Cybercriminals do not need to invent new attacks to become more dangerous. They can simply improve the attacks that already work. AI is helping them do that. It cuts the time spent researching a target, writing code, and solving technical problems along the way.
The concern is growing because this help no longer stops at a single task. Some attackers now connect AI models to tools that carry out parts of an operation on their own. A human still picks the target and directs the work. But that human can hand off far more of the effort than before.
Anthropic’s Report Shows AI Doing More of the Work
Anthropic’s September 2026 threat report describes this shift directly. It covers activity the company disrupted between December 2025 and August 2026. In several operations, attackers used multi-agent AI frameworks to handle reconnaissance, exploitation, and data theft, while humans mainly set the targets and reviewed what came back. Anthropic is careful to say these cases are not a representative sample of all attacks. They are the most notable examples the company found, not an average day of misuse.
One case stands out. Anthropic linked an espionage group it calls GTG-20006 to the Midnight Blizzard activity cluster, with an operator the company believes is a Russian speaker. That group used Claude to build phishing infrastructure, move laterally inside victim networks, pull hundreds of gigabytes of data out through bulk mailbox exports, and automatically register its own devices inside victim systems to keep access alive. When security products caught and flagged its tools, the group used AI to study the detection, modify the toolkit, and redeploy it until it slipped through again.
A Live Example: Attacks on South Korean Banks
A case reported on October 8 brings the issue closer to everyday business risk. CrowdStrike, in a report carried by Reuters, said at least nine South Korean banks have been hit since late September. The firm assessed with moderate confidence that the attacker is likely a Chinese speaker and financially motivated, possibly a 26-year-old based in Maoming, in China’s Guangdong province. CrowdStrike has not attributed the campaign to any named group.
The attacker reportedly used ARTEX, an open-source penetration-testing agent built in China and published on GitHub, which connects to external large language models to run parts of an intrusion. Reporting also describes the attacker using Claude through Claude Code during the operation. South Korean police opened a probe into the bank attacks this week. The case is a useful reminder that AI-assisted intrusions are no longer a theoretical risk sitting inside a research report. They are already landing on real financial institutions.
What CrowdStrike’s Global Threat Report Adds
CrowdStrike’s 2026 Global Threat Report puts a number on the trend. The company recorded an 89 percent increase in attacks by AI-enabled adversaries in 2025 compared with 2024. That figure reflects CrowdStrike’s own observations. It does not mean that 89 percent of all cyberattacks used AI.
The same report found that 82 percent of its 2025 detections were malware-free. This is a separate finding, and it does not mean AI caused those intrusions. It does show why security teams must look past malicious files. CrowdStrike links this pattern to attackers using legitimate logins, trusted identity workflows, and approved SaaS integrations to move around a network without ever dropping malware that a scanner could catch.
AI Assistance Does Not Stop at the Break-In
The GTG-20006 case shows that AI assistance can continue long after the initial intrusion. The group used AI workflows to organize and extract stolen data, keep its access alive, and rebuild its malware each time a security product flagged it. That creates a practical problem for defenders. A detection that stops one tool does not necessarily stop the operation behind it. The attacker can simply have AI rebuild the tool and try again.
None of this proves that AI makes every attack a success. It shows that some operators can repeat and adapt their work with far less manual effort than before.
Why This Changes the Economics of Delay
For defenders, faster and cheaper attacker iteration changes the math on waiting. A weakness left exposed gives an attacker another opportunity. A stolen account left active gives them another route in. A blocked payload can simply be replaced with a new one. Security teams should plan for repeated attempts rather than treating one blocked attack as the end of the story, and they should investigate the access that made the attempt possible in the first place.
Prevention Still Starts With the Fundamentals
None of this changes what defenders should do first. Organizations should patch exposed systems promptly. They should limit account privileges and use phishing-resistant authentication wherever possible. They should restrict unnecessary script execution and inspect files before letting users or automated systems process them.
Detection Needs to Connect the Dots
Detection works best when it links activity across systems rather than watching each one alone. An unusual login deserves more attention when it is followed by a new access token or a large data export. A document that launches a command interpreter deserves investigation on its own merits. These behaviors matter whether or not AI had any part in producing the attack.
Response Must Cover the Whole Intrusion
Removing a malicious file can still leave a stolen session active. Resetting a password can still leave another access method standing. Response teams should check for persistence, revoke every compromised credential and token they can find, and investigate what data an attacker actually reached before calling an incident closed.
AI Also Gives Defenders Useful Help
AI is not only a tool for attackers. It can help defenders review code, summarize evidence, and support investigations that would otherwise take far longer. Its value depends on reliable inputs and controlled actions. Security teams still need clear permissions and real human oversight whenever an automated decision could disrupt a business system.
The Takeaway
The lesson from this stretch of reporting is a practical one. AI is making existing attack methods faster and easier to repeat, from Anthropic’s disrupted espionage operations to a live campaign against South Korean banks. Defenders should judge the resulting behavior, not just the tools behind it, and close the paths that allow that behavior to repeat. The immediate goal is simple to state and hard to execute: shorten the gap between the first warning and effective containment.