How Attackers Use AI: What the AI Companies' Reports Show

Anthropic and Google now publish what they see attackers doing with AI. I went through their reports, plus the yearly breach studies from Verizon, Mandiant and IBM. One thing stands out. Attackers aren't using AI to invent new crimes. They're using it to commit the old ones faster, cheaper and with fewer people. For a bank or fintech that changes the clock more than the playbook.

I spent a major chunk of my career on banking and payment systems: State Bank of India's core banking system as an engineer at TCS, then five years on eBay and PayPal's architecture team. Today I run Zunderdog, a software company. I haven't investigated these incidents myself. I've read what the companies and researchers published and I'll tell you what it means for systems that move money. This is a briefing, not a how-to.

The Short Version for Your Board

• What the reports show: attackers mostly use AI to speed up methods that already exist. Mandiant doesn't call 2025 a year of AI-caused breaches.
• What has changed: speed, volume and polish. Flaws get exploited sooner and phishing reads perfectly.
• What hasn't been shown: none of the reports I read says AI was used to breach a bank.
• What to change: shorten the time to fix dangerous flaws, stop one convincing message from moving money, make detection automatic and use the same AI tools yourself.
• Who owns it: one named person, with a date.

Who Is Telling This Story

Every company here has a stake. Anthropic makes Claude, Google makes Gemini and OpenAI makes ChatGPT. A story where AI is powerful, dangerous and best handled by their own security teams isn't bad for business. Two things make me take the reports seriously. They describe specific cases and keep their hedges ("we assess with high confidence", "a handful of successful intrusions"). They also describe catching the activity. Anthropic says it detected the espionage campaign below itself and that it banned the accounts involved in each case I cite. Google says its early discovery may have stopped a criminal's mass attack.

I also lean on the yearly studies that count real breaches: Verizon, Mandiant (the Google-owned firm that investigates real breaches) and IBM. They sell security services of their own so I read them with the same care. The reports call attackers "threat actors" and label groups with codes such as GTG-1002.

What the Reports Show

AI doing most of the work

In November 2025 Anthropic reported a campaign (opens in a new tab) that it assessed with high confidence was run by a Chinese state-sponsored group, GTG-1002. The attackers used Claude Code as an AI agent. (An AI agent is software that plans a series of steps and carries them out itself instead of answering one question at a time.) Anthropic's full report (opens in a new tab) says the AI did 80 to 90% of the tactical work at "physically impossible request rates", with humans stepping in at only a few decision points.

The group went after roughly 30 organisations and financial institutions were among the first targets. Anthropic says a handful of the intrusions succeeded and that the confirmed high-value targets it got into included major technology corporations and government agencies. It doesn't say a bank was breached. Nor will I.

Extortion at scale

In August 2025 Anthropic described a criminal (opens in a new tab) who used Claude Code to run a data extortion campaign (steal a company's data then threaten to publish it unless paid) against at least 17 organisations, including healthcare, emergency services and government. The AI automated reconnaissance (working out what a target runs) and collected victims' logins. It also read the stolen financial data to help set the ransom. Demands sometimes passed $500,000. No bank was named.

Fewer people, more reach

Anthropic's September 2026 report (opens in a new tab) covers December 2025 to August 2026. One of its main findings is that sophisticated attacks no longer need sophisticated attackers. AI has closed much of the gap in labour and tooling, which means skill is no longer a reliable sign of who's behind an operation. One breach of an enterprise software company went from first access to bulk data theft in hours.

A Chinese-speaking group ran a standing effort to find flaws in major endpoint-security products (the software that guards laptops and servers). It also built exploits for network and security appliances and one workflow aimed at network appliances produced more than a dozen possible zero-days in a single month. A zero-day is a flaw nobody has fixed because the maker doesn't know about it yet. The group's targets were about fifty organisations in sectors that include finance. Another financially motivated group had a history of breaking into hotel booking and financial technology platforms before it turned to AI vendors. I found no bank named as a victim.

Google: AI-built exploits and a faster clock

Google's threat intelligence group said in May 2026 (opens in a new tab) it had for the first time identified a criminal using a zero-day exploit it believes was developed with AI. The flaw let someone get past two-factor login in a popular open-source admin tool. The plan was a mass attack. Google says its early discovery may have prevented it. It also says it doesn't believe Gemini was the model used.

In October the same group reported (opens in a new tab) that flaws exploited in real attacks rose from an average of 10.5 a month in 2025 to 18 a month between January and August 2026. Google suggests the growth is concentrated in n-days: flaws that are already public, usually with a fix on offer. One AI-discovered flaw in a BeyondTrust product was being exploited by one group within four days of public disclosure and by five more within seven days.

The sober view

Mandiant's M-Trends 2026 (opens in a new tab) says plainly that it doesn't consider 2025 the year breaches were "the direct result of AI". Verizon's 2026 breach report (opens in a new tab) says attackers are demonstrably using generative AI at different stages. But most AI-assisted malware matched known examples and fewer than 2.5% of the AI-assisted malware observations involved rare techniques with one or no known examples.

OpenAI, which makes ChatGPT, strikes the same balance in its PHP2Shell post (opens in a new tab). It says that to its knowledge frontier AI models (the most capable ones from the leading labs) found the flaws before attackers did. It adds that the same capabilities can help attackers rapidly develop offensive tools and exploits. I covered those flaws in my PHP2Shell guide.

What It Means for a Bank or Fintech

Five changes follow. Each is about speed or volume, not a new trick.

1. Less time between a fix and an exploit. Exploiting a software flaw is now the most common way breaches start (opens in a new tab): 31% overall and 22% in finance and insurance, according to Verizon's executive summary (opens in a new tab). It's the first time in 19 years that it has beaten stolen passwords. Verizon also found only 26% of critical, known-exploited flaws were fully fixed in 2025, with a median of 43 days to fix them. That's across every organisation in its data and not a bank figure. Mandiant estimates (opens in a new tab) the average time to exploit a flaw has fallen to minus 7 days, which means exploitation often begins before a fix is released.

2. Phishing and fraud in flawless language. Phishing (a message built to trick someone into handing over a login, a payment or access) started 20% of the breaches in Verizon's finance and insurance data (opens in a new tab). The old giveaways, odd grammar and clumsy phrasing, are getting less reliable because a model can write a clean message in any language. IBM's 2026 study (opens in a new tab) found one in four malicious breaches was AI-enabled, a 56% rise on the year before, led by deepfake impersonation (fake voice or video of a real person) and AI-enabled malware. RBI's FREE-AI committee (opens in a new tab) warned in 2025 that deepfakes can also compromise video KYC.

3. Faster reconnaissance. In the first two Anthropic cases above the AI automated the quiet first step of working out what a target runs and where it's weak. A forgotten server or an old vendor portal gets found sooner. Being too obscure to bother with is no longer a plan.

4. Extortion. Ransomware (malware that locks your systems until you pay) featured in 48% of Verizon's breaches (opens in a new tab), up from 44%. The August 2025 case shows the other version: steal the data and threaten to publish it. So the board question changes from "can we restore from backup?" to "what do we do when the data is already out?" In India, CERT-In's 2022 directions (opens in a new tab) give organisations six hours to report a cyber incident once they notice it. Practise that clock.

5. AI agents doing most of the work. An agent works at speeds where a person watching a dashboard can't keep up. So detection and the first response, such as locking an account or ending a session, have to be automatic and rehearsed. At PayPal I worked on notifications: email, SMS, push and the messages merchants' servers rely on. The lesson stayed with me: an alert is worth only what happens in the next few minutes.

The Plain Defences That Matter More Now

None of this needs exotic technology. It's the basics, done faster and checked.

1. Know what you run. Keep a list of every system, including the ones vendors run for you, with the software and version.
2. Fix the dangerous flaws in days. Google's advice is to move from patching everything without priority to triage guided by threat intelligence. In plain words, fix first what attackers are actually using, starting with flaws on lists such as CISA's Known Exploited Vulnerabilities catalogue (opens in a new tab). That only works if you can release a change quickly and safely, which means automated tests around your payment paths first.
3. Never let one convincing message move money. Call back on a number you already hold before changing payee details. Add a second approver above a set limit and a pause on new payees. These work in any language and against a cloned voice.
4. Tighten logins. Use multi-factor authentication (a second proof beyond the password) that can't be phished, such as passkeys or hardware keys. Credential abuse started 15% of the breaches in that same finance and insurance data.
5. Retire what nobody fixes any more. Software past end of life gets no official security fix. If you still run old PHP, my PHP 7 to 8 upgrade guide covers the plan and the cost.
6. Rehearse the bad day. Who decides, who calls the regulator, who talks to customers and where the offline backups are. Run it before you need it.

Use the Same Tools Yourself

The same AI is available to defenders. Anthropic says one of its partner banks used its Mythos Preview model, which isn't generally released, to help detect and prevent a fraudulent $1.5 million wire transfer after a criminal took over a customer's email account and made spoofed phone calls. That's Anthropic's account (opens in a new tab) and it names no bank. IBM's study (opens in a new tab) found that extensive use of AI and automation in security cut breach costs by almost $2 million on average. Only 18% of organisations apply AI agents to vulnerability management.

RBI's own FREE-AI committee (opens in a new tab) is open about both edges. It called AI a double-edged sword for cybersecurity and said not adopting AI could itself be a risk. In its June 2026 Financial Stability Report (opens in a new tab) RBI says AI-enabled cyber threats were the leading perceived risk for the next 12 months. Most of the 33 banks and 10 large NBFCs it surveyed rated their readiness for those threats as developing or intermediate.

My view is that banks and newer fintech systems should be using these tools now. Use them to read your own code and settings for flaws before an attacker does and to sort alerts and spot fraud patterns. Use them to draft fixes that your engineers review and test. Do it inside your own rules: decide which data each tool may see, keep a person approving changes to anything that moves money and log what the tool did.

Many fintechs have an edge here. With automated tests and release pipelines a fix found today can be live tomorrow. They still run on the same open-source parts and PHP2Shell didn't care how new the brand was. Some older banking platforms can't release that fast and that gap is what I mean when I say banking has to change how it works. I make the case in my piece on what banks have to change. Over the past month I've been talking to major banks about the changes that need to come.

How We Can Help

At Zunderdog we build and upgrade software, put tests around the paths that move money and build release pipelines so a fix can go live quickly and safely. That's what decides how fast you can respond. Our Backend, Cloud and DevOps and custom software teams do this work. Here's how we work with banks and fintechs.

I won't promise you'll never be attacked. Nobody honestly can. If you'd like a second opinion on how fast your team could fix and release a change, book a 30-minute call with me or tell us what you run. If you work in a bank or a fintech and you're facing the same questions, I'd be glad to compare notes.

Quick Answers

Are attackers using AI to hack banks? The reports say attackers use AI heavily and that financial institutions have been among the targets. None of the reports I read says AI was used to breach a bank.

Is AI creating new kinds of attack? Mostly not so far. Verizon found most AI-assisted malware matches known examples and Mandiant doesn't see 2025 as a year of AI-caused breaches.

What should a bank do first? Know what you run, cut the time to fix flaws that attackers are already using and make sure one convincing message can't move money.

Can banks use AI for defence too? Yes. RBI's FREE-AI committee says regulated entities may use AI tools to strengthen cybersecurity.

Sources

• Anthropic: espionage campaign report (opens in a new tab) (November 2025) and full report (opens in a new tab)
• Anthropic: August 2025 extortion report (opens in a new tab), September 2026 report (opens in a new tab) and Project Glasswing update (opens in a new tab)
• Google: AI threat tracker (opens in a new tab) and exploitation trends (opens in a new tab)
• Mandiant: M-Trends 2026 (opens in a new tab)
• Verizon: 2026 DBIR executive summary (opens in a new tab) and news release (opens in a new tab)
• IBM: Cost of a Data Breach 2026 (opens in a new tab)
• OpenAI: Patch the Planet (opens in a new tab)
• RBI: FREE-AI report (opens in a new tab) and Financial Stability Report, June 2026 (opens in a new tab)
• CERT-In: directions of 28 April 2022 (opens in a new tab)
• CISA: Known Exploited Vulnerabilities catalogue (opens in a new tab)