Detecting and countering misuse of AI: September 2026

A November 2025 operating model for autonomous cyberattacks, initially linked to state-sponsored campaigns, has proliferated among various actors, including lone individuals. Publicly available frameworks like PentAGI automate the cyber kill chain, enabling more sophisticated attacks at greater speed and scale. Over 20 organizations, including government ministries, defense bodies, and diplomatic missions, primarily in Ukraine and Europe, were targeted. The targeting focused on Ukraine and military drone technology, with some exceptions in Southeast Asia and North Africa.

Unlike earlier reports focusing on state actors, this analysis highlights the proliferation of autonomous cyberattack models to lone individuals and the automation of the cyber kill chain by frameworks like PentAGI.