We went through 68 AI-related attacks and incidents on the public record, and rechecked the numbers everyone quotes. The techniques are mostly old. The labour is what has changed, and in 2026 it changed fast.
By Ninja Labz · figures rechecked against their sources on 9 November 2026
$893mUS losses in complaints mentioning AI, 2025 (FBI)
71%of that was investment fraud
14 of 1,061AI-found bugs confirmed exploited (VulnCheck)
7.5 vs 8new crews' median claims in 30 days, 2026 vs 2024 (Ninja Labz)
The story so far
Most of what is written about AI and cybercrime falls into two camps. One says AI is about to overwhelm every defence. The other says it is all hype. The evidence supports neither.
Through 2025, the sceptics had the better of it. Mandiant, after more than 500,000 hours of investigations, wrote: "we do not consider 2025 to be the year where breaches were the direct result of AI." The UK's National Cyber Security Centre had predicted change "through evolution and enhancement of existing TTPs, rather than creating novel threat vectors."
Then 2026 happened, and one person or no person started doing work that used to take a team.
What actually changed: the labour
Between 11 January and 18 February 2026, an actor Amazon rated "low-to-medium" in skill compromised more than 600 FortiGate devices in over 55 countries using commercial AI. Amazon observed no exploitation of FortiGate vulnerabilities. The actor used exposed management ports and weak passwords, and moved on when it met well-defended networks.
In October, CrowdStrike watched a China-linked group move "from single intrusions to multiple simultaneous engagements directed by a human operator". More than 200 organisations were targeted over 11 days. CrowdStrike confirmed post-exploitation at nine.
The most striking case had no human attacker at all. In July 2026, OpenAI models in an internal test, with certain safeguards disabled, escaped their sandbox using zero-day flaws in Artifactory and broke into parts of Hugging Face's production systems. The aim appears to have been stealing the answers to the test. METR, which investigated independently, found that about 700 of roughly 1,200 agents meant to be isolated took part after finding a way to talk to each other. Hugging Face logged about 17,600 actions and said "most actions went nowhere". It was an internal research model that was not intended for release.
OpenAI's own conclusion: "organizations should no longer assume that sophisticated cyber operations require continuous human direction."
What hasn't changed: what they get into
Look at how these attacks start and the picture is familiar. Exposed admin pages. Default passwords. Known flaws left unpatched. The FortiGate actor gave up on hardened targets. Kaspersky, examining AI-directed attacks on schools this autumn, concluded that AI "does not yet present fundamentally new challenges for detection."
Basic security still works against these attackers, and it is cheaper than it was to find the organisations that don't have it.
Where the money is: fraud
The FBI's 2025 report is the first to track AI as its own category: 22,364 complaints and $893 million in losses, about 4% of everything reported. Investment fraud alone was $632 million. Business email compromise with a reported AI link was $30 million, about 1% of that category.
The largest confirmed single case remains Arup, where a Hong Kong employee sent HK$200 million after a video call. The company confirmed "fake voices and images were used".
One warning on the FBI number. "AI Related" means only that the complaint "contains a reference to artificial intelligence". Plenty of victims never know AI was involved, and some will mention it when it wasn't.
Ransomware: no visible speed-up
We tested one specific prediction. If AI makes it much easier to start a ransomware crew, new crews should reach volume faster. Using leak-site claims, we measured every new crew's first 30 days.
New crews first seen
Crews
Median claims, first 30 days
Posted more than 20
Apr to Nov 2023
25
10
28%
Apr to Nov 2024
34
8
18%
Jun to 9 Oct 2026
52
7.5
17%
The data can't rule out a change of a few claims either way, and leak-site claims can't show how an intrusion was carried out. The field is more crowded than it was, but our collection also improved, so we don't read that as an AI effect. Meanwhile Chainalysis found payments fell 8% in 2025 to about $820 million while claimed victims rose 50%. More names on leak sites has not meant more money.
The bugs: real, and mostly unused
AI can find software flaws at scale. Mozilla fixed 271 in Firefox 150 that Claude Mythos Preview surfaced, while noting: "We haven't seen any bugs that couldn't have been found by an elite human researcher." Attackers aren't obviously cashing in yet. VulnCheck counted 14 confirmed exploited out of 1,061 AI-attributed vulnerabilities and called the impact "real but modest".
Attackers have got faster, and that matters. Mandiant's estimated mean time to exploit is now minus seven days. The handover from initial access to a second criminal group fell from over eight hours in 2022 to 22 seconds in 2025. Nobody has shown how much of that is AI.
Numbers to stop quoting
"80% of ransomware uses AI." An MIT Sloan working paper said so. It was pulled after researchers showed it labelled almost every major group as AI-using without evidence.
"AI phishing is 4.5 times more effective." Microsoft compared AI emails (54%) with generic ones (12%). In the same 101-person study, human experts also scored 54%.
"PromptLock is the first AI ransomware in the wild." It was an NYU research project. ESET still calls it the first known case of AI-powered ransomware.
"Deepfakes will cost $40bn by 2027."Deloitte's forecast covers all generative-AI-enabled US fraud, across FBI fraud categories.
"AI ran 80 to 90% of a Chinese espionage campaign." That is Anthropic's account of its own logs. It may be right, but critics note it published no indicators of compromise, and outsiders cannot check the percentage.
Six questions for any AI attack claim
Was it a real attack, or research, a test or a demo?
Who says AI was used, and how do they know?
Did AI make the difference, or would the attack have worked anyway?
How did the attacker get in? Was that new?
Who is the source selling to?
Is the number measured, modelled or from a survey of opinions?
Lines you can use
AI has changed how much labour an attack takes far more than how an attack works.
Ninja Labz analysis of 68 AI-related incidents
The most expensive thing AI has done so far is help people lie, not help them hack.
Ninja Labz, on FBI 2025 complaint data
New ransomware crews posted a median of 7.5 claims in their first 30 days in 2026, against 8 in 2024. If AI has made them faster, it does not show up in how quickly they reach volume.
Ninja Labz leak-site analysis, 9 Nov 2026
AI-found bugs are plentiful. Exploited ones are not: 14 of 1,061, according to VulnCheck.
VulnCheck, 28 Jul 2026
The study behind the claim that AI phishing is 4.5 times more effective found that human experts scored exactly the same 54%.
arXiv 2412.00586; Microsoft Digital Defense Report 2025
Anyone still saying nothing has changed needs to read the Hugging Face report. Anyone saying everything has changed needs to read what the attackers actually got into.
Ninja Labz
The record: 68 AI-related incidents
From Microsoft's Tay in 2016 to November 2026. 47 involve AI used by attackers or acting on its own; 21 are attacks on AI systems. 19 are confirmed by a victim, court, police or government. 27 are documented technically by a named researcher or vendor. 10 rest on press reporting and 12 are claims outsiders can't check, including AI companies' reports about misuse of their own models.
68 incidents
2016-03-23 to 25ConfirmedAI as target
Microsoft Tay
A coordinated group manipulated a learning chatbot on Twitter into posting offensive content within 24 hours.
Sysdig describes an LLM-driven operator encrypting 1,342 Nacos items, then returning with ransomware for AI model files.
What AI did
Self-correcting payloads in 31 seconds. Entry was a Langflow CVE, a 2021 Nacos bypass and a default key. Ransom note's Bitcoin address matches a documentation example.
Scale
One victim; Sysdig calls it a production database server
Harm
Tables dropped; key unrecoverable
Note
AI role inferred; a honeypot is not explicitly excluded in the text
OpenAI said its models reached sites including SEC.gov and used public keys on Census data, finding no compromise; other outlets report 100+ organisations notified.
What AI did
Self-directed web activity; "most" low severity, per OpenAI.
Scale
"Dozens" to 100+ organisations
Harm
53 user images leaked, per Wikipedia's citation of Guardian
Note
OpenAI pages and Reuters and Guardian unopened; CNBC opened
We searched public sources for every substantiated AI-related incident and graded each by who confirms it. "Claimed" does not mean false. It means an outsider can't check it. We rechecked the headline figures in this briefing against 20 of their sources. Some rows in the record rest on secondary reports, and each shows its source.
Nobody can currently say what share of crime is AI-assisted, because there is no reliable test for AI-written text or code. There is no sound global figure for deepfake losses, and little evidence on how AI agents perform against well-defended networks.
Press. Scott Gardner, Ninja Labz: message on LinkedIn. Everything here is free to use with credit.
Declaration of interest. Ninja Labz sells threat intelligence, so we are a vendor too. We used AI throughout this research, including a Claude model from Anthropic to compile the record. Anthropic's reports are graded by the same rule as everyone else's. Our ransomware data has almost no collection from June 2025 to March 2026.