AI agents are moving deeper into offensive cyber operations. In a campaign highlighted in September reporting, a Chinese-speaking operator reportedly deployed multiple open-source AI agent frameworks to find and exploit vulnerabilities across several targets, automating work that would ordinarily require hands-on effort from an attacker.

The reported activity illustrates how AI tools are being applied to increasingly complex stages of an attack, including tasks that traditionally require substantial technical expertise and hands-on effort.

Meanwhile, the volume of AI-related activity across illicit communities continues to climb.

In September 2026, Flashpoint analysts identified 8,837,186 posts discussing artificial intelligence in the context of illicit activity, up from 7,461,908 in August. That represents an approximately 18% increase in a single month.

Across forums, marketplaces, and chat services, threat actors continue to advertise AI services, exchange techniques, and explore ways to incorporate AI into fraud, identity verification bypass, social engineering, and offensive cyber operations.

To track these developments, Flashpoint’s monthly AI Threat Report analyzes primary source communities across forums, marketplaces, and chat services. This month’s intelligence highlights a sharp increase in AI-enabled identity verification bypass activity, continued demand for malicious AI capabilities, and emerging examples of AI agent tooling being used in offensive operations.

Where AI Activity Is Concentrated

Telegram remained the dominant source of observed AI service advertisements in September, with 6,309,872 posts, up from 4,899,407 in August. That represents an approximately 29% month-over-month increase.

Activity across other platforms was substantially lower. Flashpoint identified 20,361 posts on GitHub Gist, followed by Pastebin (6,288), Signal (6,123), and Reddit (5,882). Smaller volumes were observed across 4chan, BlackHatWorld, Discord, Mastodon, and other sources.

As with previous months, these figures do not represent unique advertisements or services. Threat actors frequently repeat or distribute the same messages across multiple channels and platforms to maximize exposure.

Telegram’s continued dominance underscores its importance as a distribution channel for illicit AI services. Other platforms provide additional avenues for sharing technical material, advertising capabilities, and discussing methods.

The distribution of activity also reinforces why post volume requires context. Repeated advertisements can inflate overall counts, making it important to examine the underlying services and techniques being promoted alongside changes in activity.

AI-Enabled Fraud and Identity Verification Bypass

Discussions of AI-enabled identity verification bypass continued to accelerate in September.

Flashpoint analysts observed 1,171,914 posts advertising or discussing Know Your Customer (KYC) bypass methods using AI technology, including deepfake technology. That compares with 751,644 posts in August, representing an approximately 56% month-over-month increase.

The increase is particularly noteworthy given the growth already observed in August, when KYC-related activity nearly doubled from July. Across the past two months, the number of observed posts has nearly tripled, rising from 394,567 in July to more than 1.17 million in September.

These discussions are concentrated in Telegram channels advertising methods designed to circumvent identity verification controls through generative AI, including deepfake technology.

For financial institutions and other organizations that rely on digital identity verification, this activity warrants close attention. AI-enabled impersonation can create additional challenges for onboarding, account recovery, and other processes that depend on verifying a user’s identity.

The sustained increase in underground discussion also provides security and fraud teams with an important signal about where threat actor interest is concentrated, even when repeated advertisements contribute to the overall volume.

Malicious LLM Usage and Prompt-Based Workflows

Malicious and unrestricted large language models (LLMs) remained part of the AI-related activity observed across Flashpoint Collections in September.

Threat actors continue to develop their own models or seek ways to bypass safeguards imposed by mainstream AI services. These capabilities can support phishing, social engineering, harmful code generation, and the creation of malicious or offensive content.

The availability of malicious and unrestricted LLMs gives threat actors additional options for incorporating AI into existing workflows. Models designed or modified to circumvent safety restrictions can be used to generate content and technical material that mainstream services would ordinarily reject.

These tools also introduce challenges for security teams assessing how AI-enabled threats are evolving. Understanding which models are being discussed, how they are marketed, and the capabilities being sought by threat actors can provide insight into emerging areas of interest across illicit communities.

Notable AI-Related Activity Observed in September

Flashpoint identified several notable developments involving AI infrastructure and the growing use of AI in offensive cyber operations.

September reporting highlighted a Chinese-speaking operator reportedly using three open-source AI agent frameworks, including Strix and Cairn, to automate vulnerability discovery and exploitation across multiple targets, according to The Register, citing Gambit.

These developments highlight two areas of concern: the targeting of proprietary AI infrastructure and the potential for agent-based tools to accelerate offensive operations. For security teams, both reinforce the importance of protecting AI development environments and addressing exploitable weaknesses before attackers can capitalize on them.

What Security Teams Should Take Away

September’s intelligence points to continued growth in AI-related criminal activity, with particularly sharp increases in discussions surrounding identity verification bypass.

Flashpoint observed more than 8.8 million posts discussing AI and criminal activity, while KYC bypass discussions exceeded 1.17 million posts for the first time in the three-month period examined.

At the same time, reported activity involving AI agent frameworks illustrates how automation is extending into more complex offensive workflows. Threat actors are exploring ways to apply AI to vulnerability discovery and exploitation, alongside its established uses in fraud, impersonation, and social engineering.

For security teams, these developments reinforce the importance of maintaining visibility into the communities where new capabilities are discussed, advertised, and tested. Tracking changes in activity and understanding how tools are being applied can help organizations identify emerging risks and better prioritize their defenses.

To see how Flashpoint can help your team identify and respond to emerging threats, request a demo.

Frequently Asked Questions (FAQ)

What is the Flashpoint AI Threat Report?

The Flashpoint AI Threat Report is a monthly intelligence analysis tracking how threat actors use and discuss artificial intelligence across illicit communities. Built on Flashpoint’s primary source collection, the report provides visibility into underground forums, chat services, marketplaces, and other environments where AI-related criminal activity is discussed and advertised.

How are threat actors currently using AI in cybercrime?

Threat actors are using or exploring AI capabilities across a range of criminal activities, including identity verification bypass, phishing, social engineering, malicious code generation, and vulnerability discovery.

September reporting also highlighted the use of AI agent frameworks to automate elements of offensive cyber operations, including vulnerability discovery and exploitation.

How rapidly is illicit AI activity growing in cybercrime communities?

Flashpoint analysts identified 8,837,186 posts discussing AI and criminal activities in September 2026, compared with 7,461,908 in August. This represents an approximately 18% month-over-month increase.

Activity related to AI-enabled KYC bypass also grew substantially, reaching 1,171,914 posts in September, an increase of approximately 56% from August.

These figures measure observed posts, rather than unique threat actors, services, or confirmed attacks.

Which messaging platforms and forums host the most illicit AI chatter?

Telegram continues to account for the largest concentration of observed AI service advertisements. Flashpoint identified more than 6.3 million posts advertising AI services on Telegram in September.

Other sources included GitHub Gist, Pastebin, Signal, Reddit, 4chan, BlackHatWorld, Discord, and Mastodon.

What are malicious LLMs?

Malicious LLMs are AI models developed, modified, or marketed for purposes that mainstream AI services typically restrict. Threat actors may use these models to generate phishing content, assist with social engineering, create harmful code, or support other criminal activities.

Flashpoint continues to track discussion of these models across illicit communities to understand how their capabilities and use cases are evolving.

Blogs

Blog

Flashpoint’s Top 5 Predictions for the 2026 Threat Landscape

Flashpoint’s forward-looking threat insights for security and executive teams, provides the strategic foresight needed to prepare for the convergence of AI, identity, and physical security threats in 2026.

As the global threat landscape accelerates its transformation, 2026 marks an inflection point requiring defensive strategies to fundamentally shift. The volatility observed in 2025 has paved the way for an era soon to be defined by AI-weaponized autonomy, information-stealing malware, systemic instability of public vulnerability systems, and the complete convergence of digital and physical risk.

Flashpoint offers a unique window into these complexities, providing organizations with the foresight needed to navigate what lies ahead. Drawing from Flashpoint’s leading intelligence and primary source collections, we highlight five key trends shaping the 2026 threat landscape. These insights aim to help organizations not only understand what’s next but also build the resilience needed to withstand and adapt to emerging challenges.

Prediction 1: Agentic AI Threats Will Weaponize Autonomy, Forcing a New Defensive Standard

2026 will see continued evolution of AI threats, with future attacks centering on autonomy and integration. Across the deep and dark web, Flashpoint is observing threat actors move past experimentation and into operational use of illegal AI. 

As attackers train custom fraud-tuned LLMs (Large Language Models) and multilingual phishing tools directly on illicit data, these AI models will become more capable. The criminal intent shaping their misuse will also become more sophisticated. Additionally, 2026 will see a greater marketplace for paid jailbreaking communities and synthetic media kits for KYC (Know Your Customer) bypass.

These advancements are enabling criminals to move beyond simple tools and engage in scaled, autonomous fraud operations, leading to two major shifts:

1. Agentic AI is becoming the true flashpoint: Threat actors will be using agentic systems to automate reconnaissance, generate synthetic identities, and iterate on fraud playbooks in near real-time. In this SaaS ecosystem, AI will help attackers leverage subscription tiers and customer feedback loops at scale.
2. The attack surface will shift to focus on AI Integrations: Organizations are increasingly plugging LLMs into live data streams, internal tools, identity systems, and autonomous agents. This practice often lacks the same security vetting, access controls, and monitoring applied to other enterprise systems. As such, attackers will heavily target these integrations, such as APIs, plugins, and system connections, rather than the models themselves.

“The ubiquity of automation has dramatically increased attack tempo, leaving many security teams behind the curve. While automation can replace repetitive tasks across the enterprise, organizations must not make the critical mistake of substituting human judgement for AI at the intelligence level.

This is paramount because a critical threat in 2026 is Agentic AI autonomy weaponized against soft targets—API integrations and identity systems. The only winning defense will be human-led and AI-scaled, prioritizing purposeful use to keep organizations ahead of this exponential risk.”

Josh Lefkowitz, CEO at Flashpoint

These evolving AI threats will force a fundamental shift in defensive strategies. Defenders will have to shift to deploying systems around AI rather than trust them on their own.

Prediction 2: Identity Compromise via Infostealers Will Become the Foundation of Every Attack

Infostealers will become the entry point, the data broker, the reconnaissance layer, and the fuel for everything that comes after a cyberattack. This shift is already in motion and is accelerating rapidly: in just the first half of 2025, infostealers were responsible for 1.8 billion stolen credentials, an 800% spike from the start of the year. However, 2026 will redefine the malware’s role, making its most valuable output being access, rather than disruption.

Infostealers will become the upstream event that powers the rest of the attack chain. Identity and session data will be increasingly targeted, since it gives attackers immediate access into victim environments. Ransomware, fraud, data theft, and extortion will simply be downstream ways to monetize.

This upstream approach defines the new reality of the attack chain, which is already operational. Nearly every major stealer strain Flashpoint observes now exfiltrates the following:

• Autofill PII (personable identifiable information)
• Saved addresses
• Phone numbers
• Internal URLs
• Browsing history
• Cloud app tokens

An organization’s attack surface is no longer just composed of their own networks. It is the entire digital identity of their employees and partners. This new reality requires security teams to take a new approach. Instead of attempting to block attacks, they must proactively detect compromised credentials before they are weaponized. This will be the difference between reacting to a data breach and preventing one.

“The infostealer economy has fully industrialized the attack chain, making initial compromise a low-cost commodity. Multiple security incidents in 2025 tie back to credentials found in infostealer logs. This reality has underscored the critical importance of digital trust—specifically, verifying who can access what resources. For 2026, identity is the perimeter to watch, and security teams must proactively hunt for compromised credentials before they’re weaponized.”

Ian Gray, Vice President of Intelligence at Flashpoint

Prediction 3: CVE Volatility Will Force Redundancy in Vulnerability Intelligence

The temporary funding crisis at CVE in April 2025 and the subsequent CISA stopgap extension through March 2026 exposed the systemic fragility of a centralized vulnerability intelligence model. With the future of the CVE/NVD system hanging in the balance, 2026 will be defined by the urgent need for redundancy and diversification in vulnerability intelligence.

In today’s vulnerability intelligence ecosystem, nearly every organization’s vulnerability management framework relies on CVE and NVD—including its “alternatives” such as the EUVD (European Union Vulnerability Database). The CVE system has grown into a critical global cybersecurity utility, relied upon by nearly all vulnerability scanners, SIEM platforms, patch management tools, threat intelligence feeds, and compliance reports. A complete shutdown of CVE would result in a widespread loss of institutional infrastructure.

The next generation of security needs to be built on practices that are resilient, diversified, and intelligence-driven. It should be focused on providing insights that can be used to take action such as threat actor behavior, likelihood of exploitation in the wild, relevance to ransomware campaigns, and business context. Security teams will need to leverage a comprehensive source of vulnerability intelligence such as Flashpoint’s VulnDB that provides full coverage for CVE, while also cataloging more than 100,000 vulnerabilities missed by CVE and NVD.

Prediction 4: Executive Protection Will Remain a Critical Challenge as Cyber-Physical Threats Converge

The continued blurring of lines between cyber, physical, and geopolitical threats will elevate the risk to organizational leadership, turning executive protection into a holistic intelligence function in 2026. The rise of information warfare combined with physical world convergence means the threat to key personnel is no longer purely digital.

In the aftermath of the tragic December 2024 assassination of United Healthcare’s CEO, Flashpoint has seen the continued circulation and glorification of “wanted-style posters” of executives in extremist communities. Additionally, Flashpoint has seen nation-state actors participate, using espionage and influence to target high-value individuals.
Organizations must adopt an integrated approach that connects insights from threat actor chatter and a wealth of other OSINT sources. This fusion of intelligence is essential for applying frameworks to ensure the safety of leadership and key personnel.

Prediction 5: Extortion Shifts to Identity-Based Supply Chain Risk

2025 was marked by several large-scale extortion campaigns, demonstrating how the threat landscape is rapidly evolving. Ransomware operations have shifted into a straight extortion play. Flashpoint has observed a surge in new entrants to the ransomware market, accompanied by a decline in the quality and decorum of ransomware groups.

Furthermore, vishing campaigns attributed to “Scattered Spider” have highlighted weaknesses in identity, trust, and verification. Campaigns from “Scattered LAPSUS$ Hunters” have also exposed vulnerabilities in third-party integrations. These attacks culminated in extortion, showcasing that modern attacks will target trusted users and trusted applications for initial access, and will forgo ransomware in place of data access.

As this shift continues into 2026, threat actors will increasingly focus their efforts on exploiting human behavior and identity systems. Instead of attempting to spend resources on breaking network perimeters, attackers will instead socially engineer employees to gain access to corporate systems at scale. This change in TTPs will undoubtedly greatly increase supply chain risk, especially for third parties.

Charting a Path Through an Evolving Threat Landscape with Flashpoint Intelligence

These five predictions highlight the transformative trends shaping the future of cybersecurity and threat intelligence. Staying ahead of these challenges demands more than just reactive measures—it requires actionable intelligence, strategic foresight, and cross-sector collaboration. By embracing these principles and investing in proactive security strategies, organizations can not only mitigate risks but also seize opportunities to enhance their resilience.

As the threat landscape continues to rapidly evolve, staying informed and prepared are critical components of risk mitigation. With the right tools, insights, and partnerships, security teams can navigate the complexities ahead and safeguard what matters most.

Request a demo.