AI in cybercrime<\/strong> is no longer confined to specialized hacking groups. Tools powered by artificial intelligence serve everyone from perpetrators of mass scams and phishing campaigns to data thieves and groups conducting cyber espionage. AI makes their work easier at many stages: researching potential victims, creating persuasive content, and analyzing information obtained during a breach.<\/p>\n\n\n\n Two reports published in September 2026 illustrate how cybercriminals\u2019 use of AI is changing. The first came from Google Threat Intelligence Group<\/strong><\/a>, Google\u2019s team of digital threat analysts. The second came from Anthropic<\/strong><\/a>, the company behind Claude. Both analyses point to the same trend. AI is moving beyond its role as a digital assistant and increasingly supporting successive stages of an attack<\/strong>, from identifying weaknesses to stealing data.<\/p>\n\n\n\n Google<\/strong> highlights the shift from basic prompting\u2014giving a model individual instructions\u2014to agentic systems. These systems can receive a goal, a set of instructions, and access to specific tools. They can then carry out successive steps, check their results, and try alternative approaches when they encounter a problem.<\/p>\n\n\n\n The difference is like asking a chatbot to write a fraudulent email versus asking it to prepare an entire campaign.<\/p>\n\n\n\n In the first case, a person receives a finished text and decides what to do next. In the second, the system can research recipients, prepare several versions of a message, create the necessary technical components, check whether they work, and attempt repairs if something goes wrong. A person still sets the goal and provides access to the tools, but no longer has to carry out every step personally<\/strong>.<\/p>\n\n\n\n In one case described by Google, cybercriminals gained access to corporate cloud resources and used them, together with an AI coding chatbot and AI agents, to steal login credentials on a large scale. Planning, preparing, and launching the operation took less than six hours<\/strong>.<\/p>\n\n\n\n AI agents automatically identified vulnerable targets, resolved technical problems, and rotated the IP addresses used in the campaign. Google concluded that this reduced \u201chuman-in-the-loop latency\u201d between successive stages of the attack.<\/p>\n\n\n\n The attack was not fully autonomous. A person first had to gain access to the infrastructure and define the operation\u2019s goal. Even so, the example reveals a significant change<\/strong>. Less time now passes between a cybercriminal\u2019s decision and the execution of subsequent stages of an attack. Previously, each stage required human involvement. Someone had to review scan results, fix code, find another route to the target, or decide what to do after encountering a security control.<\/p>\n\n\n\n Google\u2019s observations are not isolated. Anthropic<\/strong> described cases in which cybercriminals<\/a> used its tools. The findings showed that artificial intelligence helped them gather information and create content, as well as automate activities leading to intrusions and data theft.<\/p>\n\n\n\n In one case, AI tools supported almost the entire operation<\/strong>: setting up infrastructure, conducting phishing, maintaining access to compromised systems, and extracting data. In another, AI agents rebuilt malware after security systems detected it. A person still set the goal and monitored the results, but the model took over a substantial share of the repetitive technical work.<\/p>\n\n\n\nGiven a Task, the System Looks for a Solution<\/h2>\n\n\n\n
AI in Cybercrime Speeds Up Every Stage of an Attack<\/h3>\n\n\n\n
Anthropic Describes a Similar Pattern<\/h2>\n\n\n\n