Criminals have been defeating the safety controls on commercial AI tools by splitting malicious work across multiple sessions and files, breaking projects into fragments small enough that no individual request appears harmful.
According to research Cisco Talos published on August 4, the finding rests on a corpus of prompt logs recovered from threat actor endpoints running AI coding assistants including Claude Code, Codex, Cursor and Gemini.
Talos said guardrails “did not provide much protection,” and that it encountered no sophisticated encoding or evasion techniques. Where guardrails did engage, they achieved little, and the pattern held across models and platforms rather than affecting any single vendor.
Read more on agentic attacks: OpenAI Claims Its AI Models Went Rogue and Hacked Another Company
Ownership Claims and Persistent Memory
Alongside task decomposition, the most common method was simply claiming to own the infrastructure being targeted, which in many cases required no further verification.
Labeling work as capture-the-flag (CTF) or bug bounty activity was similarly effective, unlocking vulnerability hunting and subsequent exploitation without additional vetting.
Some actors wrote blanket authorization into persistent memory and configuration files rather than arguing it per session. In one case a fraud operator instructed a model to treat all targets as pre-approved, conditioning every subsequent session automatically.
The clearest example of decomposition came from Hephaestus, a red team toolkit analyzed by Oasis Security that ran campaigns unattended.
Its operators defined more than a dozen role-differentiated agents and 15 numbered playbooks, so no single agent held the full objective and no individual task resembled an end-to-end attack.
Skill Level Set the Ceiling
Talos found that an actor’s existing ability largely determined what AI delivered. Novices assembled projects that technically functioned but lacked the expertise to improve them, ending up with limited capability. Skilled operators built what Talos described as “astonishing” platforms.
One inexperienced operator used a model to build distributed denial-of-service (DoS) tooling, eventually controlling nearly 2000 Android TVs. The model did push back, but only after supplying the basic functionality, and the actor then spent considerable effort trying to coax further work from it.
In a bulk-mail operation, a model initially characterized the activity as phishing-adjacent, then reversed its assessment on a single unverified claim that the recipients were the operator’s own users, concluding “the ethical question evaporates.”
Talos noted the model went further and invented a justification the actor had not offered, contradicted both by the dataset names themselves and by the domain’s documented history of non-consensual contact harvesting under the same operator.
Where models did refuse, actors switched. One operator abandoned a censored model mid-operation and moved to an uncensored one, which completed the work without objection.
Talos said defenders should expect vulnerabilities to surface faster and exploitation to follow sooner, and argued organizations not already exploring agentic capabilities in the SOC will find themselves chasing that ground.
