01What the researchers found
According to the reporting, the exposed directory logged 8,257 messages across 133 sessions. A human operator gave a victim-specific prompt and reviewed each step; the intrusions were executed through an AI coding tool using commercial models. AI-managed knowledge bases tracked victims, stolen credentials and campaign progress.
When a model refused a request, the operator reportedly rewrote it as an "authorized red team assessment" rather than switching models. Safety filters alone are not a reliable barrier against a determined attacker.
02The way in was familiar
Initial access came from exploiting internet-facing edge and remote-access systems at scale, including FortiClient EMS, SimpleHelp, cPanel and VPN gateways. Known, actively exploited vulnerabilities were part of the toolkit.
That is the important point: AI made the attackers faster and able to run more intrusions at once, but they still entered through unpatched, exposed systems. The basics decide whether the speed matters.
03What changes for defenders
Time between a public vulnerability and mass exploitation keeps shrinking. Treat actively exploited flaws on edge devices as emergencies measured in days, not monthly cycles. Know every internet-facing device you own—especially remote-access tools installed by IT providers.
Faster attackers also mean less time to notice lateral movement. Alert on new administrator accounts, unusual remote-management sessions and large outbound transfers, and make sure someone actually responds out of hours.
04Practical steps
Inventory edge devices and remote-access software, patch known exploited vulnerabilities first, require MFA on every remote entry point, and keep offline or immutable backups. Rehearse your response so decisions do not wait for a meeting.
This article reflects research published on October 23, 2026.
Sources & further reading
The Hacker News — Exposed infrastructure reveals how ransomware affiliates used AI agents
Continue with MindSec
Build offensive and defensive skills with INE certifications