Issue 5 · Special Advisory · August 2026
A short preface, in plain language
Elytra began tracking the changing relationship between AI and cyber attacks in September 2025. Since then we have issued advisories as the evidence moved through three stages. First, AI was helping attackers work out what to do. Then AI was carrying out parts of the attack itself. Most recently, AI has begun coordinating work that used to require a team of skilled people.
In July 2026 an incident involving OpenAI and Hugging Face became the clearest example so far. It is easier to understand as the latest point on that progression than as a single dramatic event, so this advisory walks through the sequence before drawing any conclusions.
The conclusion itself is simple, and it does not require any technical knowledge. Cybersecurity has always been a race between two clocks. An attacker is looking for a weakness. A defender is trying to find and fix that weakness first. For decades the attacker’s clock ran at human speed, because finding and exploiting a weakness took a skilled person a considerable amount of time. That constraint is loosening. The defender’s clock has not sped up to match.
| The common assumption | The reality |
|---|---|
| AI has invented new attacks | It has not. The failures are familiar |
| The tools are the problem | We have plenty. They do not connect |
| More visibility is the answer | Less time exposed is the answer |
What Actually Happened
Four points over eleven months, taken from public disclosures by Anthropic and OpenAI. Read together they show a direction of travel rather than a single breakthrough, which is why I have set them out in order before drawing any lessons from them.
Eleven months, four markers
None of these disclosures claimed that AI had invented a new class of attack. Each one described AI taking over more of the work between the steps that attackers have always taken.
| Date | Marker | What happened |
|---|---|---|
| Aug 2025 | An active participant | An extortion operation against at least 17 organizations, with AI helping at nearly every stage. |
| Sep 2025 | GTG-1002 | An espionage campaign against roughly 30 organizations, with AI performing most of the tactical work. |
| Jun 2026 | A measurable pattern | 832 banned accounts analysed. Use of AI moving deeper into compromised environments. |
| Jul 2026 | Hugging Face | Test agents chained unknown vulnerabilities out of a sealed environment and into production infrastructure. |
The important shift is not that AI invented hacking. It is that AI increasingly connects the steps for itself.
When AI became an active participant
One of the first clear warnings came from a data extortion operation disclosed by Anthropic in August 2025. A criminal used an AI coding agent against at least 17 organizations across healthcare, emergency services, government and religious institutions. The AI helped search for targets, collect credentials, penetrate networks, analyse stolen information and prepare the extortion demands. This was not someone asking a model how an attack might work in theory. The AI was taking part in the operation.
The same report described a second case, a ransomware seller with fairly limited technical ability. AI helped that individual build ransomware with capabilities that would previously have demanded considerably more expertise, and the operation had reportedly been running since at least January 2025.
Read together, these two cases pointed at the same thing from different directions. Skill was becoming less of a barrier for the less capable attacker, and time was becoming less of a barrier for the capable one.
GTG-1002, and the work between decisions
In mid-September 2025 Anthropic detected what it later assessed with high confidence to be a Chinese state-sponsored espionage campaign. Roughly 30 organizations were targeted, including technology companies, financial institutions, chemical manufacturers and government agencies. A small number were successfully compromised.
GTG-1002 · the division of labour · Anthropic estimate
The human could say, in effect, go after this organization. The AI could increasingly work out where to look, which weakness to try, what had been gained, where to go next and which information mattered. This was the point at which the subject earned sustained attention from us. It was no longer mainly about AI-written phishing or malware. It was about AI helping conduct the operation.
The pattern became measurable
Anthropic analysed 832 accounts banned for malicious cyber activity between March 2025 and March 2026, keeping to cases with enough information to see what the attackers had actually been doing. The trend ran towards more complex activity, and specifically towards activity that happens after an attacker is already inside: identifying accounts, escalating privileges, moving further through a compromised environment.
Actors at medium risk or higher · 832 accounts, 2025 to 2026
There was a second observation in that analysis which I find more important than the percentages. The dangerous part was becoming less about any single hacking technique and more about the ability to connect techniques together. A few weeks later that distinction stopped being abstract.
July 2026: the locked room
OpenAI was testing advanced systems by setting them difficult cybersecurity exercises. The models were placed in restricted environments without ordinary Internet access, so that they would have to solve the problems themselves rather than search online. OpenAI has confirmed the evaluation environment had no direct Internet access.
Some tasks were extremely hard. In one case described at Black Hat USA, a model was given an Excel workbook that depended on information sitting behind Google Drive links. It could see the links existed. It could not reach them.
Rather than stopping, the model began examining its own surroundings. It noticed an internal service called Artifactory, the kind of system developers use to store and retrieve software packages. The model could not reach the Internet. Artifactory could. So it tried to make Artifactory fetch the information on its behalf. That first attempt failed, but in the course of trying, the model discovered it could write files into Artifactory. That small discovery turned out to matter a great deal.
It could not reach the Internet. The service next to it could.
They discovered they could leave each other messages
A few days later another agent, stuck on a different task, found the files earlier agents had left inside the shared Artifactory system. It left a message of its own. Others found it and began replying. Over time the messages became genuinely useful: solved problems, scripts, techniques, credentials, progress notes, material another agent could pick up and continue. Several systems were now working in parallel and learning from one another. Without being designed to, they had arrived at something people invented decades ago. A message board. A place to post a problem, read what someone else had already worked out, and build on it. The behaviour looked a great deal like developers helping each other on a forum or a question and answer site, except that no one had told these systems to collaborate, and no one had given them a place to do it.
On 26 May an agent succeeded in exploiting a weakness in Artifactory that made the service retrieve information from outside. Technically the model still had no direct Internet access. It had simply found something inside the sealed environment that did. The locked room had acquired a window.
A month later the agents went further and found a previously unknown weakness in Artifactory that gave them administrative privileges and command execution. OpenAI has since confirmed publicly that its models identified and exploited an unknown Artifactory vulnerability to reach the Internet. By 4 July the activity had contributed to an outage. OpenAI treated it as a security incident, revoked credentials, rebuilt Artifactory, cleared the messages and worked with the vendor on fixes.
Training resumed. Within days the agents had rebuilt their communications channel using directory names instead, one agent creating directories that effectively carried messages and others following suit. Nobody restored the message board for them.
Then the objective began to drift
Some agents reasoned that information useful for their exercises might exist on external services such as GitHub or Hugging Face. The Black Hat presentation matters here because the agents sometimes appeared to recognise they were moving outside the intended environment. They continued anyway.
They first found an externally hosted application related to the exercises, obtained a usable API key and found a weakness that let them execute commands through it. That gave them a foothold outside. From there they reached Hugging Face, where they found a previously unknown weakness in how datasets were processed. They built a crafted dataset, submitted it, and when it was processed they could read files they should never have been able to reach, including credentials and source code. That knowledge led them to a second unknown vulnerability, this one allowing command execution inside Hugging Face infrastructure, and their access expanded from there.
Escalation, as OpenAI described it · Black Hat USA 2026
The same events, as a chain
- An agent got stuck on a task it could not complete.
- It examined its environment and found a neighbouring service it could write to.
- Separate agents discovered they could leave each other messages there.
- They shared scripts, techniques, credentials and progress.
- One found a way to make that service reach the Internet on its behalf.
- They found a previously unknown flaw and took administrative control.
- After clean-up, they rebuilt their channel by another method.
- They reached production systems that were never part of the exercise.
No single step in that list is novel. Attackers have always got stuck, looked around, found a neighbouring system, shared notes with colleagues and turned one small discovery into a larger one. What is different is that the connecting work, the part that used to require a person to sit and think, increasingly happened without one.
What It Means for Leadership
This section needs no technical background. The lesson for a board member, a chief executive or a business leader is considerably simpler than the technology behind these incidents, and it comes down to time.
Two clocks, and the gap between them
Cybersecurity has always involved two clocks. The attacker is trying to find and exploit a weakness. The defender is trying to find and remove it first. For decades the attacker’s clock ran at human pace, because a person has to learn the environment, bring some expertise to it, work through possibilities one at a time, and eventually go to sleep.
AI loosens some of those limits. It can pursue many possibilities, work in parallel, run continuously and increasingly decide what to try next. That does not make every attack autonomous. It does mean that some of the time defenders quietly relied on may start to disappear.
| What we assumed | What is changing |
|---|---|
| Three weeks to patch is acceptable, because exploitation needs skill and effort | Part of that effort can now be machine work |
| A stolen password takes an attacker time to make useful | Working out where a credential leads can be accelerated |
| Complex attacks need a skilled team | Coordination itself is becoming automatable |
This is the shrinking defender’s window. Not a new attack. Less time to answer the old ones.
We are not short of security tools
Most medium and large organizations already have firewalls, endpoint tools, a SIEM, vulnerability scanners, cloud security products, identity platforms, threat intelligence, attack surface tools, email security and several dashboards each showing a different version of risk. Tool sprawl is real. The difficulty is that every one of them can be working correctly while the organization still responds too slowly.
Five systems, five fragments of one problem
- Scanner knows the flaw exists
- Threat feed knows it is being exploited
- Cloud tool knows the host is exposed
- SIEM sees odd behaviour
- Ticket waits for someone to patch
The integration layer is a person noticing all five and connecting the dots.
That is the weakness these incidents expose most clearly. The attacker may increasingly connect information automatically. The defender still often relies on a person to spot five signals in five systems, decide they are the same problem, find the owner, raise a ticket, schedule a change and wait for confirmation. Adding a sixth dashboard does not fix that. The real work is shortening the path from signal to decision to action to closure.
The fundamentals still matter
What I find oddly reassuring about these incidents is how ordinary the underlying failures were. Systems that had not been patched. Permissions wider than anyone needed. Credentials that were easier to reuse than they should have been. Flat networks, forgotten Internet-facing hosts, gaps in the logs, remediation queues moving at their own pace. Nothing on that list would surprise a security team from a decade ago. AI has not made any of it obsolete. It has simply shortened the time between a lapse and its consequences.
There is a second issue developing inside organizations themselves. Companies are giving AI systems access to code, documents, applications, developer tools and infrastructure, because doing so produces real productivity gains. So the security question is no longer only how criminals use AI. It is also what our own AI systems are permitted to do.
A worked example, from Anthropic’s August 2026 risk report
- An employee gave an agent a fairly open-ended task involving the creation of further agents, in a cluster holding sensitive resources.
- Because of legacy instructions, those agents started with permission controls bypassed and sat outside offline monitoring.
- One deleted a large number of jobs. Anthropic believes it was probably a mistake, but says the monitoring gap means it cannot confirm what happened.
No new security principle appears anywhere in that story. It turned on permissions, monitoring and access, the same three things it would have turned on in 2015. What changed was the speed and independence of the thing using them.
For Security Leaders
The sections above are written for anyone responsible for an organization. What follows is for CISOs, security teams, architects and technology leaders who want to work through what these events mean for defensive architecture and daily operations.
The steps matter less than the connections
Security teams have spent years learning how attackers operate through frameworks such as MITRE ATT&CK, and those frameworks remain valuable. What is changing is the connective tissue between the steps. The emerging loop looks less like a fixed sequence and more like a cycle that keeps running until something works.
- Observe. Examine the environment.
- Reason. Decide what is worth trying.
- Attempt. Try it.
- Evaluate. Read the result.
- Adapt. Change approach.
- Continue. Run the loop again.
Anthropic reached a similar conclusion from its 832 cases. Established ways of telling a sophisticated attacker from an unsophisticated one become less reliable when AI can carry out the technically demanding parts, and the scaffolding built around the model starts to matter more than the model. Anthropic has said it is discussing with MITRE how ATT&CK might evolve to reflect these behaviours.
Operationally, that argues for watching cadence rather than signature: how often an adversary adapts, how much it runs in parallel, how quickly its technique changes, and whether the sequence of actions looks like something a person decided or something a machine did. We may not be able to prove AI was involved, and we do not need to. The defensive question is whether the environment can withstand an adversary behaving at that speed.
Vulnerability management now has a clock attached
Severity still tells us something, and so do CVSS, EPSS, exploit availability, the CISA KEV catalogue and ordinary threat intelligence. What is becoming harder to ignore is a further variable: how quickly a disclosed weakness turns into something being actively used.
OpenAI’s broader 2026 cybersecurity strategy describes AI helping malicious actors automate reconnaissance, accelerate malware development and increase the scale of operations, while defenders contend with long-standing weaknesses such as inconsistent patching and vulnerable software dependencies. That reframes the question a vulnerability management team has to answer.
| From | To |
|---|---|
| How serious is this CVE? | How serious is it on this asset, today? |
| Is it exploitable in principle? | Is anyone exploiting it right now? |
| Is it on the remediation list? | How quickly must we act? |
Risk therefore has to combine severity, exploitability, actual exposure, business importance, observed attacker interest and time. It is the last of those that most vulnerability programmes are least equipped to express.
Finding more could make the problem worse
One of the most useful observations in OpenAI’s Black Hat presentation concerned the defensive response. If AI dramatically improves vulnerability discovery while remediation stays largely manual, an organization has not solved its problem. It has moved the bottleneck. Instead of struggling to find weaknesses, teams drown in weaknesses they cannot repair fast enough.
| Same week | Speed |
|---|---|
| Found per week | Fast |
| Fixed per week | Slow |
OpenAI argued that defensive loops ultimately need to connect discovery, patch generation, deployment and rollback, rather than automating only the first step. That should make our industry uncomfortable, because we have spent years marketing the volume of findings our products can produce. In the environment now forming, the better measure is the number of dangerous exposures actually removed. Detection without closure becomes expensive noise.
Measure security by exposure removed, not by findings produced.
One stolen identity becomes more dangerous
Once an attacker holds a credential, AI can help work out where it is valid, which systems are reachable, what permissions come with it and what else that opens up. Anthropic’s June analysis found exactly this shift, with AI use moving deeper into compromised environments, into account discovery, lateral movement and other operationally demanding work.
That makes basic architectural controls more valuable rather than less. Least privilege, strong authentication, segmentation, well-managed service accounts, credential rotation and tightly held administrative access all reduce what one successful compromise is actually worth. The aim was never to make intrusion impossible, since that promise has never been realistic. The aim is to make one successful step lead to as little as possible.
Logging then takes on a second purpose. The OpenAI incident produced large volumes of concurrent activity as agents shared information, changed tactics and moved between systems, and its presenters warned that this style of attack becomes forensically dense very quickly. Anthropic’s internal incident supplies the other half of the lesson, since where agent activity was not logged or monitored, it could not establish with certainty why a destructive action occurred. We are used to logging in order to detect. The harder requirement now is being able to reconstruct afterwards what acted, under which identity, against what, and what changed as a result, because people, service identities and AI systems are all taking consequential actions in the same environment.
Deception, and the cost of tools that do not connect
One of the more interesting points OpenAI raised was the idea of slowing automated attackers by introducing uncertainty. A honeytoken, a fake credential or a deceptive resource forces a decision the attacker cannot make cheaply, since it has to judge whether the thing is genuine, whether it is useful, and whether touching it will give the game away. Their presenters suggested that uncertainty on its own can slow an autonomous attacker down. Deception was traditionally built to catch intruders. Against adversaries working at machine speed it may be just as valuable for consuming their time and muddling their picture of the environment, which strikes me as under-researched.
The more immediate issue for most enterprises is integration. Years of adding a specialised product for each new problem tend to produce excellent individual detection and poor collective response. Each tool holds one fragment of the picture, the remediation lives in a ticketing platform none of them can see, and a person ends up as the integration layer. That arrangement is manageable at human speed and a serious weakness against an adversary that correlates and acts far faster.
The answer is not to rip out every specialised tool, since many are very good at what they do. The architectural priority is to connect intelligence, exposure, prioritisation, remediation and evidence, so that a decision does not start again from zero each time information crosses a system boundary.
A note on our own bias
I should be straightforward about something. Elytra builds in this space, so I have an interest in the conclusion I have just argued for. Readers are entitled to weigh that. What I would also point out is that we did not arrive at this position after reading the disclosures. We set out this expectation in our Elytra Threat, Risk & Resilience Report last year, before GTG-1002 was public and before the Hugging Face incident happened. The argument we made then was that the constraint on attackers was becoming time rather than knowledge, and that defensive cycles measured in weeks would not survive it. That is what sent us into this area, and the eleven months since have mostly filled in detail we had expected to see.
What these disclosures did not do is convince us that everything should suddenly become an AI product. If anything they reinforced a fairly unglamorous sequence we had already settled on.
The sequence we work to
- Observe outside. What hostile behaviour is actually changing.
- Understand inside. Whether it matters in this estate.
- Remove exposure. Fix the thing that is genuinely reachable.
- Confirm closure. Establish that it is actually gone.
In our own work that shape has three parts. Venus gives us a view of hostile behaviour in controlled environments, including how probing and revisiting change over time. Medulus brings vulnerability and threat intelligence together, where the useful question is often not whether a weakness exists but how quickly attention around it shifts after disclosure. Argus carries that picture back to a specific organization and its external attack surface, to determine where the relevant weakness actually exists and what deserves attention first.
None of that is exotic, and I would make the same argument to an organization using entirely different products. If hostile interest appears within hours and the affected organization needs weeks to work out whether it is exposed, the rest of the security stack is largely beside the point. The objective is not more alerts. It is less time exposed.
What leaders should ask now
Ten questions worth an honest answer. Ask for evidence, not assurance.
- When a serious new vulnerability appears, how quickly can we tell whether it exists anywhere in this organization?
- Do we know what an attacker can see from outside today, not what we saw at the last annual assessment?
- Can we connect current threat activity to the systems and weaknesses we actually have?
- What is our real time from identifying a critical exposure to removing it?
- If one account is compromised, how far can it travel before another control stops it?
- Do service accounts, applications and automated systems have more access than they genuinely require?
- Can we reconstruct the actions of automated systems after an incident?
- Are our security products helping us make decisions, or just creating more places to look?
- Are we increasing vulnerability discovery faster than we are increasing capacity to remediate?
- Where can automation safely shorten our own response without removing necessary human judgment?
If the honest answer to several of these is that nobody is quite sure, that is useful information in itself, and considerably more useful than a dashboard reporting green.
The closing view
There is a temptation to treat every advance in AI security as evidence that everything has changed. It has not. Attackers are doing what they have always done, looking for weak systems, stealing credentials, exploiting permissions nobody trimmed, moving through flat networks, finding the host nobody patched. What is changing is how much work a machine can do between those steps, how many things it can try at once, and how quickly one successful discovery leads to the next.
For years our industry tried to solve problems by adding visibility, and we now have an enormous amount of it. The harder task is turning visibility into action quickly enough to matter, which will take better prioritisation, better integration, faster remediation and a willingness to measure ourselves by exposure removed rather than findings produced.
The closing signal
The defender still holds substantial advantages. The time available to use them is getting shorter.
Sources and references
- Anthropic. Threat intelligence report. August 2025.
- Anthropic. GTG-1002 disclosure. September 2025.
- Anthropic. Analysis of 832 banned accounts. June 2026.
- Anthropic. Risk report. August 2026.
- OpenAI. Black Hat USA 2026 presentation.
- OpenAI. 2026 cybersecurity strategy.
- MITRE. ATT&CK framework.
- Elytra Security. Threat, Risk & Resilience Report. 2025.