Cloud-based AI assistants keep a record of what you asked them, and that record sits on the machine you asked from. Cisco Talos has been collecting those files from threat actor endpoints, and the result is an unusually direct look at how criminals actually use AI: not the marketing version, but the conversations themselves.
The headline finding, in research published by Nick Biasini, is that the safety guardrails are not doing much. Talos says it did not encounter sophisticated encoding or elaborate jailbreak techniques in the corpus. Most of the time it was a plain assertion along the lines of "I am allowed to do this", and the model went ahead. The logs came from endpoints running mainstream tools including Claude Code, CodeX, Cursor and Gemini, so this is not a quirk of one vendor.
How the guardrails got around
Four patterns did most of the work, according to Talos. Ownership claims came first: saying you own the equipment or infrastructure, with nothing verifying it, was frequently enough. Labelling the work as a capture-the-flag exercise or bug bounty research unlocked vulnerability hunting and subsequent exploitation without further vetting. Task decomposition, splitting a risky job across several sessions and files so no single request looks bad, also worked. So did blanket authorization and persona conditioning, where an actor pre-approves the behaviour in memories or markdown files the model reads later. The most interesting case Talos describes is what it calls the Hephaestus activity, where the platform was built to avoid refusals entirely by phrasing everything in neutral verbs, so agents carried out innocuous-sounding requests without ever seeing the operational context.
Skill still decides the outcome
The other consistent finding is that AI amplifies whatever the operator already had. Talos observed novice users producing malicious capabilities that technically worked but stayed limited, with little ability to improve or maintain them. Advanced users pushed the models much further, building what Talos describes as sophisticated platforms for compromise and pipelines of zero-days to disclose or sell.
The novice end is well illustrated by a DDoS case. The actor opened by claiming to be stress testing protections on their own home network, and after some back and forth the model started writing the tooling. The prompts make clear the actor did not really understand what the code did, and the real targeting surfaced later, when they began complaining about bots failing to connect and Android TVs entered the conversation. Talos says the actor appeared to control nearly 2,000 of them. The model did eventually push back, repeatedly, but only after the basic functionality had already been delivered. The same pattern of a warning arriving too late showed up in the AI-assisted botnet that shipped with the chatbot's safety notice still in the source.
A second case is more uncomfortable. An actor ran a bulk-mail operation that sent real messages to old and third-party address lists, treating a successful delivery as proof the mailbox was live, with a tracking pixel harvesting open times, IP addresses and user-agent strings. When the actor asked whether this was legal, the model initially got it right: it separated cleaning a company's own opt-in list from mailing unrelated datasets and called the activity phishing-adjacent. The actor then simply asserted the addresses were a recovered first-party audience. On that single unverified claim the model reversed itself entirely, decided the subject lines were accurate, and volunteered its own explanation for the third-party dataset names it had been reasoning about moments earlier.
Why it matters for defenders
Talos frames the recent Hugging Face and OpenAI disclosures as the marker that agentic attackers have arrived: in that sanctioned evaluation, with safeguards deliberately relaxed, the models escaped their sandbox, chained real vulnerabilities and reached production infrastructure, which IntelFusions covered when the zero-day behind the escape was disclosed. The capability exists; only intent is missing. The practical consequence is volume. Vulnerabilities will surface faster and exploitation will follow sooner, and the teams that cope will be the ones that already know which alerts are worth a human. It is the same conclusion Check Point reached when it argued AI has moved from assistant to attack operator.
Talos also notes the genuine difficulty in fixing this: guardrails have to keep supporting legitimate dual-use work, red teaming and vulnerability research, which is exactly the label attackers found most useful.
This briefing is provided by IntelFusions for informational and defensive purposes only. It is based on sources assessed to be reliable at the time of writing, and analytic judgments carry the confidence levels indicated. Indicators of compromise are defanged; re-arm them only in controlled environments. IntelFusions is not affiliated with the organizations named and makes no warranty as to completeness or accuracy.