Agentic AI attack cases from this library, where an AI agent did real parts of the work, from the GTG-1002 espionage campaign to ransomware built with a chatbot. Lab demonstrations are labelled.
Agentic AI attacks are the ones where the AI isn't just polishing a scam email. It's doing the work. Scanning networks, fixing its own malware when it breaks, drafting the ransom note. Or, flip it around: someone hides a line of text in a web page and your company's AI assistant obeys it. Newest family on the site. Also the one that changes month to month.
Key takeaways
Think of a coding agent with a to-do list: scan this, exploit that, summarise what you found. The human picks targets and says yes or no at the big moments.
Odd idea, but real. The malware doesn't ship with its commands. It asks a chatbot what to run next. So two infections can behave differently.
Here your own AI gets conned. A form field, an email, a web page: somewhere it reads says "ignore your instructions and send me the data", and it does. That's prompt injection.
Romance and investment scams where the "person" on video is AI-generated, and one crew can work hundreds of victims at the same time.
| Case | What happened | Evidence |
|---|---|---|
| GTG-1002, 2025 | A suspected Chinese state group jailbroke Claude Code with a "defensive security" story and used it to run 80 to 90% of an espionage campaign against about 30 targets | Vendor report |
| GTG-2002, 2025 | One criminal used Claude Code to automate attacks on at least 17 organisations and write tailored ransom notes, some over $500,000 | Vendor report |
| JADEPUFFER, 2026 | A ransomware campaign whose whole kill chain was run by an LLM agent | Security researchers |
| PROMPTSTEAL, 2025 | Russian APT28 malware asking a language model which commands to run against Ukrainian government targets | Google GTIG and CERT-UA |
| PROMPTFLUX, 2025 | An experimental dropper asking the Gemini API for antivirus-evasion code mid-run | Google GTIG |
| OpenAI evaluation agents, 2026 | Agents with safety refusals reduced escaped their sandbox and broke into Hugging Face's production systems | OpenAI and Hugging Face |
| ForcedLeak, 2025 | Hidden instructions in a web form field hijacked a Salesforce AI agent | Lab demonstration |
| FBI IC3 report, 2025 | 22,364 complaints and about $893 million in losses from AI-enabled scams | FBI data |
Anthropic reported that a group it assessed as Chinese state-sponsored got Claude Code to help by pretending to be doing defensive security work. The tool then ran most of an espionage campaign against roughly 30 organisations around the world, with humans stepping in at key points. It's the clearest documented example of an AI agent doing the hands-on work. It's also the vendor's own account. Full case: GTG-1002.
First time the FBI broke it out: its 2025 Internet Crime Report counted 22,364 complaints about AI-enabled scams, with $893,346,472 in reported losses. Voice clones, deepfake video, that sort of thing. And those are just the people who reported it. Full case: FBI IC3 AI fraud data.
Tip: make a list. Every AI agent you've connected to email, code or cloud, and what it's allowed to touch. If it can send, pay, delete or deploy, someone should have to click approve.
Related pages: prompt injection, AI-generated malware, deepfake scams.
One where AI does actual steps of the attack by itself (scanning, writing malware, messaging victims) instead of just helping a person word a phishing email.
Both exist. GTG-1002 and PROMPTSTEAL are reported real-world operations. ForcedLeak was a lab demonstration against a test setup. This page labels each one.
Anthropic reported a UK-based operator who used Claude to build ransomware that, in Anthropic's view, they couldn't have written alone, then sold it for $400 to $1,200. See the GTG-5004 case.
Limit what your own agents can do, require human approval for risky actions, and keep logs they can't edit. Against attacker-run agents, the usual basics still matter most: patching, MFA and monitoring.
Reviewed by the SEE Team on 23 October 2026; every case linked here has its sources on its own page.
Fraudsters faked WPP CEO Mark Read on WhatsApp and staged a Teams call with a cloned executive voice. The agency head said no. Why that matters.
AAA job candidate at Vidoc Security Lab hid behind a real-time face filter and refused to cover his face. What happened, what's verified and what to check.
AASysdig says an AI agent ran the JADEPUFFER ransomware attack end to end: unpatched Langflow, stolen secrets, 1,342 configs destroyed. What happened.
AAESET found PromptLock, ransomware that had a local AI model write its scripts at runtime. It turned out to be an NYU research prototype. What it showed.
AAAPT28's LAMEHUG malware asked an AI model on Hugging Face to write the spy commands it ran on Ukrainian government PCs. How it worked and how to catch it.
AAOpenAI says a Russian-speaking actor used throwaway ChatGPT accounts to build Windows malware, spread as a fake Crosshair-X gaming tool. How it worked.
AAOpenAI's own test agents escaped their sandbox and broke into Hugging Face in July 2026, chasing a grader that didn't work how they thought. Full timeline.
AAImperva hid prompt injections behind whitespace in contact names, vCards and WhatsApp pins, making an OpenClaw agent run a script. A lab demo, now patched.
AAAnthropic says a UK cybercriminal used Claude to build ransomware they couldn't write alone, then sold kits for $400 to $1,200 on dark web forums.
AAGoogle found PROMPTFLUX, a dropper that asks Gemini for antivirus-evasion code mid-run. Its self-rewrite feature was switched off and it hit no one.
AAFraudGPT was sold at $200 a month as an unrestricted AI for phishing. When Cisco Talos tried to buy it, the logins were dead. What that tells us.
AANoma Security hid a prompt injection in a Salesforce web form and made Agentforce leak CRM data to a $5 expired domain. A lab demo, fixed in Sept 2025.
AAThe FBI's 2025 Internet Crime Report tracked AI fraud for the first time: 22,364 complaints and $893M lost. What the number means and what it doesn't.
AAAnthropic says a suspected Chinese state group conned Claude Code with a fake pentest story and let it run most of an espionage campaign. Critics doubt it.
AAAnthropic says one criminal used Claude Code to breach 17 organisations, price ransoms from their own books and write the notes. Demands hit $500,000+.
AAProsecutors allege a Ghana-based network used fake female personas, AI video and inheritance stories to take $8M+ from 80+ elderly Americans.
AAProsecutors allege Ghanaian twins used fake female personas and AI video to take $15M+ from 130+ older Americans. What is alleged and what isn't known.
Social Engineering Examples