AI cyber attacks and how to defend against them

An AI cyber attack uses artificial intelligence to help plan, create, or execute malicious activity. In a June 2026 analysis of 832 accounts banned for malicious cyber activity, 67.3% had used AI to help write malware. That selected sample is not a measure of all cyberattacks, but it shows why security teams need to prepare for AI use beyond phishing.

AI can help an attacker turn information into a convincing message, working code, or a next action. The security impact depends on whether that output leads to access, greater permissions, or control of sensitive resources. Defenders need to understand those connections to choose controls that interrupt an attack.

What is an AI cyber attack?

An AI cyber attack uses a model to assist one or more malicious tasks. The model might generate content, interpret unfamiliar software, or help coordinate actions. A model’s ability to produce instructions is different from an attacker’s ability to execute them: execution requires tools, access, and permissions. Automated activity alone does not establish AI involvement.

AI-assisted attacks and agentic attacks

In an AI-assisted attack, a person uses model output to complete a task. For example, an attacker could use a large language model (LLM) to revise an impersonation message, then choose its recipient and send it. The human controls the transition from generated content to action.

In an agentic attack, software connects the model to tools. The agent can act, examine a result, and choose another action within the access it has been given. An operator may still select targets, supply credentials, or approve consequential steps. A useful assessment therefore asks which tasks the agent performed and where humans intervened, rather than treating autonomy as an all-or-nothing property.

Attacks using AI and attacks against AI

AI can be an attacker’s tool or the system being attacked. AI-generated phishing targets a person or account. Data poisoning targets information used to train or operate an AI system. Prompt injection attempts to redirect a model through malicious instructions, potentially affecting connected tools or data.

These categories can overlap, but they require different investigations. An impersonation incident calls for examining communication, identity, and access records; suspected prompt injection also requires examining the AI application’s inputs, permissions, and actions. NIST’s adversarial machine learning taxonomy addresses attacks against AI systems. For that broader protection problem, see AI security.

Types of AI cyber attacks

AI can support familiar attack techniques at several stages. The UK National Cyber Security Centre’s assessment of AI’s impact on cyber threats describes how AI can improve attackers’ capabilities. For each technique, the useful defensive question is what AI helps accomplish and which access or authorization failure makes the result dangerous.

AI phishing and deepfake impersonation

Generative AI can help produce plausible messages, adapt language to a recipient, and imitate a speaker. The resulting text, audio, or video can make a fraudulent request feel familiar. Harm occurs when the recipient acts on that apparent identity, such as approving a payment, disclosing a code, or resetting an account.

Consider an illustrative help-desk call: a convincing voice claims to be an employee who has lost a phone. If the help desk treats that voice as sufficient proof, it may reset authentication for an attacker. The key failure is the recovery process accepting an unverified identity. Better grammar checks will not address it; an independently established verification channel can.

For the message-level warning signs and verification process, explore the AI phishing guide.

AI-assisted reconnaissance and exploitation

Reconnaissance means learning about a target before or during an intrusion. AI can help interpret public information, explain code, and organize findings about exposed systems. This can reduce the effort needed to understand an unfamiliar environment, but an analysis or suggested exploit does not itself establish that a system is vulnerable or compromised.

The defensive consequence is practical: know which services are reachable, whether they are necessary, and what they can access. A poorly maintained internet-facing application with broad internal permissions presents a different risk from an isolated service. Prioritizing remediation requires that exposure and access context, alongside vulnerability severity.

AI-assisted malware development

AI assistance during development can include explaining code, troubleshooting errors, or adapting existing components. The resulting malware may run without using a model at all. This distinction matters because looking only for connections to an AI service would miss code created with AI and then deployed independently.

Gartner’s September 2026 analysis distinguishes coding assistance from claims of novel malware capabilities and describes malware that uses AI during execution as mostly experimental. The evaluation question is what the malicious program does: launches processes, changes files, collects credentials, or communicates externally. Its development method is additional context, not a substitute for observing its behavior.

Credential abuse and lateral movement

A credential helps establish an identity; permissions determine what that identity can do. A session or token can allow continued access after authentication. An attacker who obtains one of these may be able to act through legitimate applications without repeatedly entering a password.

Lateral movement is the use of an initial foothold to reach other systems or accounts. AI can assist the interpretation of access relationships and results, while excessive permissions make further movement possible. Australia’s Signals Directorate warns specifically that compromised access to AI services can involve stolen credentials, keys, or sessions, with consequences for connected systems. The impact depends on the access available to the compromised identity or service.

Data theft and extortion

After gaining access, attackers need to find information worth stealing. AI can help summarize or categorize retrieved material, making a large collection easier to assess. This does not create access to data by itself; it can make existing unauthorized access more useful.

For defenders, the volume of an export is only part of the question. A small set of sensitive contracts or credentials can matter more than a large routine backup. Investigators need to know which identity accessed the data, whether the activity fits its role, where the data went, and whether there was an approved business purpose.

What real incidents show

Public disclosures help distinguish observed AI use from predictions. Each example below identifies the reported sequence and a defensive lesson. The evidence comes from particular investigations, so it cannot establish how common the same behavior is across all organizations.

AI-generated voice impersonation

In December 2025, the FBI updated its warning about impersonation of senior US officials using text and AI-generated voice messages. It described attempts to move conversations to encrypted messaging and obtain authentication codes that could allow access to contacts. Those contacts could then support further impersonation.

The mechanism was a chain of trust: an apparently familiar person made an access-related request, and the resulting information could help target additional people. The lesson is to verify both identity and the requested action through independently established contact details. A believable voice does not establish that sharing a code is authorized.

AI-orchestrated espionage

Anthropic reported disrupting an espionage campaign detected in September 2025 that targeted roughly 30 organizations and succeeded in a small number of cases. Its account describes AI assistance across reconnaissance, vulnerability analysis, credential collection, and organization of stolen data. The provider estimated that AI performed 80–90% of the campaign’s tactical work, while humans retained important decisions.

That estimate concerns a particular investigated campaign. The report also describes model errors, including overstated findings. It supports planning for connected, multi-stage activity; it does not show that every suggested exploit worked or that fully autonomous attacks succeed reliably. Defenders should look for the sequence from access to data collection, even when individual actions resemble ordinary administration.

AI-assisted credential abuse and data theft

Anthropic’s September 2026 report describes a financially motivated actor, designated GTG-50014, using AI in operations involving exposed credentials, access to databases, and theft or extortion. Its cases show how opportunistic access can develop into a broader intrusion without requiring a novel exploit in every instance. The report covers selected notable activity disrupted between December 2025 and August 2026.

The defensive lesson is to connect secret exposure with subsequent account and data activity. Removing an exposed key is necessary, but an investigation should also establish where it was used, what it could access, and whether the attacker created another route into the environment. The disclosure is provider-observed evidence, not an independent estimate of global cybercrime.

How AI changes attack progression

AI can reduce the effort needed to interpret a result and decide what to try next. That creates a coordination problem for defenders: a team may see separate identity, endpoint, and cloud alerts while an attacker is working toward one objective. The response needs to connect those events early enough to act.

In Anthropic’s selected-account study, the share of actors rated medium risk or higher rose from 33% in the first six months to 56% in the second six months of its March 2025–March 2026 study. Its assessment combines threat intent, AI assistance, and impact. The provider also notes that improved detection may contribute to the observed change. This is a change in a provider-defined risk measure within a selected population, not a global attack-growth rate.

A worked example from access to data theft

The following hypothetical scenario illustrates where evidence and intervention can connect. It is not a reported customer incident or a tested product result. Suppose impersonation leads to an account compromise, followed by access to a cloud application and an unauthorized data export.

Check sessions, tokens, keys, permission changes, and affected devices. Verify that access has actually ended.

AI might have helped create the impersonation or interpret application results. The observed sequence can justify investigation and containment before that attribution is known. This is why a collection of isolated alerts is less useful than evidence showing which identity performed which action on which resource.

How to detect AI cyber attacks

Detection should establish suspicious or unauthorized activity, its scope, and the next response decision. A network connection rarely reveals whether an attacker used AI to write a message or script. Waiting for proof of AI involvement can delay action on evidence that already demonstrates compromise.

Connect evidence across the environment

Different records answer different questions. Combining them is useful only when investigators can associate the same accounts, devices, resources, and times. For example, an identity provider may record a login while the application records the later data export; neither record alone explains the full event.

Check these limitations before an incident. Confirm that useful events are collected, timestamps can be aligned, and account identifiers can be resolved across systems. For the separate question of how defenders use AI to analyze evidence, see AI threat detection.

Investigate the sequence of events

An unusual download can be legitimate. A migration, backup, or approved analytics task may explain it. Confidence changes when the same account also has an unexpected recovery event, a new application grant, and access to sensitive data outside its normal responsibilities.

A useful investigation reconstructs that sequence, checks the business explanation, and identifies the affected resources. It should preserve uncertainty where records are missing. A risk score can prioritize attention, but analysts still need the underlying events and context to decide whether to restrict access, involve an owner, or continue observing.

Test detection and containment together

Use a controlled exercise with authorized test accounts and non-sensitive data to simulate the worked example. Define the expected records and response boundaries beforehand. Then measure the time to a useful alert, the time to establish the affected identity and resources, and the time to verify containment.

These are different outcomes. An alert can arrive quickly yet lack enough context to act; a response command can report success while another application session remains active. Ask the team to demonstrate the evidence behind its decision and confirm that the relevant access has stopped. Record missing logs, manual handoffs, and response dependencies as specific improvement tasks.

How to reduce risk and respond

Controls should address entry, the reach of a compromised identity, and the ability to interrupt activity after access. Their value is easier to assess when each control is tied to an attack path and a verifiable result. The priorities below apply the same reasoning to prevention and response.

Reduce exposed entry points

Maintain an inventory of internet-facing services, their owners, and their dependencies. Remove services that are unnecessary or unsupported, and prioritize fixes using exposure, exploitation risk, and the resources an attacker could reach. A patch closes a particular weakness; removing an unnecessary service eliminates that route entirely.

The Australian Signals Directorate’s enterprise guidance on AI-enabled cyber attacks recommends reducing exposed services, restricting privileges, centralizing useful logs, and exercising response and recovery. Apply those priorities to known access paths rather than treating an AI label as a separate remediation category.

Protect identities, sessions, and recovery

Use phishing-resistant authentication where supported. NIST explains that WebAuthn, used by FIDO2 authentication, binds authentication to the legitimate service’s domain. That binding helps prevent a lookalike site from obtaining an authentication result usable at the real service. Manually entered one-time codes do not provide the same protection. Read NIST’s authentication guidance.

Protect account recovery with equal care. A strong login method offers limited protection if an impersonator can persuade support staff to replace it. Verify high-risk requests through established channels and record who approved the change. Investigate suspicious sessions and devices as well as failed logins: an attacker using an already authenticated session may not trigger another authentication challenge.

Limit privileges and verify containment

Give human users, service accounts, and AI agents only the access needed for their role, with an accountable owner. Forrester’s public 2026 threat assessment highlights identity, provenance, and access controls for agents. In practice, a team should be able to identify who authorized an agent, which systems it can use, and how to withdraw that access.

Before an incident, decide who can restrict an account, revoke a key or token, end a session, isolate a device, or block a connection. Test the permissions required for those actions. Use narrowly scoped, reversible automation where appropriate, with an audit trail and a recovery process for incorrect actions.

During response, preserve relevant evidence, identify affected identities and resources, contain the access, and investigate persistence. A password reset alone is not proof of containment. NIST notes that identity-provider and application sessions are managed and terminated independently, so ending one may leave another active. Verify the relevant application sessions and alternate access paths, then address the original cause before restoring access. See NIST’s session-management guidance.

Where Vectra AI can help

Teams evaluating detection need evidence that connects identity activity with network and cloud behavior. Vectra AI’s AI-native security and observability approach includes behavioral analysis of human and non-human identities across those environments. Use the worked example to examine how that context supports an investigation. Explore identity-based attack detection.

Public reviews can suggest useful evaluation questions. A May 2026 Gartner Peer Insights review excerpt praises behavioral visibility while flagging customization effort. An April 2026 G2 reviewer describes useful investigation context and setup that required reading and support calls. G2 labels that review incentivized. These are individual experiences; Peer Insights reviews are separate from Gartner analyst research. Ask a demonstration to establish the setup requirements, available evidence, and response dependencies in your environment.

The Sanofi customer story provides a relevant response example. Vectra AI’s published account describes recruiter impersonation and an infected Word document; a Sanofi representative credited Vectra AI with detecting and shutting down the attack. The account does not establish that the attacker used AI. Its relevance is the detection and response workflow after compromise.

If you are evaluating that workflow, request a Vectra AI demo and use the scenario above to discuss evidence coverage, investigation steps, and how containment would be verified.

Note: This guide draws on public incident disclosures, government guidance, public analyst commentary, and selected customer reviews. The worked example and evaluation framework are proposed practices, not results from hands-on testing.

‍