Criminals Are Using AI Like a Work Tool. Researchers Have the Receipts.
Two major studies show hackers using AI assistants to write malicious code, dodge safety filters, and attack in hours rather than weeks. Cloud activity tied to this shift jumped 171 percent in the first half of 2026.
Key points
- Cisco Talos found criminals regularly tricked AI safety filters by claiming their requests were for "authorised testing" or hobby hacking competitions, a problem observed across Claude Code, CodeX, Cursor, and Gemini.
- CrowdStrike recorded that 88 percent of known attacks exploiting a publicly disclosed software flaw happened within 48 hours of the flaw being revealed, a window AI is helping criminals close even faster.
- North Korean hacking group Stardust Chollima poisoned a widely used software package called Axios in March 2026, planting hidden malware that could spread to any developer who downloaded it.
- Cloud-related criminal activity, including password theft and hijacking of AI services, rose 171 percent in the first half of 2026, according to CrowdStrike's 2026 Threat Hunting Report.
- Criminals are now embedding hidden instructions inside ordinary documents, images, and videos to hijack AI assistants and make them carry out attacks on their behalf.
Criminals have started treating AI the same way a developer treats a coding assistant: fire up the chat window, describe the problem, iterate on the output. Two research teams have now published detailed evidence of exactly that.
Cisco Talos, the threat research arm of networking giant Cisco, released a study during the Black Hat USA security conference showing how hackers are using AI tools to write malicious software, build fraud systems, and speed up attacks. Separately, CrowdStrike, a major cybersecurity firm, published its 2026 Threat Hunting Report documenting how AI is compressing the time between a software flaw being announced publicly and criminals actively exploiting it.
Neither report is theoretical. Both draw on real logs, real victims, and real damage.
How did criminals get past the AI safety rules?
They asked nicely. Cisco Talos found that simply telling an AI model "this is authorised testing" or "I'm doing a capture the flag challenge" (a legal hacking competition) was enough to make most models comply with requests they should have refused. The problem appeared across multiple platforms, not just one.
When one model refused, criminals switched to a version with no safety filters at all.
The result: one group built a bulk email verification service capable of processing tens of millions of addresses (used to identify live targets for scam campaigns). Another adapted a known software flaw called React2Shell into a pipeline for stealing login credentials. A third built infrastructure to knock Android TV devices offline using a flood of fake internet traffic, a technique called a distributed denial-of-service attack.
What is the new trick hidden inside ordinary files?
Researchers are tracking a technique where criminals hide malicious instructions inside shared documents, images, or videos. When an AI assistant reads or processes the file, it follows those hidden instructions rather than the user's actual wishes.
Norwegian AI researcher Håkon Måløy demonstrated one version that could spread through Microsoft Word documents via Microsoft Copilot, Microsoft's AI writing assistant. Think of it like a note hidden inside a letter that tells the postal worker to redirect your mail, and the postal worker just does it.
Joseph Rooke, senior director at threat intelligence firm Recorded Future, told CSO Online that this approach will increasingly replace traditional malware because it needs no software to be installed and bypasses most conventional defences.
Should developers and businesses be worried about the software they use?
Yes, and soon. In March 2026, Stardust Chollima, a hacking group linked to North Korea, used stolen login credentials to corrupt the Axios npm package. An npm package is a bundle of reusable code that software developers download and build into their own programs, the way a baker uses pre-mixed flour. By corrupting Axios, which is used in countless applications, the group planted malware (a program called ZshBucket designed to steal files) in the systems of anyone who downloaded the package.
Three months later, the same group injected a malicious package into at least 131 components of a popular AI development toolkit called Mastra.
| Event | Date | Scale |
|---|---|---|
| Axios npm package corrupted by Stardust Chollima | March 2026 | Widespread developer exposure |
| Mastra AI framework packages poisoned | June 2026 | At least 131 packages affected |
| Altered Spider poisoned software dependencies | 1H 2026 | Over 300 in a single day |
| React2Shell exploitation response | 1H 2026 | 800 leads, 80-plus victims in four days |
| Cloud-linked criminal activity increase | 1H 2026 | Up 171 percent year on year |
CrowdStrike found that 87 percent of threats detected in software registries (the online libraries where developers download packages) involved corrupted JavaScript packages.
The failure mode here is simple: developers trust package registries the same way shoppers trust a branded jar of peanut butter. If the factory is compromised, every jar ships with the problem already inside.
For ordinary people, the knock-on effect is that applications they use every day, banking apps, booking systems, workplace tools, may quietly contain code they were never meant to carry.
If you use a service that reports a data breach in the next few months, check whether it mentions supply chain attacks or compromised dependencies. If it does, change your password for that service and any others where you use the same one. A password manager, which is a program that generates and stores unique passwords for each site, removes most of that risk from the start.
One thing the post-mortem will say: the detection window was measured in hours, and the response window was measured in days.
