Part 8: Adversarial use of AI by illicit networks

What the AI vendors’ own threat reports say about criminal and state use of their models since 2025, and what it means for investigators.

The people we investigate have the same tools. Since 2025 the AI vendors themselves have published detailed accounts of what they see, and those reports are the best open sources on the subject.

• Anthropic, August 2025. One actor used Claude Code to run extortion attacks against at least 17 organisations, with ransom demands above 500,000 dollars. The company called it “vibe hacking”. North Korean operators used the model to pass technical interviews and hold remote jobs at Fortune 500 companies. A seller with little technical skill offered ransomware built with AI for 400 to 1,200 dollars.¹
• Anthropic, November 2025. A group the company assessed as Chinese state-sponsored used Claude Code to run roughly 80 to 90 percent of a campaign against about 30 targets. Humans intervened at only a handful of decision points. A small number of intrusions succeeded. The model also overstated its results and invented credentials, which slowed the attackers down.²
• Anthropic, September 2026. The company’s latest report groups misuse into seven areas, including surveillance and the distillation of its models by other labs.³
• OpenAI publishes periodic reports on the networks it disrupts, including influence operations and scam operations.⁴
• Google Threat Intelligence Group, November 2025. Documented malware that calls Gemini at run time to rewrite itself and to generate commands, which GTIG named PROMPTFLUX and PROMPTSTEAL.⁵

For illicit trade the pattern is simple. AI lowers the skill needed to forge documents and to write convincing correspondence in any language. It lets small groups run romance and investment scams at scale. It clones a voice for a payment-approval call. It produces the identity documents and selfies that defeat remote onboarding checks. Europol’s EU-SOCTA 2025 and UNODC’s reporting on scam compounds in Southeast Asia are the best starting points for the organised-crime view. We have not verified their figures for this edition, so we do not quote them.

A note on one new category. TypeSafe AI’s Jev (September 2026) is a non-generative “decision model” that returns typed classifications rather than text, which could matter for triage at scale. It is available only by waitlist, and its speed and accuracy figures are the vendor’s own. We list it as something to watch rather than something to use.

Footnotes

1. Anthropic (27 August 2025). “Detecting and countering misuse of AI: August 2025.” https://www.anthropic.com/news/detecting-countering-misuse-aug-2025. Accessed 2026-10-09.

2. Anthropic (13 November 2025). “Disrupting the first reported AI-orchestrated cyber espionage campaign.” https://www.anthropic.com/news/disrupting-AI-espionage. Accessed 2026-10-09.

3. Anthropic (September 2026). “Threat intelligence report: September 2026.” https://www.anthropic.com/threat-intelligence-report-september-2026. Accessed 2026-10-09.

4. OpenAI. “Disrupting malicious uses of AI” (report series). https://openai.com/index/disrupting-malicious-ai-uses. Accessed 2026-10-09.

5. Google Threat Intelligence Group (5 November 2025). “GTIG AI threat tracker: advances in threat actor usage of AI tools.” https://blog.google/technology/safety-security/gtig-report-ai-malware/. Accessed 2026-10-09.