What did Google’s Q3 2026 AI Threat Tracker, Anthropic’s September 2026 threat intelligence report, and Microsoft’s contemporaneous findings reveal about the shift from basic AI-assisted hacking to autonomous, agentic cyberattack systems—with state-linked groups, cybercriminals,

The shared finding was not that AI had created wholly new forms of intrusion, but that it was turning established tradecraft into repeatable, multi-step workflows: models could help actors plan, generate, test, adapt, and scale attacks with less specialist labor and less hands-on time. The evidence is strongest for AI accelerating and coordinating familiar operations—not for fully independent systems operating without meaningful human direction. 107

• From assistant to operator: Google’s tracker described a move from one-off prompting toward integrated agentic workflows, including automated scanning, credential harvesting, troubleshooting, and infrastructure rotation. This compresses an attack that once required several tools and operators into a rapidly iterating pipeline. 11

• What attackers were using AI for: Across the reports, observed or alleged uses included target research and profiling, multilingual spear-phishing content, malware and script development/debugging, infrastructure scaffolding, stolen-data summarization, and social-engineering material. Microsoft’s assessment was that most malicious AI use still centered on generating text, code, and media—not autonomous end-to-end compromise. 10

• State-linked cases: Anthropic said it disrupted activity involving Russian-, Chinese-, and Iranian-linked actors, alongside financially motivated groups, spanning cyber operations, influence, surveillance, fraud, biological misuse, conventional-weapons work, and model distillation. Reuters reported that Anthropic’s cases included a Russia-linked operation targeting Ukrainian officials and alleged Chinese AI-company misuse of Claude. These are company attributions and case studies, rather than a measure of all threat activity. 724

• Malware adaptation and credential/API-key theft: Anthropic’s reported cases show why agentic use matters operationally: an attacker can ask a model to alter or rebuild code after security products flag it, use compromised credentials or API keys as inexpensive compute, and iterate at machine speed. The risk is the feedback loop—generate, test, revise, deploy—rather than any single malicious prompt. 87

• ShinyHunters example: Microsoft attributed passkey- and SSO-themed social-engineering campaigns against corporate Microsoft 365 accounts to actors linked to ShinyHunters, Helix, and related extortion groups. The reported pattern was reconnaissance followed by IT-support impersonation to obtain access and steal cloud data—an example of conventional credential theft enhanced by better targeting and scalable lures, rather than proof that AI independently executed the whole intrusion. 3

• Impersonation at scale: AI brand impersonation fits the same economics: credible-looking support pages, phishing messages, chat interactions, cloned voices or visuals, and multilingual variants can be produced and refreshed cheaply. Defenders therefore face greater message volume, personalization, and variation, weakening rules that rely on known templates or obvious grammatical errors. Microsoft specifically observed AI use in phishing-lure generation and translation. 10

• Model distillation as a parallel security threat: Google characterized systematic querying of Gemini to extract proprietary capabilities as “distillation” or model-extraction attacks—an IP and capability-security problem, not merely ordinary cybercrime. Public reporting described campaigns involving very large prompt volumes; the defensible interpretation is that attackers may try to reproduce a frontier model’s useful behavior through API probing, while providers try to identify abusive querying and protect their models’ reasoning and safeguards. 118

• Why the cost equation changed: AI lowers the marginal cost of drafting, localization, research, code assistance, and iterative deception. That gives low-resource criminals and hacktivists portions of the capacity previously associated with larger teams; defenders must distinguish more individualized, frequently changing malicious content from legitimate communications. The reports therefore imply an asymmetry in speed and scale, not an inevitability that every AI-enabled attack succeeds. 610

• Responsible-AI implication: The same access, capability, and monitoring questions extend beyond cybercrime. Anthropic’s report explicitly covered attempted misuse involving biological and conventional-weapons development as well as cyber operations, which is why the policy discussion concerns abuse monitoring, account/API controls, rate limits, detection of model extraction, incident sharing, and safeguards for high-consequence domains—not only phishing defense. 162

A key caveat: these publications document detected and disrupted cases, so they demonstrate capability and emerging operational patterns; they do not, by themselves, establish that autonomous attacks are now the dominant form of cybercrime. 7