reported after 2026-10-22 (2026-Q4 onward, each compared with the quarter before it), while leak-site victims posted within 30 days of month end over those two quarters are higher than in the same two quarters a year earlier.

Tested on: the share of Coveware's ransomware cases that paid, by quarter (Outcomes); monthly ransomware leak-site victims (Live) · registered 2026-10-22 · evaluates on 2027-08-31
H7
Enforcement, not AI, moves the ransomware counts
not yet evaluated

If AI is the cause: Distinct leak-site groups and victims rise steadily, unrelated to takedown dates.

Best non-AI explanation: Group counts jump after takedowns as affiliates rebrand. Premise: Operation Cronos disrupted LockBit (NCA: "The National Crime Agency is today, Tuesday 20 February, revealing details of an international disruption campaign targeting LockBit", 2024-02-20; source).

Refuted if: Refuted if, for the first law-enforcement takedown of a ransomware leak site dated after 2026-10-22 and added from a primary source to the list of dated counting changes, the distinct-group count's rise in the six months after it is no larger than its rise in the six months before. If no such takedown is recorded by 2027-07-31, there is no reading.

Tested on: monthly ransomware leak-site victims (Live); active leak-site groups per month, counted within 30 days of month end (the public dataset) · registered 2026-10-22 · evaluates on 2028-01-31

Written 2026-10-22, with every evaluation date fixed then. The conjectures with code-computed readings are on Analysis; the outcome series these test are on Outcomes and Live.

Who can see what

The ledger holds 23 documented AI-assisted attack campaigns, 2024 to 2026, each re-read from its primary document. The grid counts them by who reported them and which kind of AI tool was involved; a campaign that two observers reported appears in both rows, so the rows are never added together. Defensive tools and demonstrations are not attacks and are listed separately below. These counts are what each observer saw, not how common each kind of AI use is. A model provider can only report misuse of its own models, so provider reports pile up in the columns they can see; an open-weight model run on the attacker's own machine reports to no one.

The attack count reads 14 published documents: 7 model providers' reports (OpenAI, Anthropic and Google GTIG), a victim's own statement (Arup), 2 security researchers' reports (HP Wolf Security and Zenity Labs), a CERT advisory (CERT-UA) and 3 incident-response and threat-intel reports (Wiz, Palo Alto Networks Unit 42 and Cisco Talos). It holds what those documents describe, so it is a partial record, not a census of AI-assisted attacks.

Who reported it	Closed model, provider-hosted	Open-weight, third-party hosted	Open-weight, self-hosted	Attack harness or agent	Deepfake generator	Tool not stated
Model providers (their own misuse reports) a provider sees only traffic to its own models; a model run on the attacker's own hardware sends it nothing	8	none recorded	no source can observe this	6	none recorded	none recorded
Incident-response and threat-intel teams they see what forensic artifacts and collected samples reveal; a model provider's threat-intel team reporting tools other than its own models counts here	none recorded	1	none recorded	6	none recorded	none recorded
Governments and CERTs they see what victims and partners report to them	none recorded	1	none recorded	none recorded	none recorded	none recorded
Security researchers and vendors they see the samples and tools they collect	none recorded	none recorded	none recorded	1	none recorded	1
Victims' own statements a victim says what it saw done to it, such as a deepfaked video call; it rarely knows which model made it	none recorded	none recorded	none recorded	none recorded	1	none recorded
Victim-side reports (IC3, breach registries, SEC filings) victims can report that AI was involved, not which kind: a complaint, breach notice or 8-K never records the model or tool an attacker used	no source can observe this	no source can observe this	no source can observe this	no source can observe this	no source can observe this	IC3 2025: 22,364+ complaints, $893M+ lost, mentioning AI · IBM 2026: 25% of malicious breaches reported AI-drivenlower bounds, not ledger cases

Source: the AI ledger's public data file in Substrate, one primary document per row (every document is listed on Methodology), fetched 2026-10-26; the victim-side cell reads 2025 IC3 Annual Report and IBM's 2026 Cost of a Data Breach report, shown in full on Outcomes.

The ledger holds 1 AI-enabled fraud or deepfake case: Arup, 2024 (loss quantified, confirmed by an authority or the victim). IC3 alone received 22,364+ complaints mentioning AI in 2025, so the ledger's fraud cases are the few a public document names, a floor and never a count of AI-enabled fraud; its extraction has not yet reached court filings or police statements, where more such cases are documented.

“No source can observe this” marks a cell no observer of that kind can see by construction. “None recorded” means the ledger holds no row there yet, which is not evidence that it never happens. The victim-side row's one open cell holds victims' own AI reports, which say AI was involved but never which kind; they are lower bounds and are not ledger cases. The model-provider row holds only providers' reports of misuse of their own models; a provider's threat-intel team reporting someone else's model or tool is counted with the threat-intel teams. Counts by kind of AI tool are what an observer could see, not prevalence: provider reports only see their own models, and open-weight self-hosted use leaves no provider telemetry. Grades, tool class, stage and outcome come from a language model reading the quoted passage, with the rules above applied in code. No human has labelled the rows. Count campaigns, not rows, when counting attacks: some campaigns appear once per observer.

The ledger, by evidence

confirmed beyond the provider's report

of 23 attack campaigns; independently, or by an authority or the victim

self-reported by a model provider

no outside confirmation in the document

asserted

their documents hedge the AI use or gives no evidence a reader can check

with a quantified loss

campaigns whose document puts a figure on the harm

defensive tools and demonstrations

listed separately, never counted as incidents

Published	Actor or tool	Reported by	Tool class	Stage	Reached	Evidence grade	Primary source
2024-02-14	Charcoal Typhoon	OpenAI	Closed model, provider-hosted	resource development	disrupted	self-reported by the model provider	Disrupting malicious uses of AI by state-affiliated threat actors Quoted span “Charcoal Typhoon used our services to research various companies and cybersecurity tools, debug code and generate scripts, and create content likely for use in phishing campaigns.”
2024-02-14	Crimson Sandstorm	OpenAI	Closed model, provider-hosted	resource development	disrupted	self-reported by the model provider	Disrupting malicious uses of AI by state-affiliated threat actors Quoted span “Crimson Sandstorm used our services for scripting support related to app and web development, generating content likely for spear-phishing campaigns, and researching common ways malware could evade detection.”
2024-02-14	Emerald Sleet	OpenAI	Closed model, provider-hosted	resource development	disrupted	self-reported by the model provider	Disrupting malicious uses of AI by state-affiliated threat actors Quoted span “Emerald Sleet used our services to identify experts and organizations focused on defense issues in the Asia-Pacific region, understand publicly available vulnerabilities, help with basic scripting tasks, and draft content that could be used in phishing campaigns.”
2024-02-14	Forest Blizzard	OpenAI	Closed model, provider-hosted	recon	disrupted	self-reported by the model provider	Disrupting malicious uses of AI by state-affiliated threat actors Quoted span “Forest Blizzard used our services primarily for open-source research into satellite communication protocols and radar imaging technology, as well as for support with scripting tasks.”
2024-02-14	Salmon Typhoon	OpenAI	Closed model, provider-hosted	resource development	disrupted	self-reported by the model provider	Disrupting malicious uses of AI by state-affiliated threat actors Quoted span “Salmon Typhoon used our services to translate technical papers, retrieve publicly available information on multiple intelligence agencies and regional threat actors, assist with coding, and research common ways processes could be hidden on a system.”
2024-05-17	Arup	Arup (spokesperson statement reported by CNN)	Deepfake generator	fraud impersonation	loss quantified	confirmed by an authority or the victim	British engineering giant Arup revealed as $25 million deepfake scam victim \| CNN Business Quoted span “London-based company Arup has confirmed it was the victim of a deepfake scam in Hong Kong.”
2024-09-24	AsyncRAT	HP Wolf Security	Tool not stated	resource development	intrusion	asserted	HP Wolf Security Uncovers Evidence of Attackers Using AI to Generate Malware Quoted span “The structure of the scripts, comments explaining each line of code, and the choice of native language function names and variables are strong indications that the threat actor used GenAI to create the malware. The attack infects users with the freely available AsyncRAT malware, an easy-to-obtain infostealer which can record victim’s screens and keystrokes.”
2025-07-17	LAMEHUG	CERT-UA	Open-weight, third-party hosted	post exploitation	intrusion	confirmed by an authority or the victim	Кібератаки UAC-0001 на сектор безпеки та оборони із застосуванням програмного засобу LAMEHUG, що використовує LLM (велику мовну модель) (CERT-UA#16039) Quoted span “Очевидною особливістю LAMEHUG є застосування LLM (великої мовної моделі), використаної для генерації команд на основі їх текстового представлення (опису).”
2025-08-27	a sophisticated cybercriminal	Anthropic	Attack harness or agent	exfiltration extortion	intrusion	self-reported by the model provider	Detecting and countering misuse of AI: August 2025 Quoted span “The threat: We recently disrupted a sophisticated cybercriminal that used Claude Code to commit large-scale theft and extortion of personal data.”
2025-08-27	s1ngularity	Wiz	Attack harness or agent	recon	intrusion	independently confirmed	s1ngularity: supply chain attack leaks secrets on GitHub: everything you need to know \| Wiz Blog Quoted span “In the first phase of the attack, the malware leveraged AI command-line tools (including Claude, Gemini, and Q) to aid in their reconnaissance efforts, and then exfiltrated the stolen data to publicly accessible attacker-created repositories within victims’ GitHub accounts.”
2025-11-05	PROMPTFLUX	Google GTIG	Closed model, provider-hosted	resource development	disrupted	self-reported by the model provider	GTIG AI Threat Tracker: Advances in Threat Actor Usage of AI Tools \| Google Cloud Blog Quoted span “Further examination of PROMPTFLUX samples suggests this code family is currently in a development or testing phase since some incomplete features are commented out and a mechanism exists to limit the malware's Gemini API calls.”
2025-11-05	PROMPTSTEAL	Google GTIG	Open-weight, third-party hosted	post exploitation	intrusion	independently confirmed	GTIG AI Threat Tracker: Advances in Threat Actor Usage of AI Tools \| Google Cloud Blog Quoted span “PROMPTSTEAL is a data miner, which queries an LLM (Qwen2.5-Coder-32B-Instruct) to generate commands for execution via the API for Hugging Face, a platform for open-source machine learning including LLMs.”
2025-11-05	QUIETVAULT	Google GTIG	Attack harness or agent	credential access	intrusion	asserted	GTIG AI Threat Tracker: Advances in Threat Actor Usage of AI Tools \| Google Cloud Blog Quoted span “In addition to these tokens, QUIETVAULT leverages an AI prompt and on-host installed AI CLI tools to search for other potential secrets on the infected system and exfiltrate these files to GitHub as well.”
2025-11-13	Chinese state-sponsored group	Anthropic	Attack harness or agent	initial access	intrusion	self-reported by the model provider	Disrupting an AI-orchestrated cyber espionage campaign Quoted span “The threat actor—whom we assess with high confidence was a Chinese state-sponsored group—manipulated our Claude Code tool into attempting infiltration into roughly thirty global targets and succeeded in a small number of cases.”
2026-05-11	Hexstrike	Google GTIG	Attack harness or agent	recon	attempt	asserted	Adversaries Leverage AI for Vulnerability Exploitation, Augmented Operations, and Initial Access \| Google Cloud Blog Quoted span “For example, we recently analyzed a suspected PRC-nexus threat actor deploying agentic tools like Hexstrike and Strix against a Japanese technology firm and a prominent East Asian cybersecurity platform.”
2026-06-30	Strix	Zenity Labs	Attack harness or agent	recon	attempt	independently confirmed	Real-World AI Infrastructure Attacks: What Honeypots Reveal Quoted span “In one incident, a threat actor configured Strix, an autonomous AI pentesting agent, to run on the hijacked infrastructure and directed it against a live French e-commerce website.”
2026-07-30	Hermes	Palo Alto Networks Unit 42	Attack harness or agent	vuln discovery	intrusion	independently confirmed	Chinese-Speaking Threat Actor Harnesses AI Models for Autonomous Cyberattacks Quoted span “The actor, operating under the aliases knaithe and KnYuan , leveraged DeepSeek , via the Hermes Agent framework, as their autonomous offensive operator.”
2026-08-20	UAT-10147	Cisco Talos	Attack harness or agent	resource development	intrusion	independently confirmed	UAT-10147: Chinese-speaking adversary integrates agentic AI into post-compromise operations Quoted span “Additionally, UAT-10147 is leveraging AI-driven tools to build end-to-end offensive workflows.”
2026-09	GTG-10007	Anthropic	Attack harness or agent	resource development	intrusion	self-reported by the model provider	Countering misuse of AI: September 2026 / Anthropic Quoted span “In doing so, they have designed and implemented autonomous workflows by which they can direct Claude to conduct vulnerability and exploit research agentically around the clock.”
2026-09	GTG-20006	Anthropic	Closed model, provider-hosted	resource development	intrusion	self-reported by the model provider	Countering misuse of AI: September 2026 / Anthropic Quoted span “Further along the spectrum, threat actors directed Claude to execute operations (such as running commands against victim networks, harvesting credentials, and exfiltrating data) with a human making each individual targeting decision (GTG-20006).”
2026-09	GTG-50014	Anthropic	Attack harness or agent	exfiltration extortion	intrusion	self-reported by the model provider	Countering misuse of AI: September 2026 / Anthropic Quoted span “In a different compromise, the actor leveraged Claude in a supply chain compromise of a software-as-a-service (SaaS) vendor to accelerate reconnaissance and to enable data exfiltration.”
2026-09	GTG-50020	Anthropic	Attack harness or agent	credential access	intrusion	self-reported by the model provider	Countering misuse of AI: September 2026 / Anthropic Quoted span “Multiple groups including GTG-10002, as previously reported , developed and utilized their own autonomous attack frameworks; while other groups including GTG-50020 and GTG-50029 leveraged publicly available offensive agent frameworks like PentAGI .”
2026-09	GTG-50029	Anthropic	Attack harness or agent	initial access	intrusion	self-reported by the model provider	Countering misuse of AI: September 2026 / Anthropic Quoted span “GTG-50029 provides another example of an actor embracing the use of AI across the kill chain.”
2026-09-08	Recon	Google GTIG	Attack harness or agent	recon	intrusion	asserted	GTIG AI Threat Tracker: From Prompting to Autonomy – The Evolution of Adversarial AI \| Google Cloud Blog Quoted span “Automated Reconnaissance and Credential Management Framework: GTIG identified an exposed Command and Control (C2) server hosting an automated reconnaissance and credential management framework dubbed "Recon." Initial directory listings exposed specialized agentic configuration and knowledge files—including AGENTS.md, KNOWLEDGE.md, and agentic_vuln_research.md—alongside modular framework directories such as .openclaw/ and memory/ .”
2026-09-08	UNC6240	Google GTIG	Closed model, provider-hosted	initial access	attempt	self-reported by the model provider	GTIG AI Threat Tracker: From Prompting to Autonomy – The Evolution of Adversarial AI \| Google Cloud Blog Quoted span “UNC6240 (also known as ShinyHunters), a financially motivated threat cluster specializing in high-volume software-as-a-service (SaaS) data exfiltration and extortion operations, has also integrated AI tactics across various stages of the attack lifecycle.”

Dates are the primary document's publication date; the attack usually happened earlier. A campaign counts once in the figures above even when several observers reported it; its strongest grade and furthest outcome count. A language model reads each row's quoted span and assigns its grade, tool class, stage and outcome against the written definitions on Methodology. A person has not yet checked those labels against the documents, so each row links its document and shows its quoted span for anyone to check; corrections are recorded in the dataset. The extraction code is public · fetched 2026-10-26 · 2 candidate rows dropped (document unreadable or undated).

Defensive tools and demonstrations (not attacks)

AI used to find or fix bugs, and capabilities shown in labs and competitions. They show what AI can do, not harm done, so none is counted above.

Published	Tool or team	Reported by	Kind	Tool class	Primary source
2024-10	Big Sleep	Google Project Zero	Defensive tool	AI agent or harness	From Naptime to Big Sleep: Using Large Language Models To Catch Vulnerabilities In Real-World Code Quoted span “We believe this is the first public example of an AI agent finding a previously unknown exploitable memory-safety issue in widely used real-world software.”
2025-06-24	XBOW	XBOW	Demonstration	AI agent or harness	How XBOW Ranked #1 in Autonomous Penetration Testing \| XBOW Quoted span “XBOW is a fully autonomous AI-driven penetration tester.”
2025-07-15	Big Sleep	Google	Defensive tool	AI agent or harness	A summer of security: empowering cyber defenders with AI Quoted span “Since then, Big Sleep has continued to discover multiple real-world vulnerabilities, exceeding our expectations and accelerating AI-powered vulnerability research. Most recently, based on intel from Google Threat Intelligence, the Big Sleep agent discovered an SQLite vulnerability ( CVE-2025-6965 ) — a critical security flaw, and one that was known only to threat actors and was at risk of being exploited.”
2025-08-08	Team Atlanta	DARPA	Demonstration	Tool not stated	AI Cyber Challenge marks pivotal inflection point for cyber defense \| DARPA Quoted span “A cyber reasoning system (CRS) designed by Team Atlanta is the winner of the DARPA AI Cyber Challenge (AIxCC), a two-year, first-of-its-kind competition in collaboration with the Advanced Research Projects Agency for Health (ARPA-H) and frontier labs.”
2025-08-26	PromptLock	ESET	Demonstration	Open-weight, self-hosted	First known AI-powered ransomware uncovered by ESET Research Quoted span “The PromptLock malware uses the gpt-oss-20b model from OpenAI locally via the Ollama API to generate malicious Lua scripts on the fly, which it then executes.”
2025-10-30	Aardvark	OpenAI	Defensive tool	AI agent or harness	Introducing Aardvark: OpenAI’s agentic security researcher Quoted span “Aardvark represents a breakthrough in AI and security research: an autonomous agent that can help developers and security teams discover and fix security vulnerabilities at scale.”
2026-03-06	Anthropic’s Frontier Red Team	Mozilla	Defensive tool	Tool not stated	Hardening Firefox with Anthropic’s Red Team \| The Mozilla Blog Quoted span “A few weeks ago, Anthropic’s Frontier Red Team approached us with results from a new AI-assisted vulnerability-detection method that surfaced more than a dozen verifiable security bugs, with reproducible tests.”
2026-04-21	Claude Mythos Preview	Mozilla	Defensive tool	Closed model, provider-hosted	The zero-days are numbered \| The Mozilla Blog Quoted span “As part of our continued collaboration with Anthropic, we had the opportunity to apply an early version of Claude Mythos Preview to Firefox.”

The attack ledger in date order

25 reports · 23 campaigns · 2024 – 2026

Each documented AI-assisted attack, one row per observer's report, generated from the data file. Filled marks are confirmed by someone other than the model's provider; hollow marks are self-reported, asserted or a demonstration.

2024-02-14 · OpenAI · closed model, provider-hosted · resource development
Charcoal Typhoon
Reached: disrupted · Evidence: self-reported by the model provider · Disrupting malicious uses of AI by state-affiliated threat actors
2024-02-14 · OpenAI · closed model, provider-hosted · resource development
Crimson Sandstorm
Reached: disrupted · Evidence: self-reported by the model provider · Disrupting malicious uses of AI by state-affiliated threat actors
2024-02-14 · OpenAI · closed model, provider-hosted · resource development
Emerald Sleet
Reached: disrupted · Evidence: self-reported by the model provider · Disrupting malicious uses of AI by state-affiliated threat actors
2024-02-14 · OpenAI · closed model, provider-hosted · recon
Forest Blizzard
Reached: disrupted · Evidence: self-reported by the model provider · Disrupting malicious uses of AI by state-affiliated threat actors
2024-02-14 · OpenAI · closed model, provider-hosted · resource development
Salmon Typhoon
Reached: disrupted · Evidence: self-reported by the model provider · Disrupting malicious uses of AI by state-affiliated threat actors
2024-05-17 · Arup (spokesperson statement reported by CNN) · deepfake generator · fraud impersonation
Arup
Reached: loss quantified · Evidence: confirmed by an authority or the victim · British engineering giant Arup revealed as $25 million deepfake scam victim | CNN Business
2024-09-24 · HP Wolf Security · tool not stated · resource development
AsyncRAT
Reached: intrusion · Evidence: asserted · HP Wolf Security Uncovers Evidence of Attackers Using AI to Generate Malware
2025-07-17 · CERT-UA · open-weight, third-party hosted · post exploitation · same campaign as reported by Google GTIG
LAMEHUG
Reached: intrusion · Evidence: confirmed by an authority or the victim · Кібератаки UAC-0001 на сектор безпеки та оборони із застосуванням програмного засобу LAMEHUG, що використовує LLM (велику мовну модель) (CERT-UA#16039)
2025-08-27 · Anthropic · attack harness or agent · exfiltration extortion
a sophisticated cybercriminal
Reached: intrusion · Evidence: self-reported by the model provider · Detecting and countering misuse of AI: August 2025
2025-08-27 · Wiz · attack harness or agent · recon
s1ngularity
Reached: intrusion · Evidence: independently confirmed · s1ngularity: supply chain attack leaks secrets on GitHub: everything you need to know | Wiz Blog
2025-11-05 · Google GTIG · closed model, provider-hosted · resource development
PROMPTFLUX
Reached: disrupted · Evidence: self-reported by the model provider · GTIG AI Threat Tracker: Advances in Threat Actor Usage of AI Tools | Google Cloud Blog
2025-11-05 · Google GTIG · open-weight, third-party hosted · post exploitation · same campaign as reported by CERT-UA
PROMPTSTEAL
Reached: intrusion · Evidence: independently confirmed · GTIG AI Threat Tracker: Advances in Threat Actor Usage of AI Tools | Google Cloud Blog
2025-11-05 · Google GTIG · attack harness or agent · credential access
QUIETVAULT
Reached: intrusion · Evidence: asserted · GTIG AI Threat Tracker: Advances in Threat Actor Usage of AI Tools | Google Cloud Blog
2025-11-13 · Anthropic · attack harness or agent · initial access
Chinese state-sponsored group
Reached: intrusion · Evidence: self-reported by the model provider · Disrupting an AI-orchestrated cyber espionage campaign
2026-05-11 · Google GTIG · attack harness or agent · recon
Hexstrike
Reached: attempt · Evidence: asserted · Adversaries Leverage AI for Vulnerability Exploitation, Augmented Operations, and Initial Access | Google Cloud Blog
2026-06-30 · Zenity Labs · attack harness or agent · recon
Strix
Reached: attempt · Evidence: independently confirmed · Real-World AI Infrastructure Attacks: What Honeypots Reveal
2026-07-30 · Palo Alto Networks Unit 42 · attack harness or agent · vuln discovery
Hermes
Reached: intrusion · Evidence: independently confirmed · Chinese-Speaking Threat Actor Harnesses AI Models for Autonomous Cyberattacks
2026-08-20 · Cisco Talos · attack harness or agent · resource development
UAT-10147
Reached: intrusion · Evidence: independently confirmed · UAT-10147: Chinese-speaking adversary integrates agentic AI into post-compromise operations
2026-09 · Anthropic · attack harness or agent · resource development
GTG-10007
Reached: intrusion · Evidence: self-reported by the model provider · Countering misuse of AI: September 2026 / Anthropic
2026-09 · Anthropic · closed model, provider-hosted · resource development
GTG-20006
Reached: intrusion · Evidence: self-reported by the model provider · Countering misuse of AI: September 2026 / Anthropic
2026-09 · Anthropic · attack harness or agent · exfiltration extortion · same campaign as reported by Google GTIG
GTG-50014
Reached: intrusion · Evidence: self-reported by the model provider · Countering misuse of AI: September 2026 / Anthropic
2026-09 · Anthropic · attack harness or agent · credential access
GTG-50020
Reached: intrusion · Evidence: self-reported by the model provider · Countering misuse of AI: September 2026 / Anthropic
2026-09 · Anthropic · attack harness or agent · initial access
GTG-50029
Reached: intrusion · Evidence: self-reported by the model provider · Countering misuse of AI: September 2026 / Anthropic
2026-09-08 · Google GTIG · attack harness or agent · recon
Recon
Reached: intrusion · Evidence: asserted · GTIG AI Threat Tracker: From Prompting to Autonomy – The Evolution of Adversarial AI | Google Cloud Blog
2026-09-08 · Google GTIG · closed model, provider-hosted · initial access · same campaign as reported by Anthropic
UNC6240
Reached: attempt · Evidence: self-reported by the model provider · GTIG AI Threat Tracker: From Prompting to Autonomy – The Evolution of Adversarial AI | Google Cloud Blog

Source: the ledger's public data file in Substrate, one primary document per row · fetched 2026-10-26.

CVEs whose CVE.org record credits an AI tool: 138 in Sep 2026

Monthly · from Jan 2024

Per month of publication, CVEs whose numbering authority credited a tool on the published list (v1.0.0). A floor, never AI's share of CVEs. Most CNAs record no tool, the credits field is optional, and a researcher who used an AI tool is usually credited by name, so most AI-assisted finds never show here. Only tools on the versioned list are matched, only the numbering authority's own part of each record is read, and CVE ids from before 2023 that were published later are not scanned.

01020304050

8313883138831388313828 Jul 2026: counting change

'24'25'26

AI-credited CVEs (lower bound)axis broken above 50: taller bars are cut and print their valuemethod change

Source: CVE.org records (cvelistV5), 199,612 records scanned · fetched 2026-10-30 · the published tool list.

Counting change

The dashed seam marks 2026-07-28: CVE Program lets Anthropic and OpenAI assign CVE IDs for what they find (source). A rise that starts at the seam may be a change in who records the credit rather than in what AI finds; see Methodology.

The vulnerability question: more bugs, the same amount, or different ones?

The site's first question, kept as one band: whether AI is changing the vulnerability supply underneath the outcomes. Three hypotheses, each weighed against what the data can and can't support.

Hypothesis 1

AI is finding more vulnerabilities

Counts are up; how much of the rise AI explains is not measured

Raw counts are up sharply: 48,185 CVEs in 2025, by CVE.org's published count cross-checked against Jerry Gamblin's annual review (every year and its sources are on CVE Data). Documented structural contributors exist: more organizations authorized to issue CVE IDs (CNA expansion), the Linux-kernel and WordPress publishers, and disclosure completeness, all predating AI tools. No public decomposition says how much of the rise each explains, AI included. AI-found bugs are real and so far small beside the total: Big Sleep's first 20 open-source flaws, the 12 OpenSSL zero-days AISLE's system found and the 18 real zero-days AIxCC's finalists found. No public dataset isolates an AI-attributable increase from the confounders.

Hypothesis 2

It's roughly the same — hype exceeds reality

Mixed: early vendor reports say productivity; later reports document intrusions run with attack harnesses; total attacker impact is unmeasured

Microsoft and OpenAI (February 2024) reported the same pattern in their own telemetry: AI gives threat actors productivity, with no novel technique observed. Absence of a new technique in vendor telemetry does not show attacker capability is unchanged. The UK's NCSC expects the near-term threat to come from "evolution and enhancement of existing tactics, techniques and procedures." Proofpoint's 2026 telemetry: "More CVEs, Same Playbook." The most dramatic attacker claim, Anthropic's autonomous-espionage report, rests on the provider's own account and is graded self-reported by the model provider below. Since then, this site's own ledger holds later cases: two reports dated 2026 document intrusions run with an attack harness or agent, each graded independently confirmed by an observer other than the provider of the model involved (Palo Alto Networks Unit 42 on Hermes and Cisco Talos on UAT-10147). Those are documented cases, not a measure of how often it happens, and they do not settle whether the techniques are new.

Hypothesis 3

The types are changing

No new kind of weakness in the rankings; AI's effect on the mix is not measured

Eight of the top 10 weaknesses in MITRE's 2023 CWE ranking are still in its 2025 top 10; what moved is their order (The Types). Google reports memory-safety bugs fell from 76% of Android's vulnerabilities in 2019 to 24% in 2024, which it credits to writing new code in memory-safe languages (Google Security Blog); that is one codebase, not a trend everywhere. In the documented cases, AI tools found known kinds of bugs, skewed by how each tool works (fuzzers and code reasoning toward memory bugs, LLM pentesters toward web bugs). No public dataset classifies bugs by whether AI found them, so whether AI changes the overall mix is not measured.

What actually changed: the clock

The change vendors report most consistently is speed. Mandiant's average time-to-exploit fell from 63 days (2018–19) to 5 days (2023, excluding outliers; 47 with them). These are Mandiant's averages on its own sample of exploited vulnerabilities. M-Trends 2026 reports a separate series, Google Threat Intelligence Group's mean counted from the patch date, at −1 day in 2024 and an estimated −7 days in 2025 (M-Trends 2026, p.78); below zero means exploitation came before the patch, on average. Our own computed series, from public data, is on Live.

Average days from disclosure to first observed exploitation, Mandiant. Palo Alto Networks Unit 42's 2026 Global Incident Response Report lists Faster vulnerability exploitation: The window between disclosure and exploitation continues to shrink. under its heading AI increases the speed and scale of attacks (p.7). That is Unit 42's own claim: it gives no measure of how much of the fall in time to exploit is due to AI, and no report in this site's data measures it. Source: Mandiant, Time-to-Exploit Trends 2023.

Zero-days exploited in the wild — a steady band, not a runaway

Google/Mandiant detection telemetry, self-revised annually. GTIG's latest review calls the counts a consolidating upward trend whose annual volume has fluctuated within a 60-100 range (GTIG, 2025 Zero-Days in Review). No step change is visible in this series; it moves within that range. It counts detected zero-days only, so it says nothing about attacks that use known bugs. Each count links to the review that states it: 2022 · 2023 · 2024 · 2025.

Two independent checks worth holding onto

The productivity story isn't settled either. METR's randomized trial (July 2025) put 16 experienced open-source developers on 246 real tasks and found they were 19% slower with AI tools — while believing they were 20% faster. It's a snapshot, and METR itself flags later results differ, but it's a rare controlled measurement against the common assumption that AI tools make developers faster.

And the capability is real when an expert drives. Researcher Sean Heelan used OpenAI's o3 to find a genuine remote use-after-free zero-day in the Linux kernel's SMB implementation (CVE-2025-37899, May 2025). Google's John Hultquist later reported the first in-the-wild evidence of an AI-developed exploit, caught before mass exploitation: "probably the tip of the iceberg." Interpretation: an early sign, not yet evidence of scale.

Sources: METR, Jul 2025 · Sean Heelan, May 2025 · CyberScoop, May 2026

What the data cannot tell us

Each gap below names the instrument that would close it. None exists in public today.

Whether a given breach was AI-caused. A phishing email or an exploit does not record whether a model wrote it, so no victim-side report can say. Missing instrument: an incident-response taxonomy that records tool evidence per case, published across many responders.
How much open-weight models are used in attacks. A model run on the attacker's own hardware sends no provider any telemetry. Missing instrument: systematic malware and intrusion forensics that record the model, aggregated across vendors.
Whether AI caused the time-to-exploit collapse, or merely coincided with it. Palo Alto Networks Unit 42's 2026 Global Incident Response Report lists Faster vulnerability exploitation: The window between disclosure and exploitation continues to shrink. under its heading AI increases the speed and scale of attacks (p.7). That is Unit 42's own claim: it gives no measure of how much of the fall in time to exploit is due to AI, and no report in this site's data measures it. CrowdStrike and Unit 42 credit AI with speeding up other stages of an attack, without a measure of how much: CrowdStrike's 2026 Global Threat Report: AI accelerated phishing and automated reconnaissance, shortening the time from initial access to impact. (PDF p.2); Unit 42's 2026 Global Incident Response Report: AI compresses the attack lifecycle and reduces the manual effort required to operate across multiple targets. (PDF p.7). The event studies on Analysis test it around dated releases, and timing alone never settles it. Missing instrument: first-exploitation dates with a recorded method, as GreyNoise or VulnCheck keep behind keys.
Whether AI has increased valid, unique vulnerability discovery net of the noise it also generates. Missing instrument: a per-CVE finder-method field that numbering authorities fill in; the AI-credit series above is a floor because that field is optional.
How much harm goes unfound. Breach counts include only breaches someone found, and defenders report being past capacity: 5 reports from 2026-10-19 to 2026-10-31 describe incident-response firms turning work away, and vendor surveys put 28–63% of alerts uninvestigated (63% is this site's 100 − 37) (Defender capacity). Missing instrument: a recurring public measure of incident-response capacity and of alerts left uninvestigated, on one definition over time.
What would have happened without AI. The counterfactual is never observed, so every estimate of AI's effect rests on stated assumptions. Missing instrument: none can exist; the hypotheses above say which assumption each test makes.
Whether the 2026 Patch Tuesday surge is a trend or an artifact. Ten months of one year aren't enough to say. Missing instrument: more months, and Microsoft's own finder attribution per CVE.