Recorded Future Finds AI Accelerating Familiar Cyberattacks

Recorded Future analyzed 103 malicious campaigns involving AI between July 31, 2025, and July 31, 2026, in research published on its website. Most incidents used AI to accelerate established attack methods such as phishing, extortion and supply chain compromise, while fully autonomous attacks remained rare.

The company classified 32 incidents as AI use in malware or offensive cyber operations. The other 71 involved attacks on AI systems, AI themed lures, assisted fraud and deception, or the abuse of AI agents and services. About one third of all incidents were financially motivated, while nine of the 32 malware and operations cases involved state sponsored espionage.

Developer tools were a major target because coding assistants and proxy packages can access credentials, source code and connected systems. Recorded Future also identified a campaign against Taiwanese government entities that used up to eight AI agents with limited human involvement. Most other state sponsored activity used AI to assist malware creation, obfuscation and targeting rather than run entire operations.

Recorded Future, whose Insikt Group produced the report, sells threat intelligence services to security teams.