Sophos AI Security Report 2026: AI Accelerates Attacks and Expands Enterprise Exposure
Report discovered via Awesome Annual Security Reports.
Summary
Sophos reports that AI is accelerating familiar attack techniques and defensive investigations while exposing enterprise credentials and developer tools. Its 2026 report highlights STAC6994’s agent-assisted malware development and gaps in AI governance.
Key points
- The report draws on Sophos MDR and incident response casework, threat intelligence, malware analysis, and observations across a customer base exceeding 625,000 organizations.
- Sophos found STAC6994 using approximately 12 AI agents to develop nearly 80 modules covering more than 70 evasion techniques. The operator subsequently deployed ransomware and stole data; claimed near-universal EDR bypass success was not fully supported by recovered evidence.
- Sophos concludes that AI primarily accelerates familiar attack workflows. Fully autonomous intrusion campaigns remain unconfirmed at scale, and AI assistance is often difficult to establish from incident telemetry.
- AI development infrastructure is an active target: SANDWORM_MODE packages used rogue MCP servers and prompt injection to steal secrets, while the Nx Console extension compromise harvested developer credentials.
- The report identifies OAuth tokens, API keys, excessive agent permissions, and shadow AI as enterprise exposure points, citing the Salesloft/Drift and Vercel incidents.
- Reasoning models can accelerate triage and investigation, but Sophos argues they complement rather than replace specialized behavioral detection, environment-specific baselines, and layered alert filtering.
- Recommended controls include an AI asset and credential registry, agent sandboxing, credential isolation, brokered tool access, egress restrictions, endpoint monitoring, and human approval for irreversible operations.
Article Details
- Publisher
- Sophos
- Report Period
- 2026
- Scope
- AI-enabled attacks, enterprise AI exposure, defensive operations, and governance, drawing on Sophos casework, telemetry, research, underground monitoring, and third-party reports.
- Sample Size
- Observations across over 625,000 customer organizations worldwide; individual studies and cited reports use different populations.
- Key Statistics
- STAC6994 used approximately 12 AI agents to develop nearly 80 modules testing over 70 techniques; Sophos reported that the development cycle compressed weeks into days, but did not substantiate the agents' claimed near-universal EDR bypass success.
- Sophos research reduced 11.8 trillion telemetry events collected over two weeks to 81,573 high and critical alerts, averaging fewer than 50 per organization.
- The report states that CVE-2026-10520 was exploited within 24 hours of proof-of-concept publication and CVE-2026-42208 within 36 hours.
- The Saviynt/Cybersecurity Insiders report found that 71% of large enterprises had deployed AI agents accessing core business systems, while only 16% governed that access effectively.
- An AI-assisted campaign reportedly compromised over 600 FortiGate firewalls across 55 countries in five weeks.
- Recommendations
- Maintain an AI registry covering tools, agents, models, accessible credentials, permissions, data flows, sandboxing, and expected connectivity; enforce conditional access, MFA, DLP, and credential rotation.
- Reduce agent blast radius through sandboxing, credential isolation, brokered tool endpoints with fixed schemas and egress allowlists, endpoint monitoring, and human approval for irreversible operations.
- Review and pin dependencies, monitor developer endpoints, and verify model provenance, MCP server integrity, serving region, retention, logging, and training-use policies before exposing private data.
- Capture and analyze prompt traffic, memory writes, and cross-agent handoffs as security events, and monitor outbound traffic for secrets and abnormal volumes.
- Patch critical internet-facing vulnerabilities within days and evaluate defensive AI using real SOC workloads, measuring validation effort, prompting efficiency, and analyst trust calibration.
MITRE ATT&CK
T1027 · Obfuscated Files or InformationSTAC6994's modular payload generator wrapped raw payloads in encryption and evasion layers to produce custom executables.T1195.002 · Compromise Software Supply ChainThe report describes a compromised Nx Console VS Code extension distributing credential-stealing malware and malicious npm packages impersonating developer utilities.T1486 · Data Encrypted for ImpactSophos CTU confirmed that the STAC6994 operator subsequently deployed ransomware.T1528 · Steal Application Access TokenThe Nx Console compromise harvested API credentials, while the Salesloft/Drift and Context.ai incidents involved compromised OAuth tokens.T1550.001 · Application Access TokenAttackers used Drift OAuth tokens to breach Salesforce environments and inherited Context.ai OAuth tokens to pivot into Vercel's internal environments.T1552.004 · Private KeysThe SANDWORM_MODE packages used a rogue MCP server and prompt injection to make AI assistants retrieve SSH keys.T1566.004 · Spearphishing VoiceSophos CTU observed advertisements for AI voice bots designed for vishing and call-based fraud.T1587.001 · MalwareSTAC6994 used AI agents to develop and test malware payloads and EDR evasion modules before operational deployment.
CVE
CVE-2025-32711Microsoft’s own Copilot vulnerability CVE-2025-32711 (EchoLeak) demonstrated how weak input sanitization can enable zero-click data leakage.CVE-2026-10520disclosure and exploitation. The directive's first real-world test arrived almost immediately: CVE-2026-10520 (Ivanti Sentry) was exploited within 24 hours of proof-of-concept publication and added to the KEVCVE-2026-42208exploited within 24 hours of proof-of-concept publication and added to the KEV catalog on June 12. CVE-2026-42208 (LiteLLM) was exploited within 36 hours, with attackers targeting databases containing upstream LLM
People
Adarsh KyadigeReport contributor identified as Senior Manager, AI Research.J. P. PetersonSophos CTO who authored the report's opening letter about the STAC6994 investigation and AI-driven changes in operational tempo.Matt StecReport contributor identified as Director, Sophos AI.Matt WixeyReport contributor identified as Senior Threat Researcher, X-Ops Insights.Nash BorgesReport contributor identified as SVP of Engineering and AI.Rafe PillingReport contributor identified as Director of Threat Intelligence, X-Ops Counter Threat Unit.Ross McKercharReport contributor identified as CISO.Ryan WestmanReport contributor identified as Senior Manager Threat Research, X-Ops Insights.Stefan AxelssonHis foundational work on the base rate fallacy in intrusion detection is cited to explain false-positive constraints in large-scale detection.
Threat Actors
APT28Identified in the report as APT28. CERT-UA attributed LameHug to it with moderate confidence; the report also attributes PROMPTSTEAL to it.DragonForceRansomware actor in a Sophos IR case where an extortion report analyzing stolen data was strongly suspected to be AI-generated.GTG-1002Anthropic-documented actor associated with a multi-target data theft operation in which Claude Code reportedly automated 80–90% of activity against approximately 30 entities.HackingRealmUnderground persona advertising synthetic identities, imagery, and conversational content for romance fraud and social engineering.STAC6994Sophos-tracked actor that used AI agents to develop and test post-exploitation payloads; CTU confirmed subsequent ransomware deployment and data theft.TeamPCPThe report states that the credential-stealing Nx Console extension compromise appeared to be part of a broader operation associated with TeamPCP.The GentlemenRansomware group whose leaked chats reportedly confirmed use of generative AI to produce attack artifacts.
Malware
LAMEHUGLameHug, Python-based malware that CERT-UA attributes with moderate confidence to IRON TWILIGHT (APT28), queried a hosted open-weight model to dynamically generate Windows reconnaissance commands per environment, makingLumma StealerWhen Context.ai was compromised – reportedly via a Lumma Stealer infection on a Context.ai employee device – attackers inherited those OAuth tokens and pivoted into Vercel's internal environments.MacSynca novel RAT, and a ClickFix campaign that leveraged legitimate ChatGPT shared chat URLs to deliver the MacSync infostealer.PROMPTFLUXAI Risk and Resilience report describes two documented malware families querying LLMs during execution: PROMPTFLUX, an experimental VBScript dropper using the Gemini API for just-in-time self-modification; andPROMPTSTEALan experimental VBScript dropper using the Gemini API for just-in-time self-modification; and PROMPTSTEAL, attributed to IRON TWILIGHT (APT28), marking the first confirmed observation of state-sponsoredVoidLinkThe Verizon DBIR documented VoidLink (a malware framework assembled by an AI agent in six days) and PromptLock (AI-powered ransomware first discovered by ESET in August 2025, although this was later revealed to most
Vendors
AnthropicAt the furthest end, Anthropic’s November 2025 disclosure documented a Chinese state-sponsored campaign using Claude Code to attempt compromise of roughly thirty targets.CrowdStrikeAround a dozen AI agents, coordinated through a commercial coding assistant, were writing and testing malware against Sophos, CrowdStrike, and Windows Defender endpoint protection, each on its own virtual machine.MicrosoftThe taxonomy complements existing frameworks such as MITRE ATLAS, Microsoft’s agent failure-mode taxonomy, MIT’s AI Risk Repository, and NIST AI 100-2.Sophos- [Sophos X-Ops taxonomy of AI threats](#sophos-x-ops-taxonomy-of-ai-threats)
Products
ChatGPTabsorbing AI as infrastructure.** Sophos documented threat actors selling brokered API keys for Claude, ChatGPT, and Grok. Forums have spawned channels dedicated to AI prompt engineering, jailbreaking techniques, andClaudeis absorbing AI as infrastructure.** Sophos documented threat actors selling brokered API keys for Claude, ChatGPT, and Grok. Forums have spawned channels dedicated to AI prompt engineering, jailbreakingClaude CodeA threat actor targeting Mexican government organizations used Claude Code and GPT to generate scripts.CopilotMicrosoft’s own Copilot vulnerability CVE-2025-32711 (EchoLeak) demonstrated how weak input sanitization can enable zero-click data leakage.CursorThe attacker had provisioned virtual machines from Ludus and was using the Cursor IDE with AI agents to develop and test post-exploitation tools.Fortinet FortiGateThe AI-assisted campaign against FortiGate devices compromised over 600 firewalls across 55 countries in five weeks – the work of a threat actor using commercial AI tools.GrokAI as infrastructure.** Sophos documented threat actors selling brokered API keys for Claude, ChatGPT, and Grok. Forums have spawned channels dedicated to AI prompt engineering, jailbreaking techniques, and malwareIvanti Sentryand exploitation. The directive's first real-world test arrived almost immediately: CVE-2026-10520 (Ivanti Sentry) was exploited within 24 hours of proof-of-concept publication and added to the KEV catalog on JuneLiteLLMwithin 24 hours of proof-of-concept publication and added to the KEV catalog on June 12. CVE-2026-42208 (LiteLLM) was exploited within 36 hours, with attackers targeting databases containing upstream LLM provider keys.Nx Console VS Code extension4. **Supply chain attacks are specifically targeting AI development infrastructure.** The Nx Console VS Code extension compromise distributed credential-stealing malware. SophosLabs analysts investigated fake ClaudeOpenClawWhen OpenClaw gained traction in early 2026, over 30,000 instances were exposed on the internet and threat actors were already discussing how to weaponize its modular ‘skills’ for botnet campaigns.Salesforcetarget.** The Salesloft/Drift incident showed how chatbot OAuth tokens translate directly into Salesforce environment compromise. Separately, Sophos CTU analysts observed claims from threat actors on
Tools
CerBERTus- **CerBERTus**, a ‘three-headed’ BERT-based model, addresses the brittleness of binary jailbreak detection. A single shared encoder feeds three classification heads: harmfulness (primary), goal category (what the userCobalt StrikeTools marketed as ‘AI-led’ are appearing: Leak Bazaar (ML-powered stolen data triage) and an updated Cobalt Strike with REST API and MCP server integration.HoneyTrapOne such example, HoneyTrap, demonstrated a 149% increase in ‘attacker resource consumption’ compared to conventional defenses.Leak BazaarTools marketed as ‘AI-led’ are appearing: Leak Bazaar (ML-powered stolen data triage) and an updated Cobalt Strike with REST API and MCP server integration.LLM Scoping- **LLM Scoping** classifies whether queries fall within a feature’s intended function, rejecting out-of-scope requests before they reach the LLM. Across evaluated methods, scoping models significantly outperformedLudusThe attacker had provisioned virtual machines from Ludus and was using the Cursor IDE with AI agents to develop and test post-exploitation tools.MANTISDeceptive environments, such as those proposed in the Palisade LLM Agent Honeypot and the MANTIS framework, can fill an agent’s context with misleading information, waste its inference budget, and impose real economicMulti-round Automatic Red Teamingattack success rates to near zero on multiple public benchmarks. The team also applied Multi-round Automatic Red Teaming (MART) to harden scoping models against adversarial adaptation.SliverA fourth VM operated as a Sliver C2 server.Untrusted Data Scanner- **The Untrusted Data Scanner (UDS)** inspects external content for prompt injection before it reaches an LLM or agent. Every LLM use case has an instruction channel (what the application tells the model to do) and a