There's a sentence near the opening of ThreatDown's new Cybercrime in the Age of AI report that deserves to be read twice: "The transition to a cybercrime ecosystem shaped by AI has begun, but it's not yet complete."
That qualifier—not yet complete—is both the most reassuring and most urgent phrase in the entire document. It means organizations still have a window. ThreatDown's estimate of how wide that window is: six months.
The 22-page report, published July 2026, is one of the most concrete assessments of the AI-and-cybercrime intersection released this year. It draws on original research into criminal AI marketplaces, guardrail-stripped models on Hugging Face, malicious agent skills, shadow AI breaches, and the implications of Anthropic's Mythos model for the vulnerability landscape. What follows is a breakdown of the key findings and what they mean for enterprise leadership, security teams, and the broader public.
The report opens with a case that sets the tone for everything that follows. In early 2026, an attacker with no background in industrial control systems compromised multiple Mexican government organizations, including a municipal water utility in Monterrey. During reconnaissance, Anthropic's Claude—without being prompted— identified a SCADA management interface on the utility's internal network, correctly classified it as critical infrastructure, and recommended a targeted attack against it. The attacker had no prior OT expertise; the AI supplied it.
The breach ultimately failed. But ThreatDown's framing is precise: the significance isn't what happened, it's what it revealed. AI has made critical infrastructure visible to attackers who previously lacked the knowledge to find it. The barrier to targeting a water supply, a power grid, or a hospital isn't what it used to be.
That's the report's central argument: AI hasn't invented new attack tactics. Stolen credentials are still the dominant form of initial access. Endpoints still hold the data criminals want. What AI has done is compress the time, cost, and expertise required to execute attacks that used to demand serious skill. Every threat actor gets smarter, faster, and more scalable—including the ones who previously couldn't have found your OT network.
ThreatDown researchers mapped the storefront infrastructure of several prominent malicious AI tools—WormGPT, Kriminal, DadGPT, and Xanthorox—and found something that should give every procurement and vendor risk team pause. These tools don't build their own AI, they rent it. Tracing the production JavaScript, CSP headers, and DNS/TLS records of each storefront, researchers found the same legitimate vendors appearing repeatedly as the unwitting supply chain: Cloudflare, Vercel, Google Cloud, OpenRouter, xAI, Anthropic, DeepSeek, and Alibaba.
WormGPT, one of the earliest criminal AI tools, now markets itself as an "Ethical Hacking AI." Xanthorox calls itself a development platform. The disclaimer is the camouflage. Strip it away, and most of what's sold as criminal AI is one of three things: a jailbroken wrapper around a mainstream model, a reseller proxying a legitimate API at markup, or outright vaporware. Genuinely custom-trained criminal models are rare. The criminal AI market is, structurally, a parasite on the legitimate AI industry—and that industry's infrastructure sits inside your existing vendor relationships.
For security teams: Add criminal AI abuse vectors to your vendor risk assessment process. The same Cloudflare tenant, the same API endpoint, and the same model your developers use may also be serving your adversaries.
In July 2026, ThreatDown researchers found more than 6,644 models on Hugging Face published under self-declared guardrail-free labels: "abliterated," "uncensored," "heretic," "decensored," "unfiltered." Together, these models accumulated tens of millions of downloads in a single 30-day window. Publishing volume grew approximately threefold between Q4 2025 and Q2 2026.
Abliteration—the technique for stripping refusal behavior from an open-source model without retraining—used to require specialist knowledge. It still does, technically. But criminals don't need to perform it themselves. Thousands of pre-abliterated models are freely downloadable. A criminal weighing $50/week for GhostGPT against a free model that runs offline on their own machine, with no provider logging the prompts, has an easy decision.
This is the detection problem that should concern defenders most. When a criminal runs an abliterated model locally, no provider sees the prompts. No blocklist catches the traffic. The artifact worth scanning is gone. The malware families already exploiting this pattern generate their malicious logic in memory at runtime and discard it—leaving signature-based detection with nothing to match.
For security teams: Endpoint behavioral detection is no longer optional. Static signature scanning will not catch the next generation of AI-generated, in-memory malware. The report's conclusion is explicit: SOC coverage and MDR/EDR with behavioral analysis are baseline requirements.
This section of the report is perhaps the most operationally novel finding. In January 2026, an AI agent called OpenClaw went viral—locally-run, highly privileged access to files, credentials, and connected systems, with a plugin marketplace called ClawHub where users could install "skills" to extend its capabilities. By the end of March 2026, approximately half a million OpenClaw instances were exposed on the public internet, most installed by employees without IT's knowledge.
Malicious skills appeared on ClawHub within days of launch. A security researcher found over 1,000 within a month, including the site's most downloaded skill. ThreatDown's own researchers documented skills that stole credentials and exfiltrated data, installed malware, and poisoned an agent's core memory files for persistence. The key detail: malicious behavior was typically embedded inside otherwise functional skills, so agents operated normally while executing harmful operations in the background.
By April 2026, when security scanners began searching for harmful payloads in skills, criminals adapted. The new generation of malicious skill contained no malicious code at all. Instead, it contained a fake "get rich with AI" blog post—a Polymarket weather-bot guide fabricated to look authentic—instructing users to download and run a binary called Polymarket.exe. That binary delivered GachiLoader, which used fileless injection to install Rhadamanthys, a sophisticated infostealer that harvests credentials for identity attacks. GachiLoader's command-and-control infrastructure was hosted on a Polygon blockchain smart contract—immutable and impossible to take down through conventional means.
Detection rate across major endpoint security products at the time of discovery: near zero.
For security teams: Agent skills represent a new attack surface category that most security stacks don't monitor. Privileged, locally-running AI agents that install third-party plugins from public marketplaces are a credential exfiltration risk even when the agent itself is legitimate. This requires policy, discovery tooling, and endpoint protection capable of catching fileless injection.
One in five organizations suffered a breach linked to shadow AI in 2025, costing an average of $670,000 more than a standard incident, according to IBM data cited in the report. Nearly half of employees who use generative AI at work do so through personal, unmanaged accounts.
The attack surface this creates is invisible by definition. Employees are uploading sensitive documents, entering credentials, and connecting company systems to unvetted platforms. Every AI tool account created without IT's knowledge is, as ThreatDown puts it, "a potential identity attack waiting to happen"—not just because of what users share with the tool, but because the OAuth credentials, API keys, and session tokens used to access AI tools have joined the list of secrets that need defending.
The 500,000 OpenClaw instances exposed on the public internet are the clearest illustration of the scale of the problem. Between February and April 2026, a public vulnerability tracker logged more than 100 separate security advisories for OpenClaw alone.
For enterprise leadership: The shadow AI problem is not primarily a security team problem; it's a governance and culture problem. If employees are reaching for unauthorized AI tools because the authorized ones are inadequate, slow to approve, or nonexistent, the answer isn't blocking—it's providing. Security teams need discovery tooling. Leadership needs to create a path for employees to use AI safely.
In May 2026, Google's Threat Intelligence Group identified what it believes to be the first known zero-day exploit developed by criminals using AI. The target was a popular open-source web-based system administration tool. The exploit—implemented as a Python script—was designed to bypass two-factor authentication (2FA) and enable identity-based attacks. Google disrupted the campaign before mass exploitation began, but the significance is what the finding confirmed: AI is now being used by criminal groups to discover and weaponize vulnerabilities that didn't exist in any public database.
This development didn't happen in isolation. In 2025, Google's Big Sleep project and bug-bounty AI XBOW had already demonstrated that AI could outperform humans at finding security flaws in software. Nation-state actors had already incorporated AI into live operations. APT28 deployed LAMEHUG against Ukrainian government targets in June 2025, malware that sends prompts to an AI model via Hugging Face's API and executes the generated commands on the target machine.
The trajectory is not in question. The only open variable is timing.
The report's final section is the one that has the most significant implications for how organizations should be thinking about the next six to 18 months.
In April 2026, Anthropic unveiled Claude Mythos—and simultaneously withheld it from public release. The reason: Mythos had proved far more capable at finding and exploiting software vulnerabilities than its creators anticipated. During testing, it found and exploited zero-day vulnerabilities in every major operating system and web browser tested, including a 27-year-old bug in OpenBSD. Engineers with no formal security background used it to find remote code execution vulnerabilities while they slept. The UK AI Security Institute tested it against a 32-step simulated corporate network takeover—a scenario estimated to require 20 hours of work from human professionals. Mythos completed it end-to-end.
Firefox's response to early Mythos access through Anthropic's Project Glasswing program tells the story quantitatively: the browser shipped 423 bug fixes in April 2026, compared to 31 in April 2025. Mozilla's CTO described the experience as giving the team "vertigo."
Anthropic's CEO has assessed that models from China with comparable capability are likely to be broadly available within six to 12 months. ThreatDown's assessment is that Mythos-class capability could reach criminal marketplaces within six months.
[RELATED: Alert: China's GLM-5.2 Just Matched Mythos on Bug-Finding]
Here's the paradox the report identifies that most coverage has missed: Mythos-class models reaching defenders first sounds like good news. It isn't straightforward. Models capable of finding vulnerabilities at this scale will generate patch volumes that dwarf anything organizations currently manage. Because every new patch is an opportunity for criminals to reverse engineer an exploit, the number of exploits available to criminals in the short term could actually grow massively, even as the underlying vulnerabilities are being found and fixed. Organizations that already struggle with their patching backlog won't suddenly find 10 times the capacity to handle 10 times the fixes. They will fall behind, and the window in which exploits remain effective will grow.
The volume of work that Mythos-class models will create for defenders is, in ThreatDown's words, "as significant as the threat they pose in the wrong hands."
ThreatDown's conclusion organizes the response across three priorities.
1. Patch like the clock is running
Because it is. Automate vulnerability assessment and patch management now, before the volume of patches organizations need to process increases by an order of magnitude. Organizations with disciplined, automated patching will be more secure. Those that don't will face an ever-growing backlog of unpatched systems and criminals armed with an ever-expanding library of exploits to use against them.
2. Monitor continuously, 24/7
AI makes every threat actor faster, smarter, and more scalable—but it doesn't create new tactics. The data are still on the endpoints. The access is still obtained through stolen identities. Organizations need to set themselves up to detect the early signs of an AI-driven attack rapidly, with SOC coverage or a managed detection and response service. A threat that moves at AI speed requires a response capability that doesn't clock out.
3. Find and govern your shadow AI
Unsanctioned AI tools, agent skills, and MCP connections are a growing compliance, privacy, and security risk that IT teams currently can't see. The report recommends AI detection and response tooling specifically designed to surface the shadow AI attack surface inside the organization—not to shut it down, but to see it clearly enough to manage it.
For boards and executive leadership
The report's statistics deserve attention at the highest levels. One in five organizations breached through shadow AI in 2025. $670,000 in additional costs per incident. A six-month window before Mythos-class vulnerability discovery reaches criminal markets. These are material business risks, and they require resource decisions—on patching automation, on 24/7 detection coverage, on AI governance—that security teams cannot make unilaterally. The governance and investment decisions need to happen now.
For security teams
The practical operational priorities are clear: behavioral endpoint detection over signature-based scanning, continuous monitoring coverage, shadow AI discovery tooling, and aggressive patching cadence. The report also flags identity as the critical battleground—stolen credentials remain the dominant initial access vector, and the surface area of credentials worth stealing has expanded to include every AI tool account an employee has ever created.
For the general public
The mechanism criminals are now using against individuals has changed in one specific and important way. The AI enthusiasm that made 2025 and 2026 feel exciting and productive has become an attack surface in its own right. The "get rich with AI" guide that delivers an infostealer, the popular marketplace skill that exfiltrates your credentials in the background—these attacks work because people trust AI tools and move fast to adopt them. Healthy skepticism about what you install, where you download from, and what you connect to your accounts is no longer optional cyber hygiene. It's the specific thing criminals are betting you won't have.
ThreatDown ends its report with a sentence worth quoting in full: "The organizations that come through this moment intact will be the ones that saw it clearly and acted while the clock still favored the prepared."
The report doesn't argue that AI-native cybercrime is an unstoppable future threat. It argues that it's a present reality that is not yet fully distributed—and that the distribution is accelerating. The water utility in Monterrey, the poisoned skill on ClawHub, the 22 million downloads of guardrail-stripped models, the first AI-built zero-day: these aren't hypotheticals, they happened.
The six-month window is real. What organizations do with it is the only question that remains open.
We asked some solution provider experts for their take on the report.
Dr. Margaret Cunningham, VP of Security & AI Strategy at Darktrace, said:
"Frontier models are becoming more powerful and more widely accessible, while the mechanisms meant to control them remain imperfect. Against this landscape, defenders should assume breach, assume unapproved access, and assume that any capability useful enough to matter will eventually be used by adversaries.
"While it is important to pay attention to claims about capabilities of these new models, it is also worth recognizing that the full picture often takes time to emerge. Some capabilities may prove more impactful than initially expected, while others may not live up to early expectations. For security teams, the challenge is evaluating these developments in real time, often before there is broad consensus on what the practical implications are. That can be especially difficult in a fast-moving environment where benchmarks, capability assessments, and model comparisons are evolving alongside intense industry interest and competition."
"The same logic applies to guardrails. Guardrails can reduce opportunistic misuse, but they are not a complete defense. People who are good at jailbreaks already use context flooding, metaphor, literary framing, and iterative workarounds to test these systems."
"While a lot of focus lands on the offensive impact, the defensive burden is most concerning. Advanced defense is still mostly human, and we have not automated this level of expertise at scale. Vulnerability management was already behind schedule before AI accelerated discovery. The hard work is not just finding a vulnerability, it's figuring out whether it matters in a specific environment, whether it is a lab-only edge case, whether patching will break something else, and how to remediate without disrupting the business."
"There is no universal 'normal' to defend anymore. Every organization, device, user, and agent behaves differently, which means security teams need a way to understand what is normal in their specific environment and spot when something changes. As AI accelerates discovery and exploitation, behavioral detection, anomaly-based analytics, and autonomous containment become essential. Defenders need to prioritize based on context, contain threats quickly when prevention fails, and build defenses around the reality of their own environment rather than a generic model of risk."
Randolph Barr, CISO at Cequence Security, said:
"Approximately two-thirds of current AI-related incidents still originate from traditional weaknesses, however, the remaining third are uniquely 'AI-native.' These include model and data poisoning, prompt injection, and autonomous agents that can chain together API calls and act with minimal human oversight. These emerging risks reflect the reality that AI systems are dynamic, self-learning, and interconnected in ways traditional applications never were. When paired with the rapid speed of development, the outcome is a growing attack surface that grows faster than most security programs can respond."
"We are approaching a future where the use of AI agents will outpace the readiness of security measures. We have seen a number of advisories over the past year which help highlight the gaps and hopefully drive the industry toward more secure, transparent designs before these tools become deeply embedded in enterprise ecosystems."
Ram Varadarajan, CEO at Acalvio, said:
"Today, we are witnessing a significant swing in the cyber threat landscape, and it's more severe and unparalleled to anything we've ever faced before. Multi-agent swarms are coordinating in real-time across reconnaissance, credential harvesting, and data exfiltration. We're facing exponential coordination where hundreds of specialized AI agents will operate simultaneously across our entire attack surface. Reactive defenses can't operate at machine speed, requiring a shift in the cybersecurity stack to preemptive, AI-driven strategies. AI fighting AI, paired with offensive deception technologies, is the emergent design to catch attackers off guard and cause them to make mistakes and disclose themselves. Organizations that adapt will recognize that defense is no longer about building higher walls. It's about becoming an unpredictable, moving target."
"To maintain competitive edge and protect valuation, companies have to pivot from reactive defense to active, game-theoretic defense. This means deploying AI-driven cybersecurity, specifically AI agents that use strategic deception in real-time. The future calls for forcing attackers to fight on the defender's terms, gambling adversary compute against AI-driven decoys, and shifting the economic burden of the attack onto the attacker."
Diana Kelley, CISO at Noma Security, said:
"Traditionally, security teams focused on the protection of systems and data. Today, we are helping to govern AI systems and agents that make recommendations and decisions, and in some cases take action on behalf of the business, while enabling the business to adopt AI quickly and safely. AI also means that we're facing a more well-resourced adversary. It lowers the cost of scale and increases the quality of automated attack campaigns. Without a strong control plane for AI systems and agents, including clear guardrails on access and actions, along with identity, access control, data governance, and runtime monitoring, AI will amplify whatever weaknesses already exist."
"Moving forward, AI will be embedded in all aspects of our businesses, and every security professional needs a working understanding of AI and agent risk. That includes how models are trained, where data exposure can happen, how outputs can be manipulated, agentic blast radius, and how AI integrates into business workflows. In the real world, those risks show up inside existing domains like productivity tools, data loss prevention, access control, application security, cloud security, and risk management."
Shane Barney, CISO at Keeper Security, said:
"Advanced AI models are now capable of scanning systems, networks and code to identify vulnerabilities at a speed and scale no human analyst can match, and that capability cuts both ways. In the hands of a defender, it's a force multiplier for threat detection and response, but in the hands of a threat actor, it accelerates the path from reconnaissance to exploitation faster than most security teams can detect, let alone respond to."
"These AI systems easily bypass traditional 'friction-based' defenses by automating complex, multi-step attack chains at scale, creating a massive influx of software bugs that human maintainers cannot triage fast enough. This results in a dangerous operational bottleneck, leaving a wide window of exposure for adversaries to exploit known flaws before a fix can be deployed. Security teams must operate on a much shorter clock, assuming public vulnerabilities will be weaponized within hours rather than weeks. Defenders should immediately implement automated update paths for internet-facing systems, treat dependency security patches as immediate priorities rather than backlog items and maintain robust logging and MFA to prevent lateral network movement if a breach occurs."
"Enterprises that have been deferring foundational security work are running out of time. The attack surface hasn't changed, however, the tools available to exploit it have gotten significantly more powerful. Unpatched vulnerabilities, excessive access permissions, and gaps in privileged account oversight are exactly the conditions that AI-assisted attacks are built to find and weaponize."