Recorded Future’s analysis of 103 AI-related incidents finds that attackers are mostly using AI to make familiar attacks faster or more convincing, rather than running fully autonomous campaigns. The report’s clearest warning is about exposure: AI development tools with access to code and credentials can give attackers a foothold into organisations downstream.
Watch Desk analysis
What happened
Recorded Future’s Insikt Group analysed incidents from 31 July 2025 to 31 July 2026. It counted 103 cases in which AI was involved as an attack vector, tool or target, including phishing, supply-chain compromise and attacks on AI services. The researchers say 32 involved AI in malware or the orchestration of offensive operations; the other 71 fell into categories such as AI-assisted deception, AI systems as targets, and abuse of AI services.
The report describes compromised AI-related packages and tools being used to steal credentials, persist in systems and reach downstream environments. It also identifies one campaign against Taiwanese government entities in which up to eight AI agents reportedly operated with limited human intervention. Recorded Future says fully autonomous attacks remain rare in the cases it analysed. Read the report.
Key findings
- Developer tools are an attractive foothold
Coding assistants and related packages can have privileged access to code and credentials, increasing the potential reach of a compromise. - AI is making deception more convincing
The report describes attackers using language models to produce targeted phishing and process stolen data for extortion. - Autonomous operations remain unusual
Recorded Future found limited evidence of agent-orchestrated attacks, with human involvement still common across the incidents it reviewed.
Why it matters
The practical message is less “AI has taken over hacking” and more “ordinary security weaknesses now have new ways to scale”. A compromised tool used by developers can expose credentials or create a route into other environments. Defenders therefore need to treat the permissions and dependencies of AI-enabled tools as part of their existing supply-chain security work.
The figures describe incidents Recorded Future identified under its own criteria, not every AI-related attack. The report also warns that the balance could shift as agentic techniques improve and spread. Its current evidence supports a picture of AI-assisted attacks, with fully autonomous campaigns still uncommon.
Our read
This is a useful corrective to the idea that cyber risk only becomes serious once an agent is left unsupervised. The less cinematic problem is already here: tools with access to valuable systems can amplify familiar attacks. Organisations should know what their AI development tools can reach, keep dependencies under review and limit credentials to what each tool actually needs. It is not glamorous security work, which is one reason it keeps being necessary.
What to watch
- Whether later incident reporting finds more campaigns using agents with limited human oversight.
- How attackers exploit the permissions and dependencies of AI coding tools and packages.
- Whether defenders publish evidence that tighter access controls reduce downstream compromises.
Discussion spark: Should organisations treat AI development tools like other privileged software and restrict their access by default, even if that makes them less convenient for developers?
Sources and evidence
- AI Is Both Target and Tool for Threat Actors (11 November 2026, 00:00 UTC)
Watch Desk is operated by WittyWires as an independent cross-cutting AI news tracker. It does not speak for the organisations or people it covers.