Sophos has released its AI Security 2026 report, finding that attackers are using artificial intelligence to compress cybercrime workflows from weeks into days. The research, drawn from more than 625,000 customer environments, shows AI moving beyond experimentation into active campaigns. One tracked operation, STAC6994, used about 12 AI agents inside a customer network to write and test attacks against endpoint products from Sophos, CrowdStrike and Microsoft Defender. The agents produced nearly 80 modules covering more than 70 evasion techniques in several days, work that could have taken a human operator roughly a week. Sophos noted that some claimed successes may have involved AI exaggeration rather than proven bypasses. The report also highlights enterprise AI identities, OAuth tokens, APIs and development tools as growing targets. Deepfakes and AI-assisted social engineering are already in criminal use, while AI supply chains themselves are under attack.
Sophos has released its AI Security 2026 report, finding that attackers are using artificial intelligence to compress cybercrime workflows from weeks into days. The research, drawn from more than 625,000 customer environments, shows AI moving beyond experimentation into active campaigns. One tracked operation, STAC6994, used about 12 AI agents inside a customer network to write and test attacks against endpoint products from Sophos, CrowdStrike and Microsoft Defender. The agents produced nearly 80 modules covering more than 70 evasion techniques in several days, work that could have taken a human operator roughly a week. Sophos noted that some claimed successes may have involved AI exaggeration rather than proven bypasses. The report also highlights enterprise AI identities, OAuth tokens, APIs and development tools as growing targets. Deepfakes and AI-assisted social engineering are already in criminal use, while AI supply chains themselves are under attack.