Criminals Are Using AI Like a Work Tool. Researchers Have the Receipts.

Key points

• Cisco Talos found criminals bypassed AI safety filters by claiming requests were for "authorised testing" or capture-the-flag competitions, a problem confirmed across Claude Code, CodeX, Cursor and Gemini.
• CrowdStrike recorded that 88 percent of known attacks exploiting a publicly disclosed software flaw happened within 48 hours of disclosure, a window AI is helping criminals close even faster.
• North Korean hacking group Stardust Chollima corrupted the widely used Axios npm package in March 2026, planting malware in the systems of any developer who downloaded it.
• Cloud-related criminal activity, covering credential theft, cryptomining and AI-service hijacking, rose 171 percent in the first half of 2026, according to CrowdStrike's 2026 Threat Hunting Report.
• Criminals are embedding hidden instructions inside ordinary documents, images and videos to hijack AI assistants and make them carry out attacks on their behalf.

Criminals have started treating AI the same way a developer treats a coding assistant: open the chat window, describe the problem, iterate on the output. Two research teams have now published detailed evidence of exactly that.

Cisco Talos, the threat research arm of networking giant Cisco, released a study at the Black Hat USA security conference showing how hackers are using AI tools to write malicious software and speed up attacks. CrowdStrike, a major cybersecurity firm, separately published its 2026 Threat Hunting Report documenting how AI is compressing the time between a flaw being announced and criminals exploiting it.

Neither report is theoretical. Both draw on real logs and real victims.

How did criminals get past the AI safety rules?

They asked nicely. Cisco Talos found that simply telling a model "this is authorised testing" or "I'm doing a capture-the-flag challenge" was enough to make most comply with requests they should have refused. The problem appeared across Claude Code, CodeX, Cursor and Gemini, not just one platform. When a model refused, criminals switched to an uncensored alternative.

The result: one group built a bulk email verification service capable of processing tens of millions of addresses for scam targeting. Another adapted a known flaw called React2Shell into a credential-harvesting pipeline. A third built infrastructure to knock Android TV devices offline with a flood of fake traffic, a technique called a distributed denial-of-service attack.

What is the new trick hidden inside ordinary files?

Researchers are tracking a technique where criminals hide malicious instructions inside shared documents or video files. When an AI assistant processes the file, it follows those hidden instructions rather than the user's actual wishes.

Norwegian AI researcher Håkon Måløy demonstrated one version that could spread through Microsoft Word documents via Microsoft Copilot, Microsoft's AI writing assistant. Think of it as a note tucked inside a letter that tells the postal worker to redirect your mail, and the postal worker just does it.

Joseph Rooke, senior director at threat intelligence firm Recorded Future, told CSO Online that this approach will increasingly replace traditional malware because it needs no software installed and bypasses most conventional defences. "Malicious prompts will increasingly replace malware as the preferred intrusion method, enabling adversaries to extract sensitive data, override guardrails, or induce harmful actions without breaching traditional defenses," Rooke said.

Should developers and businesses be worried about the software they use?

Yes. In March 2026, Stardust Chollima, a hacking group linked to North Korea, used stolen maintainer credentials to corrupt the Axios npm package. An npm package is a bundle of reusable code developers download and build into their own programs, the way a baker uses pre-mixed flour. Corrupting Axios planted the ZshBucket malware, designed to steal files, in any developer's system that pulled the package. We first covered Stardust Chollima on 6 August 2026, and the group's appetite for npm has not slowed.

Three months after Axios, the same group injected a malicious package into at least 131 components of a popular AI development toolkit called Mastra.

CrowdStrike found that 87 percent of threats detected in software registries, the online libraries where developers download packages, involved corrupted JavaScript packages.

The failure mode is simple: developers trust package registries the same way shoppers trust a branded jar of peanut butter. If the factory is compromised, every jar ships with the problem already inside.

For ordinary users, the knock-on effect is that applications they rely on daily, banking apps, booking systems, workplace tools, may quietly carry code they were never meant to contain. Check any breach notification you receive in the coming months for the phrase "supply chain" or "compromised dependency". A password manager, which generates and stores a unique password for each site, removes most of the reuse risk upfront.

The post-mortem on this period will note that detection was measured in hours and response in days. That gap is the whole problem.