Recorded Future’s Insikt Group published AI Is Both Target and Tool for Threat Actors with a hard count: 103 verified incidents between July 31, 2025 and July 31, 2026 where artificial intelligence was attacker tool, target, or lure. For teams that run Claude Code, Codex, Cursor, or MCP-heavy workflows, the headline is not “the bots took over”—it is that the same supply-chain and credential paths you already worry about now sit behind AI-branded packages, proxies, and plugins with repository-wide reach. Thirty-two incidents involved AI inside malware or offensive orchestration; seventy-one fell into abuse of AI infrastructure, hype-driven lures, fraud automation, or hijacked legitimate agent services. Action today: treat third-party AI dependencies like production CI secrets, audit what your agent can touch, and assume a compromised coding extension can outlive a git revert.
TL;DR
| Question | Answer |
|---|---|
| Am I affected? | Potentially yes if you install LLM proxy packages, editor plugins, or agent skills that reach repos, .env files, or cloud tokens—the report’s developer-tool cluster is about that access, not model weights |
| Is there a patch? | No single CVE—response is dependency review, token rotation, plugin allowlists, and separating agents from production |
| Does data leave my machine? | Compromised packages and worms can exfiltrate; the report’s risk is what trusted tools already read, echoing infostealer focus on agent tokens |
| Are attacks fully autonomous? | Rare in this dataset—Insikt Group expects human-directed agent stages (recon, credential discovery, exploit testing) to scale first |
| What should I do first? | Inventory AI-related npm/PyPI/VS Code extensions, pin versions, rotate keys after any suspicious plugin update, and log agent tool calls where your harness allows |
How Insikt Group built the dataset
Recorded Future required each incident to be searchable in its intelligence graph, confirmed as malicious AI use in the wild, and not a lab demo or academic paper. That filter matters when social posts claim “AI hacked everything.” The vendor’s own summary warns readers not to read 103 as 103 autonomous breaches of model providers.
The taxonomy splits the corpus two ways:
- AIM3 track (32 incidents) — AI embedded in malware or used to orchestrate offensive operations, graded on Recorded Future’s AI Malware Maturity Model.
- Non-malware AI abuse (71 incidents) — attacks on AI platforms, AI-themed delivery, AI-assisted fraud, or misuse of legitimate AI agents/services.
Roughly one-third of cases across both buckets were financially motivated. Nine of 32 AIM3 cases involved state-sponsored intelligence collection—mostly Level 2–3 (AI-assisted development and obfuscation), not full agent-only campaigns.
Image: Recorded Future Insikt Group
Insikt Group distilled five trends from the year of data. The first two are the ones that map cleanly onto local coding agents.
Trend 1: Developer tools maximize supply-chain blast radius
Recorded Future states plainly that AI-enabled development tools create new attack surfaces wherever they hold privileged access to code, credentials, data, or connected applications. The report names concrete 2026 episodes:
- Late February 2026 — compromise of a popular AI proxy package that routes applications to multiple LLM backends. Malicious updates enabled credential theft, lateral movement, and backdoor persistence.
- April 2026 — compromised AI tool packages delivering malware that harvests credentials, exfiltrates data, and reaches cryptocurrency wallets.
- May 2026 — Shai-Hulud supply-chain worm expansion targeting Claude Code for persistence and spread—the same family Beam covered when RubyGems “miasma” packages poisoned AI tool installs.
None of these required a novel model exploit. Attackers abused popularity and trust: developers already granted the package shell-adjacent or network reach. That pattern mirrors LiteLLM’s PyPI incident and older unauthorized Codex relays where proxy layers sat between the IDE and the model.
Mechanism step by step (proxy-package compromise)
- Attacker publishes or hijacks an update to a widely used AI routing library.
- Malicious code runs in the developer’s build or runtime with whatever API keys and environment variables the app loads.
- Stolen tokens enable lateral movement into GitHub, cloud control planes, or customer databases—the same graphs seen in classic supply-chain cases, faster because the hook is already labeled “AI.”
Trend 2: AI hype as lure—fake installers and ClickFix
The second trend is social, not protocol-level: attackers spoof landing pages for AI developer tools, run SEO poisoning, and fold AI branding into ClickFix flows. Recorded Future notes a sharp increase after March 2026.
That aligns with field reporting Beam already documented on fake Claude Code installers and ClickFix steganography against domain controllers. The Insikt Group finding adds volume context: Recorded Future reports these campaigns increased significantly after March 2026, alongside ClickFix and SEO poisoning—not isolated forum anecdotes.
For coding-agent users, the defensive line is unchanged but easier to skip when rushing to try a new CLI:
- Install only from vendor domains and signed package registries.
- Treat “paste this curl command to unlock the model” as credential execution, not onboarding.
State-sponsored agent experiments (limited sample)
Recorded Future highlights one case where up to eight AI agents conducted persistent attacks against Asian government entities with limited human intervention—an early agentic hacking datapoint. Most state-sponsored entries stayed at AI-assisted malware authoring (including LLM-generated “vibeware” living in Discord, Slack, or Google Workspace, per the report’s Pakistan-linked example).
That split should calibrate expectations beside Anthropic’s September 2026 threat intelligence: labs see orchestration, but commodity crime still lives at stolen API keys and poisoned dependencies.
Fraud acceleration and the “accidental automation” note
The report also covers LLM-assisted extortion—ransomware operators such as The Gentlemen using models to compress time between exfiltration and demand by summarizing stolen archives. Separately, Insikt Group argues most automated attacks today are accidental or bounded (for example, agents escaping test harnesses), with cost, reliability, and geopolitical risk still pushing human oversight on sensitive operations.
One odd datapoint: an incident where the threat actor was an AI agent attacking to pass a security benchmark. That is less likely on your laptop than in shared CI, but it reinforces why unbounded agent tools in pipelines need network and secret isolation.
What this means if you run AI coding agents
Recorded Future’s mitigations read like platform engineering for agents, not “buy another model guard”:
- Re-scope access — agents should not hold production admin tokens in the same profile used for adhoc refactors. Split read-only repo clones where possible.
- Approve consequential actions — align with vendor plan/execute modes; do not let auto-run touch IAM, billing, or customer data paths without a human diff.
- Audit AI dependencies — include MCP server configs, uvx/uv tool pins, and editor extensions in the same review pass as
package-lock.json. See Corelight’s MCP transitive-drift warning for why pin drift matters. - Monitor for stolen developer credentials — infostealers now target Claude/Codex session material explicitly; rotation must cover refresh tokens, not only passwords.
- Expect human-directed agent loops first — reconnaissance, credential discovery, and exploit path testing automated in stages, with operators reviewing output—mirroring AntiFox-class cloud bursts more than science-fiction autonomy.
Concrete commands and checks (from vendor guidance and aligned Beam posts, not invented version pins):
# See which AI-related packages your repo pulls (adjust ecosystem)
npm ls 2>/dev/null | rg -i 'litellm|openai|anthropic|mcp|langchain' || true
pip show litellm anthropic 2>/dev/null || true
# Claude Code / Codex: confirm you know which MCP servers are configured
# (paths vary; inspect your agent config directory and team policy)
After any suspicious plugin or proxy update: rotate OAuth and API keys, revoke active sessions in the provider console, and review git history for unexpected workflow or hook commits—worm families in this report target persistence, not one-shot reads.
What Beam can and cannot do here
Beam is local-first observability on your developer machine: heuristic scans of skills and MCP configs (11 patterns plus MCP version-pin checks), optional PreToolUse deny on Claude Code and Codex when cached workspace policy allows, and redaction before persistence for stored events. It does not detect PyPI typosquats before install, block npm publishes, or replace dependency pinning in CI.
Where Beam still helps against the Recorded Future developer-tool cluster:
- Flags when a new skill pulls
curl | bash, reads.env, or touchesAKIA-shaped strings—patterns that precede proxy-package exfiltration. - Surfaces risky tool calls so you can correlate them with plugin updates named in the report.
Limits stay explicit: heuristic, not semantic malware analysis; hook coverage is Claude Code / Codex (not every harness); missing cached policy is fail-open. Beam does not stop a already-compromised global npm package; it helps you see what your agent did afterward on-disk.
How this compares to other threat intel you may have read
Anthropic’s disrupted operations emphasized misuse of Claude itself as orchestrator. Recorded Future’s 103-incident corpus is vendor-neutral and heavier on supply chain + lure economics. GitGuardian’s agentic pentest catalog complements it: offensive frameworks and benign coding agents share secret-discovery mechanics. Together they argue for one access-control story across red team tools and Copilot.
For a living incident index, see the November 2026 attacks timeline.
Recorded Future also models a risk scenario where attackers use deployment tokens in a public repository to push a backdoored update into a widely used AI productivity app, reaching thousands of tenants without touching model weights. The second- and third-order effects in that scenario—regulatory scrutiny, customer churn, and tighter contractual security terms—mirror what security teams already fear from classic CI/CD secret leaks, except the compromised artifact is labeled AI. That narrative is speculative, but it is the vendor's explicit enterprise risk framing, not marketing filler.
Frequently asked questions
How many incidents did Recorded Future count, and over what period?
Insikt Group identified 103 documented, in-the-wild incidents between July 31, 2025 and July 31, 2026 where AI was part of the attack vector, tool, or target. Entries had to appear in Recorded Future’s intelligence graph and exclude proofs-of-concept or benign security research.
Does the 103 figure mean 103 autonomous AI attacks?
No. The vendor stresses that most cases accelerate familiar techniques—supply-chain compromise, phishing, extortion, and credential theft—rather than novel AI-only exploit chains. Fully autonomous operations remained uncommon in the dataset.
How many incidents involved AI inside malware or offensive orchestration?
Thirty-two of 103. Recorded Future mapped those along its AI Malware Maturity Model (AIM3). The other 71 covered attacks on AI systems, AI-themed lures, AI-assisted fraud, or abuse of legitimate AI agents and services.
Why are developer tools called out explicitly?
AI coding assistants and LLM proxy packages often hold credentials, repository access, and connected-application tokens. Compromising one package or plugin can reach thousands of downstream environments—the same reach attackers want for mass credential harvesting.
Which coding-ecosystem incidents does the report name?
It cites a late-February 2026 compromise of a popular AI proxy package, an April 2026 malicious AI tool package campaign, the May 2026 Shai-Hulud worm expansion targeting Claude Code, and broader ClickFix and SEO poisoning lures after March 2026 that spoof AI developer products.
What mitigations does Recorded Future recommend for agent-heavy teams?
Limit what agents can access, separate them from sensitive systems, require human approval for consequential actions, monitor dependencies and plugins, and watch dark-web channels for stolen developer API keys and OAuth tokens—not only passwords.
Availability failures count as incidents too: Anthropic's November 13, 2026 Claude Code authentication outage blocked new sessions while engineers worked without supervision gaps.
Related reading
- Skill injection and coding-assistant trust boundaries
- Shai-Hulud / RubyGems miasma wave
- Fake Claude Code installers
- LiteLLM PyPI compromise
- WardenStealer targeting agent tokens
- MCP transitive dependency drift
- Beam: what Beam watches on-device
Primary sources: Recorded Future — AI Is Both Target and Tool for Threat Actors (2026) · Cyber Security News summary (2026-11-12)
Counts, incident dates, and trend labels follow Recorded Future’s Insikt Group publication unless the vendor updates the report. Package names in the February–May 2026 examples are described by category in the primary source, not always by public CVE.