When AI Becomes Both the Attacker and the Target

Artificial intelligence is changing cybersecurity faster than many organisations are changing their defences. This past week brought further evidence that AI is no longer simply a tool for analysing threats. It is increasingly being used to conduct attacks, manipulate security systems and exploit the very infrastructure on which AI applications depend.

The most important development is not that cybercriminals have discovered artificial intelligence. It is that AI is beginning to change the speed, scale and complexity of cyber operations. At the same time, important advances in defensive AI offer organisations new opportunities to identify and eliminate vulnerabilities before attackers exploit them.

The challenge for business leaders is therefore clear: how do we benefit from increasingly powerful AI without surrendering control over our systems, information and critical operations?

AI-assisted attacks move into real financial institutions

One of the most significant developments came from South Korea, where financial institutions experienced cyberattacks involving the suspected use of autonomous AI tools.

On 7 October, CrowdStrike published an investigation identifying attacker-controlled infrastructure containing ARTEX, an AI-assisted penetration-testing framework, together with language-model configuration files and operational session histories.

The investigation provides evidence that AI-assisted tools were used in activity targeting financial organisations and associated with data theft. Although the precise number of affected institutions and the attacker’s identity remain unconfirmed, the findings demonstrate that agentic capabilities are moving beyond controlled security research into actual criminal operations.

For financial institutions, this should be a serious warning. A single attacker equipped with capable AI tools may be able to accelerate reconnaissance, vulnerability discovery and other stages of an intrusion.

Banks, insurers and organisations handling sensitive customer information must strengthen continuous monitoring, identity protection, application security and incident-response capabilities. Security arrangements designed around the assumption that attackers require considerable time and human resources may no longer be sufficient.

The software supply chain becomes an entry point into AI infrastructure

Another important warning emerged on 8 October when Socket identified a compromised version of the Tensorlake npm software development kit, used in AI-agent infrastructure.

The malicious package, [email protected], contained code designed to execute during installation, steal credentials, establish persistence and support further compromise. Its targets included cloud credentials, development secrets and configuration files associated with AI development tools.

This is particularly concerning because organisations may carefully isolate the code generated by AI agents while overlooking the security of the software components used to build and operate those agents.

The compromise illustrates a fundamental weakness in modern development environments: trusted software dependencies can become vehicles for attackers.

Organisations using the affected package should investigate immediately. More broadly, development teams should verify dependency provenance, restrict installation-time execution, protect build credentials and continuously monitor software supply chains.

AI agents are creating new trust boundaries that attackers can cross

Research published during the week highlighted another weakness in the rapidly expanding ecosystem of AI integrations.

Security research into Model Context Protocol implementations continues to show how server-side request forgery, unsafe tool chaining and weak trust boundaries can allow attacker-influenced requests to reach systems that should remain inaccessible.

The confirmed vulnerabilities are real implementation weaknesses. Broader protocol-pivoting scenarios remain security research demonstrations, not evidence that every MCP deployment is compromised. Nevertheless, the implications are considerable.

An AI assistant connected to databases, email systems, financial applications or administrative tools can become a powerful attack pathway if its permissions are excessive or its instructions are manipulated.

Organisations must stop treating AI agents as trusted users simply because they operate inside corporate systems. Every agent should have a defined identity, limited permissions, validated tool inputs and independently enforced authorisation. Sensitive actions must remain subject to appropriate human approval.

A phishing email can now deceive both employees and their AI assistants

Research this week also showed how attackers are combining conventional phishing techniques with hidden instructions intended to manipulate AI-powered email assistants.

An employee may receive what appears to be an ordinary business email. Hidden within its HTML or encoded content, however, are instructions designed to influence the AI system summarising or processing the message.

The danger is that an assistant could incorrectly classify a malicious email as legitimate, exaggerate its urgency or recommend an action that benefits the attacker.

The lesson is particularly relevant to organisations adopting AI for administrative efficiency. Email security must now protect both the human recipient and the AI systems processing the message. External content should never acquire the authority to issue operational instructions simply because an AI assistant has read it.

Financial transfers, supplier banking-detail changes and other consequential decisions should require independent verification.

Malware is learning to manipulate the systems analysing it

Research published this week examined how malware authors are attempting to interfere with AI-assisted security analysis.

Researchers identified malicious software containing natural-language instructions intended to persuade AI analysis tools to ignore suspicious behaviour, refuse further investigation or classify malicious code as harmless.

Importantly, these findings do not show that attackers can reliably defeat AI-based detection. Some techniques influenced results in controlled testing, while several more elaborate approaches proved ineffective or counterproductive.

The distinction matters. AI-assisted malware analysis remains valuable. However, organisations must ensure that suspicious files are treated as evidence to be examined, not as sources of instructions that the analysing system should obey.

Security teams should combine AI-assisted analysis with conventional detection, behavioural monitoring, sandboxing and independent validation.

A significant defensive response is beginning to emerge

The week also brought encouraging developments for defenders.

Anthropic expanded its Cyber Verification Program, providing qualifying security professionals with controlled access to advanced AI capabilities for vulnerability analysis, malware investigation and authorised security testing. The company also announced initiatives aimed at critical-infrastructure defence and AI-assisted vulnerability scanning for eligible open-source projects.

These developments demonstrate that AI can substantially strengthen defensive capabilities. They also expose an increasingly important operational challenge: discovering vulnerabilities faster is useful only when organisations can validate, prioritise and remediate them.

For decision-makers, investment in AI security should therefore be accompanied by stronger vulnerability management, skilled security personnel and measurable remediation processes.

The leadership challenge: Control must advance alongside capability

The developments of 5–11 October point towards an important conclusion.

Cybersecurity is entering a period in which both attackers and defenders can use increasingly autonomous systems. The advantage will not necessarily belong to whoever deploys the most powerful AI. It will belong to those who combine technological capability with disciplined governance, trusted infrastructure and effective human oversight.

Boards and executive teams should be asking whether they know which AI agents operate within their organisations, what information those agents can access, which actions they can execute and how quickly those actions can be stopped.

They should also understand whether their security teams can detect AI-assisted attacks, investigate compromised software dependencies and respond before automated activity causes substantial damage.

The future of cybersecurity will not be determined by artificial intelligence alone. It will be determined by how intelligently we govern the power we give it.

The time to establish those safeguards is now.