What Changed
Cisco Talos has published a data-driven look at how attackers use AI, based on prompt logs recovered from endpoints running AI coding tools such as Claude Code, Codex, Cursor and Gemini. The logs show what attackers asked for, how they got around refusals and what the tools built for them.
How Guardrails Were Bypassed
Talos found guardrails largely ineffective. The techniques were simple: claiming to own the target system, framing work as a CTF or bug-bounty task, splitting a malicious job into harmless-looking pieces, and conditioning the model through stored memories or personas. One actor used a framework, “Hephaestus,” that rewrote requests in neutral verbs.
What Attackers Built
- A DDoS operator controlling nearly 2,000 Android TVs.
- A bulk-mail validation operation (“Tubely”) handling tens of millions of records.
- A French-speaking actor’s React2Shell “Token Pipeline” credential harvester that reached 9,180 hosts and collected 3,048 files (312 MB).
- Cryptojacking through exposed Deluge and qBittorrent instances, with 814 Deluge instances and up to 582 miners.
- A Russian-language fraud chatbot, a Spanish-speaking actor’s Telegram Mini App agent and a Chinese-speaking operator accessing camera streams.
Why This Is An Operations Problem
Talos’s central finding is that the operator’s skill decides the impact. AI makes weak actors more productive and capable actors faster, and the same tools also show up in legitimate bug-bounty and penetration-testing work.
Know what matters before your first meeting.
Weekday mornings. Five minutes. What changed in security, why it matters.
By subscribing you agree to our Privacy Policy.
Free. Weekday mornings. 5 minutes or less.
What To Verify First
- Treat prompt logs and AI agent files found during incident response as evidence; they can reveal intent, tooling and targets.
- Check exposure of consumer devices, torrent clients and React-based services that featured in these campaigns.
- Assume faster exploitation of newly disclosed flaws when setting patch SLAs.
What Teams May Be Underestimating
The logs that helped Talos exist on your own developer machines too. AI tools record in detail what was asked and done, which helps investigations and is sensitive if leaked.
Source Context
This item was rebuilt from the following primary sources and original reporting:
Related In The Daily Brief
See this item in The 5-Minute Cyber Brief
Newer CyberExperts coverage on this topic
This article still works as background. If you want the current picture, start with the freshest related coverage below and today's brief.
Coder’s registry infrastructure compromised to push malicious modules
The Coder incident is a supply-chain lesson in miniature: once attackers can tamper with trusted module distribution, defenders are no longer verifying...
Attackers Turn Trusted Node.js Runtime Into Malware Delivery Tool in Targeted Attacks
The useful lesson in this campaign is not that Node.js is bad. It is that adversaries keep choosing legitimate runtimes defenders already...
HPE patches critical ArubaOS-CX remote code execution flaw
ArubaOS-CX deserves attention because switching software rarely gets treated with the same urgency as identity or edge security until exploitation arrives. A...
Monday’s brief: GlobalProtect logins without passwords, then SonicWall, AhsayCBS and NetScaler
The fastest way to catch up on what changed after this article was published.
Start your morning with the signal that matters.
Get the biggest cybersecurity developments, why they matter, and where to go deeper on CyberExperts.
By subscribing you agree to our Privacy Policy.
Free. Weekdays. Built for operators.
