By compromising an AI infrastructure attackers gain access to LLM provider keys, cloud credentials, data, and myriad connections.
“To get in, they [attackers] often scan for vulnerabilities and, as soon as one is live, use AI to turn advisories and disclosures into exploits,” says Sysdig’s Morin. “In many instances, we’ve seen the mean time to exploit [MTTE] drop to just hours, like with the Marimo and PraisonAI CVEs.”
Attacking operational technology environments
Maintainers of industrial control systems have begun adopting AI technologies to increase the efficiency of their operations.
Initially industrial AI was an advisor. If a model predicted a failure or suggested a better setpoint then it would still be up to a human operator to decide what to do. This is now changing with operators adopting more autonomous, agentic AI technologies.
“ML models and AI agents now write setpoints back to control systems to optimize energy, yield and throughput, often every few minutes and without a human approving each change,” says Thomas Plank, CEO of industrial cybersecurity specialists Tributech. “Protocols such as MCP are accelerating this, because they give LLMs and agent frameworks a standard way into live OT [operational technology] and IoT [internet of things] data.”
These changes are opening up new attack surfaces.
“Once AI acts on a physical process, attackers no longer need to compromise the controller, they can live off the AI’s own authorized access,” Plank warns.
One attack scenario would involve poisoning the data the AI acts on so that decisions are made against manipulated sensor data rather than actual readings.
“If values are tampered with, stale or simply wrong, the model makes a wrong decision with full confidence,” Plank explains. “An attacker does not need to touch the AI at all; changing the data it reads, or the data it was trained on, is enough.”
Plank concludes: “In a closed loop, that wrong decision becomes a physical action.”
Using stolen compute to build offensive infrastructure
Threat actors have been stealing stolen AI computing resources since early 2024, a form of attack known by some as LLMjacking.
Attackers began LLMjacking to resell access but more recently some have moved onto using stolen resources to build malicious tools.
For example, in June 2026 the Sysdig Threat Research Team documented an operator using a victim’s exposed, abliterated Ollama model to build an autonomous offensive framework.
Creating modular black-hat AI platforms
The threat landscape has shifted from abusing chatbots to building dedicated, weaponized AI stacks like Xanthorox AI.
Unlike general-purpose LLMs, Xanthorox is a purpose-built offensive platform designed specifically for cybercrime. The platform features modules for functions such as malware generation and vulnerability exploits.
“Hexstrike AI MCP integration allows Xanthorox to move beyond mere ‘assisted’ hacking into the realm of fully autonomous agent systems, moving it into the realm of ‘vibe hacking,’” says Radware’s Geenens. Hexstrike is an open-source, AI-powered offensive security framework originally designed for ethical penetration testing.
Check against delivery
Zbyněk Sopuch, CTO of cybersecurity vendor Safetica, says that many attackers are no longer just exploiting software vulnerabilities, preferring instead to exploit the trust organizations place in AI.
“This means security teams need to treat AI assistants the same exact way they treat human privileged users: with tight control, specific monitoring, and most importantly, never assume anyone or anything to be safe,” Sopuch concludes.
