“Next Exploit Opportunities”: How a Threat Actor Used AI to Help Plan and Execute Multiple Types of Cybercrime Activities

Unit 42 investigated a threat actor who bypassed AI safety controls to leverage AI tools in planning and executing multiple types of cybercrime. The actor used AI assistance to coordinate credential theft operations, plan VoIP fraud schemes, and execute database exfiltration attacks. The investigation highlights the emerging risk of AI being weaponized by malicious actors to enhance their attack planning and execution capabilities. This case demonstrates how threat actors are actively finding ways to circumvent AI safety guardrails to obtain actionable cybercrime guidance. The report underscores the dual-use nature of AI technology and the need for stronger safety controls in AI platforms to prevent misuse by cybercriminals.