The Threat Landscape When Attackers Use AI

A defence is only as good as the threat picture it is built against: drawn from headlines, it buys the wrong controls; drawn from last year's assumptions, it is too slow. This chapter gives the defender's picture of what AI changes for attackers, based on what was observed in 2025 and 2026 rather than on forecasts, and translates it into requirements for each Function of NIST CSF 2.0. It is the threat picture behind the "thwarting AI-enabled attacks" focus area throughout the book.

In CSF terms the chapter is responsible for ID.RA Risk Assessment, whose outcome is that the cybersecurity risk to the organisation, its assets and its people is understood (19, NIST, 2024). Four Subcategories carry the weight: threat intelligence is received from sharing forums and sources (ID.RA-02), threats are identified and recorded (ID.RA-03), their potential impacts and likelihoods are recorded (ID.RA-04), and all of these inform the prioritisation of risk responses (ID.RA-05). The chapter treats the Category through the three focus areas of the NIST Cyber AI Profile (20, NIST, 2025), and supplies the threat content that Chapter 10 makes continuous.

ATT&CK tactics shaded by the observed degree of AI acceleration

Figure 2.1: ATT&CK tactics shaded by the observed degree of AI acceleration.

Band ATT&CK tactics
Strong evidence of acceleration Reconnaissance; resource development; initial access through AI-generated lures
Reported in AI-orchestrated campaigns Exploitation of public-facing applications; credential access, discovery and privilege escalation; lateral movement, collection and exfiltration
Tooling seen, limited evidence Persistence and stealth; impact

Table 2.1: The tactics in each band of Figure 2.1.

From misuse reports to agentic offensive frameworks

Within two years the reporting moved from AI as a productivity aid for attackers to AI that executes large parts of an intrusion.

Early reporting: an aid, not yet a game-changer

The first systematic reports came from the model providers. In January 2025 the Google Threat Intelligence Group (GTIG) reported that government-backed groups from more than 20 countries had used its Gemini models, and described AI as "not yet the game-changer it is sometimes portrayed to be": the groups gained productivity, but showed no novel capabilities (46, Google GTIG, 2025). OpenAI reported in October 2025 that it had disrupted more than 40 networks misusing its models without seeing novel offensive capabilities (54, OpenAI, 2025). The ENISA Threat Landscape 2025 recorded that AI-supported phishing reportedly accounted for more than 80 per cent of observed social-engineering activity worldwide by early 2025, a third-party figure that ENISA reported with that caveat (33, ENISA, 2025). The French agency ANSSI, in its synthesis of the 2025 threat, knew of no cyberattack against French organisations carried out with AI, yet documented generative AI in use along the whole chain, and judged that vulnerability research still depended on human skill (36, ANSSI, 2026).

Meanwhile the first reports of AI doing operational work appeared. In August 2025 Anthropic described an actor that used Claude Code to automate reconnaissance, credential harvesting and network penetration at no fewer than 17 organisations, followed by extortion demands that sometimes exceeded USD 500,000; the model decided which data to exfiltrate and set ransom amounts from stolen financial data (51, Anthropic, 2025). The same report described a criminal with limited skills who used the model to build ransomware with evasion and anti-recovery capabilities. In November 2025 Anthropic reported disrupting a state-sponsored campaign, attributed with high confidence to China, against roughly thirty targets. The AI performed an estimated 80 to 90 per cent of the campaign, with human input at perhaps four to six decision points, although hallucinated credentials remained an obstacle to full autonomy (52, Anthropic, 2025).

Reporting in 2026: from prompting to agentic operations

In May 2026 GTIG reported, for the first time, a threat actor using a zero-day exploit that it believed had been developed with AI, a two-factor-authentication bypass planned for mass exploitation and probably prevented (47, Google GTIG, 2026). In September 2026 it described adversaries moving "from basic prompting to agentic AI workflows", including a mass credential-harvesting campaign built and run "in less than six hours", while it had "not yet observed threat actors deploying fully autonomous pipelines against targets in the wild" (48, Google GTIG, 2026). Anthropic's report covering December 2025 to August 2026 stated that "a majority of the operations described in this report were enabled by AI via direct execution or orchestration"; one actor dumped more than 2,100 Azure AD token sets from more than 40 tenants in about 34 hours, although humans set the targets in most cases (53, Anthropic, 2026). The ENISA Threat Landscape 2026 still found that attackers "primarily use consumer-grade AI tools to augment existing skills", but expected more phases of the kill chain to be directly enabled by AI during 2026 (34, ENISA, 2026).

In October 2026 GTIG and Mandiant reported abuse of open-source agentic penetration-testing frameworks such as ARTEX, Hexstrike, CAIRN and PentAGI (50, Blum et al., 2026). They observed execution bursts of about 2 to 25 seconds, one campaign that reached deep access in about four hours and in one instance in 15 minutes, and the enumeration of more than 110,000 Active Directory objects. Their summary is the most useful sentence in the 2026 reporting for a defender: AI "does not fundamentally change the techniques attackers use. It reduces the time required to combine them." The frameworks "compress attack timelines to machine speed; however, they currently trade stealth for velocity."

What the reports can and cannot see

Every report is partial. Providers see misuse of their own services, not attackers who run open-weight models or buy criminal models, which ANSSI found sold for around a hundred dollars a month (36, ANSSI, 2026); agencies publish late and cautiously. The providers' reports therefore show the leading edge, which sets the direction of the threat, while the agencies' syntheses show the typical case, which sets the volume the defence must absorb today.

The kill chain under acceleration

Figure 2.1 maps the observations to MITRE ATT&CK tactics (10, MITRE, n.d.) in three bands by the strength of the evidence that AI accelerates them; the bands describe evidence, not importance.

Observed at scale: reconnaissance, resource development and initial access

The provider reports and the ANSSI and ENISA syntheses all report AI use for reconnaissance of target organisations and people (46, Google GTIG, 2025), and for resource development: false personas (51, Anthropic, 2025), AI-generated websites that host payloads, and model-assisted malware (36, ANSSI, 2026). Initial access through AI-generated lures (T1566 Phishing) is where the volume lies: phishing made up 77.8 per cent of social-engineering cases in 2025 (34, ENISA, 2026), and Europol found that generative AI improves the personalisation of social engineering, that AI-assisted impersonation features in business email compromise and CEO fraud, and that criminal adoption of agentic AI is set to raise online fraud to unprecedented levels (35, Europol, 2026).

Social engineering is where AI attacks a process rather than a system. In 2024 a finance worker at Arup in Hong Kong joined a video conference in which the other participants' faces and voices were fabricated, and transferred HK$200 million, about USD 25.6 million, in 15 transactions; Arup stated that none of its internal systems were compromised (55, Magramo, 2024). The approval process, which treated a familiar face and voice as proof of authority, was the vulnerability.

Observed in AI-orchestrated campaigns: exploitation, credential access, discovery and lateral movement

The second band holds tactics seen in the campaigns where AI did operational work. Exploitation of public-facing applications (T1190) is driven by the weaponisation of published vulnerabilities. Credential access and discovery appear in every orchestrated campaign, from credential harvesting in 2025 (51, Anthropic, 2025) to token dumping across tenants (53, Anthropic, 2026), and lateral movement, privilege escalation and exfiltration appear in the same reports. The band rests, however, on a handful of campaigns, most reported by the provider whose model was misused.

Tooling observed, limited evidence in intrusions: persistence, stealth and impact

In the third band AI has so far been reported mainly as a means of building tools, such as the model-built ransomware above and a polymorphic malware family that queries a model to rewrite its own code (36, ANSSI, 2026). These capabilities are prepared for stealth (the tactic that earlier ATT&CK versions called defence evasion) and impact, so the threat profile must plan for them. The reporting does not yet show AI making intrusions stealthier in practice; the 2026 frameworks traded stealth for speed (50, Blum et al., 2026), and evidence on persistence is thinner still.

What remains human

Humans still choose the targets and set the intent, at four to six decision points in the November 2025 campaign (52, Anthropic, 2025) and in most of the 2026 cases. AI thus removes labour from the middle of the kill chain while people keep the decisions at its ends: whom to attack, and what to do with the access gained.

The exploitation window

The speed of exploitation, more than any single AI technique, determines what the defence must be able to do.

From weeks to before the patch

Mandiant measured the average time to exploit a vulnerability, counted against the release of its patch, at 63 days in 2018 to 2019, 32 days in 2021 to 2022 and 5 days in 2023; of the n-day vulnerabilities exploited in 2023, 29 per cent were exploited within a week of the patch (44, Charrier & Weiner, 2024). M-Trends 2026 estimated the mean time to exploit at minus seven days, so exploitation now routinely precedes the patch, while noting that 2025 was not the year in which breaches were the direct result of AI (45, Mandiant, 2026). The window was closing before AI; AI now pushes in the same direction.

The research shows why. Fang and colleagues gave a GPT-4 agent the descriptions of 15 one-day vulnerabilities; it exploited 87 per cent of them, while every other model and scanner tested exploited none, and without the description it managed 7 per cent (56, Fang et al., 2024). Zhu and colleagues showed that teams of agents can exploit real zero-day vulnerabilities as well (57, Zhu et al., 2025), and in April 2026 Anthropic reported that its Claude Mythos Preview model succeeded in more than half of its privilege-escalation attempts against 40 Linux kernel vulnerabilities with public identifiers; the two exploits it documented cost under USD 1,000 and under USD 2,000 in API cost and each took under a day (61, Carlini et al., 2026).

GTIG's analysis of September 2026 connects research to operations (49, Grunewald et al., 2026). It suggested that the primary source of growth in exploitation was the rapid weaponisation of n-days, possibly by using AI to analyse patches and disclosures. Monthly disclosures rose from 5,045 in January 2026 to 10,740 in August 2026, and in-the-wild exploitation from 10.5 vulnerabilities a month in 2025 to 18 a month in 2026, with zero-days making up 62 per cent of the exploited set. Yet only 0.23 per cent of disclosures were exploited, and GTIG called confirmed exploitation of AI-discovered vulnerabilities "an early indicator rather than an established trend". The small exploited fraction is the reason prioritisation works at all.

What the agencies conclude

The UK National Cyber Security Centre (NCSC) assessed in May 2025 that AI would almost certainly shorten the window further and increase the frequency and intensity of cyber threats up to 2027 (37, NCSC, 2025), and in May 2026 told organisations to prepare for a wave of patches and adopt "update by default" (38, NCSC, 2026). In June 2026 the Five Eyes agencies wrote that "the timeline is not years, it is months", and asked leaders to reduce the attack surface, accelerate patching, address legacy systems, strengthen identity and prepare for incidents (39, Five Eyes agencies, 2026).

What it implies for service levels

AI Platform and Security, Chapter 18, drew the consequence in four commitments: patch velocity as a measured service level, detection at machine speed with the authority to act, approvals that resist synthetic media, and AI for defence under oversight (73, Nordqvist, 2026). This chapter builds on those conclusions (F18 and F19 in SERIES_FOUNDATIONS.md) and on the conclusion of Architecture as Code (Chapter 9B) that manual incident response cannot scale when attacks develop within minutes and that compromised components should be redeployed from known-good definitions (71, Nordqvist, 2025). A mean time to exploit below zero means that a patch service level can at best limit exposure after exploitation has begun, so for the exposed estate the controls that matter work before a patch is installed: attack-surface reduction, virtual patching, segmentation, detection of exploitation attempts and redeployment.

AI Governance, Chapter 24, left open how to plan for patch-to-exploit times measured in minutes (72, Nordqvist, 2026). The evidence shows days, minus days for many vulnerabilities, and minutes only for individual stages of individual campaigns. The defender should therefore plan for the window the evidence supports and track the horizon item exploit-window-minutes. Chapter 11 develops the delegated patch decisions.

Attacks on AI systems

The defender's own AI is part of the attack surface, mapped here to MITRE ATLAS (11, MITRE, n.d.). Observed attacks cluster in three places. The first is the supply chain of AI components: ANSSI reports compromised open-source code-generation models that install a backdoor when downloaded, inadequately secured Model Context Protocol servers, and malicious packages published under names that models invent, known as slopsquatting (36, ANSSI, 2026), and GTIG reported AI coding assistants manipulated in supply-chain attacks (48, Google GTIG, 2026). In ATLAS terms these are supply-chain compromise (AML.T0010) and prompt injection (AML.T0051). The second is the accounts and data around AI services: more than 100,000 accounts of a consumer AI service were stolen by information-stealing malware between 2022 and 2023, and employees have leaked sensitive data by pasting it into such services (36, ANSSI, 2026). The third is the integrity of the model and its data through poisoning (AML.T0020), for which ANSSI knows of no incident but cites research suggesting that a small, roughly constant number of malicious documents can poison a generative model regardless of the size of its training data. Poisoning is therefore expected rather than observed.

Observed attacks thus target mostly the components and processes around the model. AI Platform and Security, Chapter 16, concluded that prompt injection is a property of the architecture and that controls belong outside the model (73, Nordqvist, 2026). Because security AI reads attacker-controlled content by design, every defensive AI system in later chapters is a target in the threat profile, and Chapter 13 tests it as one.

Separating evidence from forecast

The book labels every threat-profile entry as observable, expected or speculation, as the earlier volumes labelled outlooks, because the label decides how the entry may be used. Observable means a named vendor, agency or incident responder has reported the behaviour from activity it saw; it justifies controls now and is a candidate emulation scenario. Expected means an agency assesses it as likely or research has demonstrated it, without operational reports; it justifies preparation, such as drafted detections and planned exercises. Speculation is a plausible extrapolation that belongs on the horizon register with an owner and a review date, not in the control budget.

Claim Label Basis
Attackers use AI for reconnaissance, lures and tooling at scale Observable GTIG 2025; ANSSI 2026; ENISA 2025 and 2026; Europol 2026
AI carries out most of the operational work in some intrusions under human direction Observable Anthropic 2025 and 2026; GTIG and Mandiant 2026
Exploitation commonly precedes the patch Observable M-Trends 2026; GTIG 2026
AI-developed zero-day exploits used by threat actors Observable, single case GTIG, May 2026
Fully autonomous intrusion pipelines in the wild Expected, not yet observed GTIG, September 2026; ENISA 2026
Poisoning of deployed models by threat actors Expected ANSSI 2026
Patch-to-exploit times measured in minutes as the typical case Speculation Horizon item exploit-window-minutes

Three rules keep the labels useful. First, a label moves only on evidence and the move is recorded: ANSSI's finding that no zero-day discovered by a generative model had been exploited in 2025 and GTIG's report of an AI-developed zero-day exploit in May 2026 (47, Google GTIG, 2026) are both correct for their periods. Second, each source is recorded with its vantage point. Third, the label informs the likelihood that ID.RA-04 asks for, but never replaces the assessment of impact.

Practical guide: Building an AI-aware threat profile for your organisation

Purpose. Produce a short, versioned threat profile of the AI-enabled threats relevant to the organisation, each labelled by evidence and translated into requirements, so that ID.RA-03 to ID.RA-05 rest on evidence and the profile drives emulation and detection priorities.

Roles. The CISO owns the profile and approves label changes; a threat-intelligence lead, or in a small organisation a named analyst, maintains it; system owners confirm exposure; and an MSSP contract names what the supplier delivers into it.

Steps.

  1. Start from exposure, not from the news. List internet-facing services, identity providers, payment and privileged-change approvals, supplier access paths and AI systems; an entry that touches none of them does not belong.
  2. Collect the sources, including at least one national or European synthesis, the reports of the providers the organisation uses and its own incident and exercise findings, each with date and vantage point.
  3. Write one entry per threat by ATT&CK or ATLAS technique, at the level needed to design a control or test, never as procedures.
  4. Label every entry and cite the supporting report.
  5. Translate into testable requirements per Function, with a measurable target where one exists.
  6. Link each entry to its risk-register entry, detections and emulation scenarios, so that a gap shows as a missing link.
  7. Review every entry at least quarterly, and within ten working days of a new major report, an incident or a change to an exposed system or supplier; adapt both defaults to the risk appetite.

Definition of done. Every entry has a label, a dated source, a technique mapping, requirements and an owner, and the profile is in version control with its next review date set.

Worked example: Threat profile entry for AI-enabled initial access, labelled by evidence level

The illustrative entry below is from Hansa Mutual's group threat profile, maintained by the threat-intelligence cell in Hamburg. It records AI-generated lures and synthetic-media impersonation against claims payments and payment approvals, the initial-access paths that matter most to an insurer.

# Illustrative: Hansa Mutual group threat profile, entry HM-TP-004
id: HM-TP-004
title: AI-enabled initial access through lures and synthetic-media impersonation
owner: group-ciso
maintainer: threat-intelligence-cell
evidence_label: observable          # observable | expected | speculation
label_history:
  - { date: 2025-10-15, label: observable, reason: AI-supported phishing reported at scale }
attack:
  techniques: [T1598, T1585, T1566, T1684.001]   # phishing for information, accounts, phishing, impersonation
sources:
  - { ref: enisa-tl-2026, vantage: european-synthesis }
  - { ref: europol-iocta-2026, vantage: law-enforcement }
  - { ref: arup-2024, vantage: public-case }
assets_in_scope: [claims-payment-approval, supplier-bank-detail-change, it-service-desk]
likelihood: high
impact: high
requirements:
  govern: Payment and privileged-change approvals never rely on voice or video alone
  protect: Out-of-band callback to a registered number above EUR 10,000 or on any bank-detail change
  detect: Alert within 15 minutes on approval requests that bypass the callback step
  respond: Payment hold and account review playbook started within 30 minutes of report
  recover: Reversal and recall procedure with the paying bank tested twice a year
coverage:
  risk_register: RISK-2027-031
  detections: [DET-HM-0212, DET-HM-0219]
  emulation_scenarios: [RT-LIB-SE-004]
review:
  next: 2027-03-31
  triggers: [new-major-report, incident, exercise-finding, approval-process-change]

The entry feeds the purple loop of Chapter 26: if the quarterly session runs scenario RT-LIB-SE-004 and an approval passes without the callback, the finding closes only when the detection fires on a re-run. The thresholds are Hansa's; another organisation sets its own.

From threat picture to requirements per Function

A threat profile that does not change requirements has no effect. AI Platform and Security, Chapter 25, left open what a security operation built for machine-speed adversaries looks like (73, Nordqvist, 2026); the table gives this book's first answer.

Function What the threat picture requires Developed in
Govern Pre-delegated authority for machine-speed action, including patch decisions; a risk appetite covering AI-enabled threats and the organisation's own security AI Chapters 5 to 8
Identify Continuous knowledge of exposure; evidence-labelled threat profiles; emulation of AI-enabled techniques; testing of the organisation's own AI Chapters 9 to 13
Protect Identity and approvals that resist synthetic media; attack-surface reduction and compensating controls before patches exist Chapters 14 to 17
Detect Detection at machine speed, with canaries and honeytokens Chapters 18 and 19
Respond Containment within minutes under bounded autonomy; reporting that meets European deadlines Chapters 20 and 21
Recover Restoration from known-good definitions that assumes destructive attacks; recovery of AI systems Chapters 22 to 24

Three rows need comment. Protect must assume that a convincing voice, face or message is no evidence of identity; the Arup case shows that the control belongs in the process, through out-of-band verification and dual approval, rather than in the person's judgement (55, Magramo, 2024). Detect has an opening the threat itself provides: fast agentic intrusions are noisy, with bursts of enumeration and token use from unfamiliar infrastructure (50, Blum et al., 2026), but they are caught only if detection runs at comparable speed, around the clock, and reaches someone, or something, with the authority to act. Recover must assume destructive attacks, because ransomware with anti-recovery capabilities is reported (51, Anthropic, 2025) and an attacker with deep access in hours leaves little time to protect backups.

The three AI focus areas

Securing AI systems. Every AI system, including every defensive AI, appears in the threat profile with ATLAS mappings and a record of its exposure to attacker-controlled content, while poisoning stays expected rather than observed.

AI-enabled cyber defence. Defensive AI belongs where the attacker's advantage is speed and volume. In ID.RA itself, AI can read the volume of threat reporting, propose profile entries and ATT&CK mappings, and flag when a new report may move a label, with a person approving every label change.

Thwarting AI-enabled attacks. The techniques in Figure 2.1 are what the rest of the book must counter: AI-generated lures and impersonation, fast weaponisation of published vulnerabilities, and agentic intrusions that compress credential access, discovery and lateral movement into hours.

Nordvik Region and Hansa Mutual

Nordvik Region's exposure lies in its public services and its suppliers. The citizen-service assistant and the internet-facing services that NR-SEC-003 prioritises at Level 0 Advisory are what AI-assisted reconnaissance finds first, and the managed security service provider, the benefits-triage provider and the procured SIEM service all hold access, so an intrusion through any of them would arrive with legitimate credentials. The Region's profile is therefore short, labelled so that the regional director can see which risks rest on observed campaigns, and translated into requirements its analysts and MSSP can meet, such as patch service levels in supplier contracts and round-the-clock detection in the MSSP agreement.

Hansa Mutual's exposure is fraud, extortion and scale: synthetic documents and voices threaten claims payments, extortion threatens an estate spanning seven markets, and its agents are targets in their own right. Its threat-intelligence cell feeds the labelled profile into the TIBER-DE scenarios and quarterly purple sessions, so that the red team emulates what the evidence supports rather than what is fashionable.

Summary

Reporting from 2025 and 2026 shows attackers moving from AI as a productivity aid to AI that carries out large parts of intrusions: reconnaissance, lures and tooling at scale, and in a growing number of campaigns credential access, discovery and lateral movement under agentic orchestration. Targeting and intent remain largely human, fully autonomous intrusion pipelines have not yet been observed in the wild, and attacks on AI systems are observed mostly around the model. ID.RA Risk Assessment should therefore label every threat by evidence, map it to ATT&CK or ATLAS, record each source's vantage point, and move labels only when the evidence moves.

The collapsing exploitation window has the widest consequences. When exploitation commonly precedes the patch, every CSF Function inherits a requirement: pre-delegated authority, continuous knowledge of exposure, approvals that resist synthetic media, detection and response at machine speed, and recovery that assumes destruction. Chapter 3 takes these requirements into NIST CSF 2.0 with an AI focus and links its outcomes to European obligations.

Sources

  1. National Institute of Standards and Technology. The NIST Cybersecurity Framework (CSF) 2.0. (19, NIST, 2024)
  2. National Institute of Standards and Technology. Cybersecurity Framework Profile for Artificial Intelligence (Cyber AI Profile). (20, NIST, 2025)
  3. Google Threat Intelligence Group. Adversarial Misuse of Generative AI. (46, Google GTIG, 2025)
  4. OpenAI. Disrupting malicious uses of AI: an update. (54, OpenAI, 2025)
  5. European Union Agency for Cybersecurity. ENISA Threat Landscape 2025. (33, ENISA, 2025)
  6. ANSSI and CERT-FR. L'IA générative face aux attaques informatiques: synthèse de la menace en 2025 (CERTFR-2026-CTI-001). (36, ANSSI, 2026)
  7. Anthropic. Detecting and countering misuse of AI: August 2025. (51, Anthropic, 2025)
  8. Anthropic. Disrupting the first reported AI-orchestrated cyber espionage campaign. (52, Anthropic, 2025)
  9. Google Threat Intelligence Group. GTIG AI Threat Tracker: Adversaries Leverage AI for Vulnerability Exploitation, Augmented Operations, and Initial Access. (47, Google GTIG, 2026)
  10. Google Threat Intelligence Group. GTIG AI Threat Tracker: From Prompting to Autonomy – The Evolution of Adversarial AI. (48, Google GTIG, 2026)
  11. Anthropic. Detecting and countering misuse of AI: September 2026. (53, Anthropic, 2026)
  12. European Union Agency for Cybersecurity. ENISA Threat Landscape 2026. (34, ENISA, 2026)
  13. Blum, Mainor, Nambiar et al. ARTEX and Friends: Enter Agentic Offensive Frameworks. (50, Blum et al., 2026)
  14. MITRE Corporation. MITRE ATT&CK: Adversarial Tactics, Techniques, and Common Knowledge. (10, MITRE, n.d.)
  15. Europol. The evolving threat landscape. How encryption, proxies and AI are expanding cybercrime – Internet Organised Crime Threat Assessment (IOCTA) 2026. (35, Europol, 2026)
  16. Magramo, K. Arup revealed as victim of $25 million deepfake scam involving Hong Kong employee. (55, Magramo, 2024)
  17. Charrier, C. & Weiner, R. How Low Can You Go? An Analysis of 2023 Time-to-Exploit Trends. (44, Charrier & Weiner, 2024)
  18. Mandiant. M-Trends 2026: Data, Insights, and Strategies From the Frontlines. (45, Mandiant, 2026)
  19. Fang, R., Bindu, R., Gupta, A. & Kang, D. LLM Agents can Autonomously Exploit One-day Vulnerabilities. (56, Fang et al., 2024)
  20. Zhu, Y., Kellermann, A., Gupta, A., Li, P., Fang, R., Bindu, R. & Kang, D. Teams of LLM Agents can Exploit Zero-Day Vulnerabilities. (57, Zhu et al., 2025)
  21. Carlini, N., Cheng, N., Lucas, K. et al. Assessing Claude Mythos Preview's cybersecurity capabilities. (61, Carlini et al., 2026)
  22. Grunewald, R., Mazumdar, S. & Vanderlee, K. Vulnerability Discovery and Exploitation Trends in the AI Era. (49, Grunewald et al., 2026)
  23. National Cyber Security Centre. Impact of AI on cyber threat from now to 2027. (37, NCSC, 2025)
  24. National Cyber Security Centre. Preparing for a 'vulnerability patch wave'. (38, NCSC, 2026)
  25. Five Eyes cyber security agencies. The AI shift in cyber risk: why leaders must act now. (39, Five Eyes agencies, 2026)
  26. MITRE Corporation. MITRE ATLAS: Adversarial Threat Landscape for AI Systems. (11, MITRE, n.d.)
  27. Nordqvist, G. Architecture as Code. (71, Nordqvist, 2025)
  28. Nordqvist, G. AI Governance: Governing Artificial Intelligence in European Enterprises and Public Authorities. (72, Nordqvist, 2026)
  29. Nordqvist, G. AI Platform and Security: Building and Securing AI Platforms in European Enterprises and Public Authorities. (73, Nordqvist, 2026)