Knowledge Base Regulation Tracker Standards & Frameworks OSS Directory AI Incident Database Research Paper Library Case Studies Society Articles News Jobs About Charter Sign inBecome a Member
Home/Case Studies/GTIG tracks threat actors moving from prompting to autonomy with AI tools

GTIG tracks threat actors moving from prompting to autonomy with AI tools

GTIG's November 2025 update documents actors using AI across the attack lifecycle and the emergence of commercialised underground AI tools.

Threat intelligenceMalwareUnderground tools
2025-11report published
Attack lifecyclestages where AI use was observed: vulnerability research, malware development, influence content

Sources

PreviousGoogle Threat Intelligence Group analyses APT misuse of GeminiNextNorthern European government agency puts coding agents behind sandboxes, signed configuration and human approval

Contribute

Spot an error, or know a record we should add? Members can propose additions and submit corrections.

Submit case studyReport a correction or request removal

Related in Case Studies

Achieving Code Execution in MathGPT via Prompt Injection

The publicly available Streamlit application MathGPT uses GPT-3, a large language model (LLM), to answer user-generated math questions. Recent studies and experiments have shown that LLMs such as GPT-3 show poor…

AI developers and research labsPrompt injection defence design

Advai: Robustness Assurance Framework for Guardrail Implementation in Large Language Models (LLMs)

Advai applies a robustness assurance framework that attacks a client LLM with adversarial prompts optimised across several model architectures, uses the findings to set guardrails that keep outputs inside the…

AI developers and research labsRed teaming programme

AI ClickFix: Hijacking Computer-Use Agents Using ClickFix

Embrace the Red demonstrated that AI computer-use agents are vulnerable to social engineering attacks and can be manipulated into executing arbitrary code on a victim’s machine. The attack is a variation on…

AI developers and research labsAgent security architecture