Gambit Security’s new report, AI Across the Intrusion Lifecycle offers a detailed look at how artificial intelligence is moving beyond a supporting role in cybercrime and becoming integrated into the day-to-day mechanics of real intrusions. Written by Director of Threat Intelligence Eyal Sela and Cyber Threat Researcher Nir Varon, the report examines three unrelated threat actors using AI for everything from building one-off scripts and exploitation tools to analyzing stolen business data, troubleshooting infrastructure, and interactively determining what to do next inside compromised environments.
The significance is not simply that attackers are asking large language models to write malware. The cases suggest something more consequential: AI is becoming part of the operational workflow of an intrusion, helping attackers adapt as new systems, credentials, errors, and opportunities appear.
From coding assistant to operational participant
Across the three investigations, Gambit observed attackers using AI throughout different stages of an intrusion. Models generated scripts tailored to environments they encountered, developed exploitation tools, prioritized valuable business information, performed IT and DevOps tasks, and repeatedly refined commands based on the output returned by compromised systems.
This represents an important evolution from some of the earliest discussions around AI-enabled cybercrime, which focused heavily on phishing emails, malware generation, or lowering the technical barrier for inexperienced attackers.
AI can now function more like a highly responsive technical assistant that stays involved as an operation unfolds.
The broader threat landscape appears to be moving in the same direction. Anthropic recently analyzed 832 accounts associated with malicious cyber activity between March 2025 and March 2026 and found AI usage spanning all 14 tactics represented in the MITRE ATT&CK framework. The company also found that the share of actors it classified as medium risk or higher increased from 33% to 56% between the first and second halves of the period studied.
The Gambit cases provide a particularly concrete view of what that shift can look like inside active compromises.
A suspected ransomware operator puts Claude Code inside the attack loop
The first case involves a suspected ransomware operator that Gambit observed using Claude Code across intrusions into six organizations in June 2026, with the researchers also connecting the actor to two earlier compromises.
Victims spanned multiple industries and countries, including an Australian energy utility, a financial services company in Mauritius, businesses in South Africa, Thailand and Malaysia, and several organizations in the United States. Gambit attributes the activity with medium confidence to an affiliate using The Gentlemen ransomware-as-a-service operation.
What stands out is the breadth of Claude Code’s role.
The attacker used the system to conduct reconnaissance, generate exploitation commands, write malicious scripts, modify firewall policies, map internal systems and determine which machines or databases deserved additional attention.
Once credentials and remote access had been established, the AI helped interpret reconnaissance data and identify higher-value systems such as domain controllers, file servers and backup infrastructure. In another part of the intrusion, it analyzed databases belonging to a financial services platform and helped identify production data and client documents as particularly important.
The case also illustrates the limits of today’s safeguards. At one point Claude recognized that it appeared to be interacting with a real corporate network and refused to proceed without evidence of authorization. The operator opened a new session, reframed the work as authorized vulnerability testing, and the model continued.
But increased capability did not mean flawless execution. During the compromise of the utility, Claude attempted to modify a firewall configuration and ultimately left the device unreachable. The incident is an important counterpoint to fears of perfectly autonomous AI hackers: models can accelerate offensive operations, but they can also make costly mistakes inside the very systems attackers are trying to control.
Zerofot shows what happens when AI meets scale
The second case is less about one targeted intrusion and more about industrializing credential theft.
Gambit tracks the operator as Zerofot, describing a campaign that searched internet-exposed files and directories for API keys, cloud credentials, software tokens and SSH private keys.
At the center of the operation was a custom credential-harvesting scanner called auto_scan. The operator built the tool using OpenAI Codex and Claude Code, instructing the models under the premise that the work was being conducted inside an authorized capture-the-flag environment. The scanner collected exposed files, searched them for potential credentials and then attempted to validate discovered keys against their respective services.
AI’s role did not stop once the tool was written.
Claude Code was also used for the less glamorous but operationally critical work of keeping the infrastructure running. Through a multi-agent orchestration framework, it helped manage scanner infrastructure, proxies, networking, firewall configurations, monitoring and debugging.
That distinction matters. Cyber operations require far more than discovering a vulnerability or generating a payload. Infrastructure needs to be deployed, software breaks, logs need to be interpreted and configuration problems have to be solved. AI can increasingly assist with this connective work.
The scale documented by Gambit is substantial. Between April 5 and May 23, 2026, the operation collected 2,975 validated credentials and keys from 1,742 victim hosts. That included 661 SSH private keys, 635 AWS access keys associated with 214 accounts, 448 Google Gemini keys, 254 OpenAI keys and 176 Anthropic keys, among numerous other credential types. Gambit says information was shared with the Shadowserver Foundation and affected service providers to support notification and credential revocation.
RAGE turns AI-generated code into an exploitation framework
The third investigation focuses on RAGE, a custom Python framework designed to scan internet-facing services, exploit vulnerable deployments, harvest credentials and install cryptocurrency miners.
Gambit’s researchers believe much of RAGE and its associated scripts were AI-generated. One clue is unusually revealing: portions of the code still contain first-person, self-correcting reasoning apparently left behind by the model during development.
AI was also incorporated directly into the finished system. RAGE included a DeepSeek-backed “AI Orchestrator” inside its operator dashboard that provided guidance for managing the mining operation.
The framework targeted exposed services including Redis, Elasticsearch, Docker, Tomcat, Jenkins and others, while searching compromised environments for credentials that could create additional opportunities.
In one instance, credentials recovered from an exposed Redis deployment belonging to a software-as-a-service provider provided administrative access to an AWS account. The attacker subsequently generated additional tooling to enumerate identities, storage and other cloud resources.
Recovered logs showed access to eight Identity and Access Management users, four of which had AdministratorAccess, as well as 196 Amazon S3 buckets.
A campaign that appeared primarily motivated by cryptocurrency mining therefore also had the ability to turn an exposed service into a much broader cloud compromise.
AI’s mistakes may become part of the defender’s advantage
One of the most interesting aspects of Gambit’s research is that it documents AI failures alongside AI successes.
Models sometimes exposed the attacker’s intentions in unexpected ways. AI-generated tooling used conspicuous names such as “recon” for cloud sessions, while other generated artifacts preserved descriptive comments and reasoning that could provide clues about how they were created. In the ransomware case, an attempted firewall modification produced an outage.
These weaknesses complicate the idea that AI automatically makes cyber operations stealthier or more sophisticated.
Microsoft’s security researchers have similarly described AI as an accelerator within attacker workflows, with human operators still directing many end-to-end operations. Gambit’s findings suggest that the relationship may increasingly resemble a partnership: humans provide objectives and judgment, while AI absorbs significant portions of the technical iteration required to reach those objectives.
That can make attackers faster without necessarily making them better at operational security.
Cybersecurity teams may need to defend against machine-speed iteration
The larger concern raised by the research is speed.
Many security controls assume an adversary will move through a network at something resembling human pace. An attacker traditionally needs to understand an unfamiliar technology, research commands, write scripts, troubleshoot errors and interpret large volumes of data before deciding where to move next.
An AI system can compress many of those steps.
The risk is therefore not limited to a future autonomous hacking agent. An attacker who remains firmly in control can still use AI to reduce the amount of expertise, time and manual effort required to operate across unfamiliar environments.
Defenders may consequently need to focus less on whether a particular piece of malware was “AI-generated” and more on behavioral signals across the entire intrusion lifecycle: unusually rapid reconnaissance, repeated adaptive commands, aggressive credential discovery, unexpected cloud enumeration, changes to backup or security infrastructure, and movement between systems that occurs faster than traditional human-led operations would suggest.
The same capabilities also remain valuable for defense. Anthropic, for example, has been developing AI systems that identify vulnerabilities and help security teams remediate them, underscoring the dual-use nature of increasingly capable cyber models. The competition is increasingly about which side can apply those capabilities faster and with better visibility.
Ultimately, “AI Across the Intrusion Lifecycle” is compelling because it moves the AI cybersecurity discussion away from hypothetical future attacks and toward observable operational behavior. The three cases documented by Gambit Security show attackers experimenting with different models, frameworks and levels of automation, but they share one important pattern: AI is no longer confined to helping prepare an attack. It is increasingly present while the attack is actually happening.
