Topic
Use of general-purpose AI coding agents and LLMs by threat actors across reconnaissance, exploitation, data triage and exfiltration.
Shinhan Bank lost contact, loan and income data on about 25,000 customers to attackers suspected of using AI tools. Other lenders now need to learn whether the way in was a platform weakness they share.
Reality
Korean regulators sent security orders to about 500 financial firms after the same attacker IP turned up in breaches at seven lenders. Almost every firm doing the emergency reviews has no reported breach, so the cost is shared across the sector.
Reality
President Lee Jae-myung ordered a full probe of hacks that exposed data at four Korean banks, including about 25,000 Shinhan Bank customers. The response runs through every financial industry association before the probe has shown whether the banks share a weak point.
Perspective Coverage
4 publishersReality
Shinhan Bank exposed data on about 25,000 customers through a loan-broker inquiry platform kept apart from its core banking systems. Yonhap reports AI may have automated the credential stuffing, so the side systems that touch customer data are where lenders' security spending now gets tested.
Perspective Coverage
3 publishersReality
South Korea's Financial Services Commission ordered banks and card firms to check every externally reachable IT system after data leaks at four banks. The regulator will collect the returns and use them to build new cybersecurity measures for the financial sector.
Reality
DIVD said attackers chained two Zammad zero-days on its own internet-facing server and went from a hijacked session to root in seconds. It assessed that an AI agent was involved and says upgrading to version 7 is not a complete fix for both flaws.
Reality
CISA and six partner agencies updated AA26-097A on July 22, extending the vendor scope beyond Rockwell and adding detection guidance for tampered reusable code modules.
Perspective Coverage
12 publishersReality
Gambit Security says the ransomware crew used a commercial coding agent for hands-on post-compromise work between 8 April and 21 May, alongside a new Linux encryptor that force-kills running guests before it touches ESXi datastores.
Perspective Coverage
4 publishersReality
Attackers using AI can fix and retest a failed cloud privilege escalation in minutes instead of hours, according to an analysis in The Hacker News. The cost it puts on defenders is the hours spent rebuilding each alert's context before anyone acts.
Reality
Sysdig's threat research team watched one operator work a marimo notebook host for nine hours with hand-written scripts, and the eight-second jump to a bastion host at the end ran on tooling already staged on disk.
Perspective Coverage
3 publishersReality
Spain's AEPD published the account but has not yet verified it. In it, the agent scanned for flaws, logged in, altered personal data and opened invoices. The agency's own position is that AI adds speed and scale, not new threats.
Perspective Coverage
3 publishersReality
The image parsing bug had been fixed upstream about a year earlier, and the decision not to ship that fix belonged to Discourse. OpenAI's forum shared single sign-on with internal systems, so a forum account became GitHub access.
Perspective Coverage
9 publishersReality
Gambit Security says one operator used three AI agent tools to steal over 600,000 cards, spending an estimated $12,000 to $18,000. One retailer's scheduled job reinstalled a skimmer after a deploy removed it, so recovery tests have to cover every layer the agents touched.
Reality
Three cybersecurity specialists told The Verge the attackers they worry about are humans holding generative AI, aimed at infrastructure where the average US nuclear reactor is about 44 years old and some equipment vendors no longer exist.
Reality
The Spanish agency describes a third party using an agent to chain a successful login, vulnerability discovery, data modification and invoice access, and it published that account while its own investigation is still open.
Reality
ENISA says in a July 2026 assessment that the research-and-develop delay defenders implicitly count on is disappearing as automated systems take over the attacker's work, with the remaining window measured in minutes.
Reality
Harmony blames state actors and AI agents for shutting the layer-1 it launched in 2019, and the money set aside to pay validators to power down is worth more than everything left locked on the chain it closes.
Perspective Coverage
3 publishersReality
GTIG's 2026 accounting traces one crew from package-registry compromises on PyPI, npm and Docker Hub to agent instructions that planned and ran the campaign, then out to public malware releases anyone can reuse.
Reality
The attacker needed no zero-day, only frontier AI agents that cut a two-week intrusion down to a single shift, and the control that stopped their Terraform backdoor was a branch-protection gate rather than an alert.
Reality
Gambit Security says a ransomware operator asked Claude Code which databases mattered most, and got a ranked answer. Binary-focused detection does not see that step.
Reality