The AI Cyberattack Surge Hasn’t Arrived. But the Warning Signs Are Growing.

November 10, 2026 admin

The predicted wave of autonomous, AI-driven cyberattacks has not yet shown up as a clearly measurable surge in cyber losses. But that is not the same as saying attackers are standing still.

In an October 24 search of the ReversingLabs malicious-file corpus, we found a growing number of files containing references to large language model (LLM) APIs. Our estimated high-confidence subset increased from roughly 150 files in 2024 to 620 in 2025 and 1,680 from January 1 through October 24, 2026. These are early signals, not a count of AI-orchestrated intrusions.

The distinction matters: an API address in a file may reflect a bundled software library rather than a live model call. Still, when we combine the corpus findings with published investigations of AI-enabled malware and AI-assisted vulnerability research, a picture emerges. AI is entering individual stages of attack workflows faster than it is transforming the whole cybercrime economy.

The signal in the ReversingLabs data

We searched malicious files for API endpoints associated with OpenAI, Anthropic, Google Gemini, DeepSeek, OpenRouter, Hugging Face and local Ollama servers. The broader search returned 596 malicious matches in 2024, 3,044 in 2025 and 10,821 through October 24, 2026. A narrower, sample-based estimate of named, higher-confidence malware families produces the figures above.

Figure 1: ReversingLabs Spectra Analyze queries, run October 24, 2026. Higher-confidence figures are estimated from a pooled random sample; they are not independently verified counts of AI-using malware.

The numbers are small relative to the size of the warehouse. More important, an API reference does not prove model execution, attacker intent or successful exploitation. In 2026, for example, the 10,821 files contained 19,601 endpoint references—about 1.8 per file—consistent in part with multi-provider SDKs and libraries embedded in code.

There is another unresolved issue. A noticeable jump in monthly matches from May to June 2026 has not yet been tied to a specific malware family, collection change or detection change. The increasing count merits attention, but we cannot attribute every part of the trend to new attacker behavior.

What the data does—and does not—say about an AI attack wave

In an October 22 essay, security researcher Joshua Saxe asked why the expected “agentic attacker hordes” have not translated into a sharp increase in losses. He estimates that AI accounts for a small fraction of cybercrime-related losses and points to constraints such as criminal economics, law enforcement, the time required to industrialize a new business model and limits on access to commercial models. His loss estimate is a model, not an observed AI-loss total.

ReversingLabs does not measure economy-wide cyber losses, so our files cannot validate that estimate. What we can test is narrower and more useful for defenders: whether model-related capabilities are appearing in malicious artifacts, whether publicly reported AI-enabled malware is represented in our collection, and how quickly exploit samples appear around new vulnerabilities.

Where AI is already appearing in attacker workflows

We found samples of several AI-enabled malware families described by other researchers. Their volumes remain modest, and the functions differ substantially. Together, they show automation of particular tasks, not proof of fully autonomous campaigns.

Malware family	Reported AI-related behavior	ReversingLabs observation
PromptFlux	Uses Gemini to rewrite portions of its code (GTIG).	11 samples; first seen May 10, 2025.
LameHug / LameHubloader	Uses Hugging Face router endpoints; attribution to APT28 is from CERT-UA.	23 samples; first seen July 4, 2025.
PromptSpy	Uses Gemini to help navigate a device UI (ESET/GTIG).	3 samples; first seen April 4, 2026.

Family labels and sample counts are from ReversingLabs. Descriptions and actor attributions are from the cited outside reports; ReversingLabs has not independently attributed these samples to actors.

ReversingLabs first observed PromptFlux in May 2025, roughly six months before GTIG named the family in November. Other vendor reports describe AI tools used for vulnerability research, exploit validation and repeated modifications to evade detection. Anthropic reported one 2025 case in which a model handled an estimated 80–90% of tactical work across roughly 30 targets. These are selected cases—not a measure of adoption across all actors.

PHP2Shell shows why faster discovery matters

PHP2Shell illustrates the urgency without requiring an exaggerated story about autonomous attackers. The two vulnerabilities, CVE-2026-109618 and CVE-2026-109619, were the subject of AI-assisted discovery and rediscovery reporting. Amazon reported an attempted exploit against its honeypots before public disclosure, while other researchers cautioned that some circulating proof-of-concept code did not achieve full code execution.

ReversingLabs identified 10 PHP2Shell exploit files, first observed on disclosure day or within the next three days, classified under CVE-2026-109618. Just 5%–12% of antivirus engines detected those files in the assessment described in our research. Some may correspond to incomplete proof-of-concept exploits, so this is not evidence of 10 successful compromises.

The point for defenders is straightforward: serious vulnerabilities can move from disclosure to experimentation quickly, sometimes before conventional detection has caught up. That challenge grows when affected components are embedded in third-party software that security teams did not build and cannot easily inspect.

Published exploitation rates require perspective. VulnCheck found 14 confirmed exploited vulnerabilities among 1,061 attributed to AI-assisted discovery in the first half of 2026, or approximately 1.3%. That is not, by itself, proof that AI-discovered vulnerabilities are exploited more often. Other published comparisons use different populations and cannot be treated as like-for-like rates.

Four priorities for defenders

The data supports preparation rather than panic. Organizations can take practical steps before AI-enabled methods become more routine:

Understand what is inside the software you trust
Inspect delivered software artifacts, downloaded packages and files before deployment or execution. Identify embedded components and suspicious content, especially in third-party software where the underlying source code may be unavailable. Visibility into the finished artifact matters as much as visibility into its development process.
Shrink the response window for critical exposure
For a critical, internet-facing remote-code-execution vulnerability with credible exploitation, aim to begin emergency mitigation immediately and prioritize patching or compensating controls within 24 hours where feasible. Asset discovery and exposure validation should happen in parallel; patch timelines must reflect operational risk and available fixes.
Detect behavior, not just known file signatures
Use behavioral signals alongside hashes and strings. Monitor suspicious process activity and unexpected outbound model-API requests from software that has no approved reason to use them. Include API routers as well as individual model providers, and distinguish authorized applications from anomalous use.
Reduce the blast radius of AI-enabled tools
Give agents and integrations only the credentials, network access and execution privileges they need. Review unfamiliar agent tools and downloaded security packages before use, monitor key usage and build paths to revoke credentials quickly after suspected exposure.

A window to prepare—not a reason to wait

The strongest conclusion from this research is not that an AI-driven cybercrime explosion is inevitable. Nor is it that AI has had little impact. The available evidence points to something more specific: AI capabilities are surfacing in malicious files and individual attack tasks, while the scale of fully autonomous operations remains uncertain.

That leaves defenders with an opportunity. The organizations best prepared for the next phase will be those that can identify exposed software quickly, inspect the files and components entering their environments, recognize changing malicious behavior and move from discovery to mitigation with less manual delay. The right time to build those capabilities is before the most disruptive use cases are routine.

Research methodology and limitations

Query and timing. ReversingLabs Spectra Analyze advanced searches used API endpoint references with classification:malicious, grouped by first-seen year, on October 24, 2026. Endpoint presence indicates an address in an artifact—not a confirmed model call.
Estimated higher-confidence subset. “High-confidence” required a named malware family and at least 30% antivirus agreement, excluding heuristic-only, ML-only, hyperlink, PUA, adware and file-infector labels. A pooled random sample of 160 named detections suggested a 66% qualifying share (approximately ±7 percentage points). Per-year estimates apply that pooled rate across years; 2023–24 figures are particularly indicative.
Corpus denominator. Net warehouse additions are affected by reclassification and use July-to-July periods rather than calendar years. They are useful scale context but not a denominator for prevalence or attacker production. The 2026 period is incomplete.
Unresolved changes. A June 2026 increase in monthly API-reference matches has not been explained. No malicious files matching the local Ollama address were found by the query, which may reflect how loopback URLs are extracted; it does not establish zero self-hosted-model abuse.
Sample and actor limits. Weekly family activity reflects updated records, not necessarily new samples. The reported actor identities and descriptions of AI use come from the named external organizations, not ReversingLabs actor attribution. Provider disclosures do not capture all open-weight, self-hosted or otherwise unobserved usage.

Computer Security Articles