Can AI hack into systems on its own?
PartlyPartly. AI agents have done most of the work in real break-ins, with people choosing targets and stepping in at key moments; no fully independent AI attack has been documented.
First shown: Sep 15, 2025. Anthropic reported a campaign in which operators had its Claude Code tool carry out most of an espionage operation against about 30 organisations, with humans stepping in only at a few decision points. (Anthropic, Nov 2025)
What it means
An AI agent is an AI that can take actions, such as running programs and logging in, not just chat. In the cases on our record, criminals or testers pointed agents at targets and the agents did most of the routine work: looking for weak spots, trying ways in and collecting data.
People are still in the loop. They pick the targets, approve key steps and handle what the agents can't. What's changed is scale: one person with agents can now attempt far more targets than before.
Labs and security firms report these cases and say they cut off the accounts involved. Each case on our record is graded by how much the AI did and whether there was a real victim.
The evidence ladder
Every capability on this site is graded on the same five steps, from a single demonstration to real-world consequences.
| Step | Status | When | Evidence |
|---|---|---|---|
| Demonstrated shown at least once | yes | Sep 15, 2025 | Anthropic reported operators using Claude Code to perform most of an espionage campaign against about 30 organisations. (Anthropic) |
| Reproduced independently repeated | yes | Jul 4, 2026 | Sysdig documented a ransomware campaign it said was carried out end to end by an AI agent. (BleepingComputer) |
| Accessible available to ordinary people, or criminals | partly | Sep 25, 2026 | Reuters reported one hacker running open-source agent software against more than 1,200 websites, breaking into over 100 company sites. (Reuters via Star-Advertiser) |
| Reliable works most of the time for a defined task | partly | Oct 15, 2026 | A startup's agents found routes into a limited set of Anthropic's internal systems in under 12 hours, after days of failed attempts against its own software. (Gizmodo) |
| Consequences real-world use or harm documented | yes | Oct 15, 2026 | Seoul police arrested seven people who used generative AI to hack about 90 organisations and take 8.2 million records. (Korea JoongAng Daily) |
From the record
- Operators have Claude Code perform most of an espionage campaign against about 30 organisations. The case file → (Anthropic)
- A ransomware campaign run end to end by an AI agent, per Sysdig. The case file → (BleepingComputer)
- One hacker's AI agents break into more than 100 company websites, per Reuters. The case file → (Reuters (via Honolulu Star-Advertiser))
- Seoul police arrest seven over AI-assisted hacking of about 90 organisations. The case file → (Korea JoongAng Daily)
- A startup's AI agents reach a limited set of Anthropic's internal systems in under 12 hours. The case file → (Gizmodo, Oct 26 (citing The Washington Post))
What it means for you
More organisations will be tested by attackers more often, including the small ones that used to be ignored. For individuals, the fallout usually arrives as breach notices and the scams that follow them.
What to do
- Use unique passwords and two-step loginso a breach at one company doesn't open your other accounts.
- Treat breach-news messages with suspicion.Scammers use real attacks as cover. Go to the company's own site or app.
- Search our recordto see whether an organisation you deal with has been named: warningshots.ai/exposed/.
Questions people ask
Can AI hack on its own?
Not fully, on the public record. AI agents have done most of the work in real attacks, but people chose the targets and stepped in at key points.
Has AI been used in real cyberattacks?
Yes. Our record includes espionage, ransomware and mass website break-ins in which AI agents did much of the work, each with its source.
Am I affected?
Search the organisations you use at warningshots.ai/exposed/, and keep passwords unique with two-step login on.
Related
Sources
- Anthropic: Disrupting the first reported AI-orchestrated cyber espionage campaign
- BleepingComputer: JadePuffer ransomware used AI agent
- Reuters via Star-Advertiser: one hacker, AI agents, 100+ company websites (Oct 19, 2026)
- Korea JoongAng Daily: seven arrested (Oct 26, 2026)
- Gizmodo: startup claims it hacked Anthropic (Oct 26, 2026)
Spot an error or something out of date? Tell us; corrections are made and logged. Written with AI assistance from public sources; every fact checked and approved by Colin Balfe. General information, not legal, medical or financial advice.