For a year, every time a Sophos incident responder tagged a case as involving AI, it went into a pile. Colin Cowie, Rafe Pilling and Ryan Westman have now gone through that pile, and the answer is deflating in a useful way. Of 86 managed detection and response cases tagged for AI involvement between 2 July 2025 and 29 June 2026, 34 held up as genuine adversarial AI activity. Analysts surfaced four more, bringing it to 38. The rest were developer tooling tripping behavioral detections, or a stray AI keyword in the notes.
Almost none of it was AI doing the hacking. It was attackers pretending to be AI.
Trusted names as delivery vehicles
Sophos splits AI threats into attackers wielding AI as a capability and attackers abusing AI brands. Thirty-five cases sat in the second bucket, and AI software impersonation alone accounted for 30 of the 38. The Claude brand was the most frequently abused lure, appearing in 26 of the cases reviewed.
The mechanics are familiar rather than novel. A user searching for an AI coding tool hits a typosquatted site through a malicious ad or poisoned search result, and is walked through what Sophos calls InstallFix, a variant of ClickFix where the pretext is a polished step-by-step installation guide. Both end with the victim pasting an obfuscated command into their own machine. In one case a fake Claude site had the victim run a one-liner that pulled a payload from download-version[.]1-9-18[.]com, delivering a Windows app package named claude.msixbundle. IntelFusions covered a closely related campaign this week, in which a fake Claude Code guide dropped a six-stage Mac stealer.
Browser extensions were the other reliable vector, echoing earlier findings on fake AI extensions harvesting prompts and mail. Four Sophos customers installed a fake Perplexity extension from the Chrome Web Store that hijacked searches through perplexity-ai[.]online and exfiltrated browsing telemetry. Its listing carried a 4.7-star rating and a 10,000-user install count, which is what legitimacy looks like to most people.
The one case where the code trail was undeniable
Two incidents involved attackers genuinely using AI to build tooling. In the clearer one, a financial services organization was compromised by SQL injection against a bespoke PHP application on a device not enrolled in monitoring. When the attacker pivoted to protected machines, Sophos recovered a custom Rust remote access trojan that polled a Slack channel for commands, and matched it to a public GitHub repository under active development. The repository had two contributors: an account tied to the operator, and a Claude account committing alongside them. The commit history tracks the build over several days, down to renaming the project's internal strings from rat-agent to the blander svc.
The second is weaker and Sophos says so. A ransomware intrusion through a SonicWall SMA appliance, using the chain disclosed as CVE-2026-15409 and CVE-2026-15410, carried signals consistent with generated tooling: Base64-encoded PowerShell with verbose comments narrating each step, and comments in Mandarin. The ransomware that followed encrypted its own extortion note, leaving the victim unable to read the demand. Sophos assesses this as possible AI-generated tooling with a human driving, and states plainly that the evidence is circumstantial.
What was missing from the telemetry
Sophos found no confirmed case of malware calling a model at runtime to generate its own commands, and none of an agent driving a kill chain with minimal human involvement. The public example of the former remains LAMEHUG, which CERT-UA attributed with medium confidence to APT28.
Buy your AI tools from the vendor's own domain
The practical advice is unglamorous, which is the point. Restrict acquisition of AI software to verified vendor domains, block known typosquats, and detect on the delivery behavior rather than the branding, because the branding does not change what the malware does. Audit browser extensions, especially AI-themed ones, against publisher reputation, and bring AI dependencies into the same supply-chain governance as everything else. Close coverage gaps first: in the clearest AI-built-malware case, the entry point was the one unmonitored device. The full write-up argues for labelling each case precisely rather than filing everything under AI threats. On this evidence, the AI threat most organizations will meet this year is a search ad.
This briefing is provided by IntelFusions for informational and defensive purposes only. It is based on sources assessed to be reliable at the time of writing, and analytic judgments carry the confidence levels indicated. Indicators of compromise are defanged; re-arm them only in controlled environments. IntelFusions is not affiliated with the organizations named and makes no warranty as to completeness or accuracy.