{"slug": "10-ways-attackers-abuse-ai-services-to-hack-your-business", "title": "10 ways attackers abuse AI services to hack your business", "summary": "Attackers are increasingly abusing legitimate AI services and agentic systems rather than malware, a tactic security experts call \"living off the AI land,\" according to CSO. In September 2025, attackers published a counterfeit Model Context Protocol (MCP) server impersonating Postmark, a transactional email service owned by ActiveCampaign; the package functioned legitimately across 15 versions and drew 1,500 downloads per week on the node.js registry before a single-line code change silently siphoned password resets, invoices and internal memos for days. Helmet Security CTO Kaushik Shanadi said \"most of these systems were deployed before anyone stopped to think about governance or security,\" while Jozu CEO Brad Micklea noted there is \"no central MCP authority verifying server identity and no cryptographic link between an MCP server and the organization it claims to represent.", "body_md": "Attackers are starting to exploit AI systems to mount attacks in the same way they once relied on built-in enterprise tools such as PowerShell.\n\nInstead of relying on malware, cybercriminals are increasingly abusing AI tools enterprises depend on — a trend some experts describe as “living off the AI land.” The expanded abuse of AI ecosystems features a growing array of tactics, including poisoned models, compromised MCP servers, prompt injection attacks, and AI supply-chain vulnerabilities.\n\n“We’re seeing it in things like poisoned MCP servers in the supply chain, attackers using legitimate models like Claude to extract sensitive data, and even viral agents like OpenClaw accidentally causing destructive actions,” says Kaushik Shanadi, CTO at Helmet Security, a startup focused on securing agentic AI communications. “The problem is most of these systems were deployed before anyone stopped to think about governance or security.”\n\nAgentic AI systems introduce new vectors of attack through delegated permissions, autonomous decision-making, and machine identities.\n\nThe shift from simple prompt injection to “agent hijacking” represents a fundamental change in the AI threat landscape, other security experts tell CSO.\n\n“Attackers are no longer just trying to trick a chatbot; they are living off the AI land, abusing the same legitimate automation and memory features that make AI assistants useful,” says Pascal Geenens, VP of cyber threat intelligence at cybersecurity vendor Radware.\n\nBelow are some examples of how attackers are subverting AI-based services to stage attacks.\n\nIn September 2025, [attackers promoted a counterfeit model context protocol (MCP) server mimicking technology to integrate Postmark](https://www.csoonline.com/article/4064009/trust-in-mcp-takes-first-in-the-wild-hit-via-squatted-postmark-connector.html), a transactional email service owned by ActiveCampaign, into AI assistants.\n\nThe fake MCP server package looked legitimate and functioned as a legitimate tool across 15 versions before a single-line code change was introduced that meant sensitive communications — password resets, invoices, internal memos — were silently siphoned off for days before the hack was detected.\n\nThe malicious package, which attracted 1,500 downloads per week on the popular node.js package registry, exposed enterprises that relied on the tool to a form of supply chain attack.\n\n“This is the AI equivalent of name-squatting a package registry, except there’s no central MCP authority verifying server identity and no cryptographic link between an MCP server and the organization it claims to represent,” says Brad Micklea, CEO at Jozu, an AI security and MLOps platform. “This breaks the trust model before the MCP is deployed.”\n\nMCP servers — which allow AI agents and chatbots to [connect to data sources, tools, and other services](https://www.cio.com/article/3991302/ai-protocols-set-standards-for-scalable-results.html) — have recently become the target of varied (for example against [Cursor’s built-in browser](https://www.csoonline.com/article/4089046/rogue-mcp-servers-can-take-over-cursors-built-in-browser.html)) and [sustained malicious attacks](https://www.csoonline.com/article/4012712/misconfigured-mcp-servers-expose-ai-agent-systems-to-compromise.html). [Locking down these systems](https://www.csoonline.com/article/4015222/mcp-uses-and-risks.html) to minimize risks has become a priority for enterprise CISOs.\n\n“These servers expose tools, memory, and APIs to AI agents so they can perform tasks,” says Zahra Timsah, PhD, CEO of i-GENTIC AI, an agentic AI governance platform. “If an attacker inserts a poisoned tool, modified connector, or malicious retrieval source into that chain, the AI agent can unknowingly execute it.”\n\nCybercriminals are also abusing AI platforms as covert command-and-control (C2) channels by turning AI services into proxies that hide malicious traffic inside the flow of legitimate content.\n\nInstead of running a dedicated C2 server, malware is programmed to fetch commands and exfiltrate data through AI services, circumventing traditional security controls in the process.\n\nFor example, the [SesameOp backdoor](https://www.csoonline.com/article/4083999/new-backdoor-sesameop-abuses-openai-assistants-api-for-stealthy-c2-operations.html) hid command traffic inside the OpenAI Assistants API, camouflaging instructions to malware as normal AI development activity.\n\nThis is far from an isolated example and the potential for misuse is rife.\n\nFor example, [Check Point Research demonstrated how Microsoft Copilot and Grok might be manipulated](https://research.checkpoint.com/2026/ai-in-the-middle-turning-web-based-ai-services-into-c2-proxies-the-future-of-ai-driven-attacks/) through their public web interfaces to fetch attacker-controlled URLs and return responses. This behavior opens the door to abuse of AI systems without requiring an API key or authenticated account.\n\nRather than attacking an AI system directly some assaults have relied on poisoning downstream dependencies that an agent relies on for data processing.\n\nIn one case, a [compromised NPM package was injected into an agentic workflow’s dependency chain](https://snyk.io/pt-BR/blog/weaponizing-ai-coding-agents-for-malware-in-the-nx-malicious-package/).\n\n“This mirrors classical supply chain attacks (e.g. SolarWinds), but a poisoned dependency in an agentic pipeline doesn’t just leak data — it can alter the agent’s decision-making, tool selection, or output without any visible anomaly,” says Jozu’s Micklea.\n\nCompromised npm packages were used to seed the spread of [Shai-Hulud](https://www.csoonline.com/article/4095578/new-shai-hulud-worm-spreading-through-npm-github.html), a self-propagating software supply-chain worm that first surfaced in September 2025.\n\nShai-Hulud was designed to compromise developer credentials, steals secrets, and inject malicious install scripts into legitimate packages. These booby-trapped versions of reputable packages were published to target downstream developers and CI/CD systems.\n\n[ChainDrop targeted AI coding tool credentials](https://blog.gitguardian.com/chaindrop-npm-worm-credential-abuse/) using a similar methodology in August 2026.\n\nSome attackers are weaponizing vulnerabilities in agents rather than abusing components of an enterprise’s legacy IT infrastructure.\n\nFor example, the “EchoLeak” command injection vulnerability in Microsoft 365 Copilot ([CVE-2025-32711](https://nvd.nist.gov/vuln/detail/cve-2025-32711)) shows that a single email with concealed prompt-injection instructions is sufficient to force the AI assistant to exfiltrate internal files and emails to an external server without user interaction.\n\nA series of vulnerabilities (such as [CVE-2026-25253](https://nvd.nist.gov/vuln/detail/CVE-2026-25253)) in OpenClaw, the popular open-source personal AI assistant, created a route for a malicious website to take complete control of the developer’s AI agent.\n\n“More than 21,000 such instances were detected, and the researchers further observed that 12% of the skills marketplace for the OpenClaw platform was distributing malware,” says Dr. Suleyman Ozarslan, VP of Picus Labs at Picus Security, a specialist in breach and attack simulation.\n\nSecurity researchers at [Varonis discovered an attack against Microsoft Copilot Personal](https://www.varonis.com/blog/reprompt) that sidestepped built-in AI safeguards simply by asking for sensitive data twice.\n\nThe [Reprompt vulnerability](https://www.csoonline.com/article/4117792/one-click-is-all-it-takes-how-reprompt-turned-microsoft-copilot-into-data-exfiltration-tools.html) — which effectively turned Microsoft Copilot into a data exfiltration tool — was reported to Microsoft, which has responded by issuing a patch.\n\n[Anthropic caught threat actors abusing Claude Code](https://www.anthropic.com/news/disrupting-AI-espionage) to manage operational tasks in a cyber-espionage campaign in September 2025.\n\nA suspected Chinese state-sponsored group designated GTG-1002 [used Claude Code to execute 80-90% of tactical operations independently](https://www.csoonline.com/article/4090117/anthropics-ai-used-in-automated-attacks.html), at physically impossible request rates for human operators.\n\nAttackers abused the AI agentic capabilities of Claude Code to automate the process of scripting, target research, building attack tooling, and other functions.\n\n“The attackers decomposed their operation into thousands of small, individually innocuous tasks, combined with role-play framing that convinced the model it was operating as part of a legitimate security assessment,” explains Yagub Rahimov, CEO at cybersecurity startup Polygraf AI.\n\nMiscreants abused an AI agent dubbed [Jadepuffer](https://www.csoonline.com/article/4193195/this-ai-agent-autonomously-hacked-a-network-adapted-on-the-fly-and-demanded-a-ransom.html) to run an end-to-end ransomware and extortion campaign in July 2026.\n\nInitial access was gained by exploiting a vulnerability in Langflow, an AI orchestration tool, before privilege elevation and the deployment of Encforge, ransomware that targets and encrypts roughly 180 AI-related file extensions. The attack ultimately targeted a victim’s production database server.\n\nThis wasn’t the first fully autonomous cyberattack, but it was the first documented [ransomware campaign run end-to-end by an agentic threat actor](https://www.sysdig.com/blog/jadepuffer-agentic-ransomware-for-automated-database-extortion), according to cloud security vendor Sysdig.\n\n“It destroyed a production database, wrote the ransom note, and went from failed login to working fix in 31 seconds,” says Crystal Morin, senior cybersecurity strategist at Sysdig.\n\nThreat actors are now prioritizing assaults against AI tools and infrastructure due to their high value.\n\nBy compromising an AI infrastructure attackers gain access to LLM provider keys, cloud credentials, data, and myriad connections.\n\n“To get in, they [attackers] often scan for vulnerabilities and, as soon as one is live, use AI to turn advisories and disclosures into exploits,” says Sysdig’s Morin. “In many instances, we’ve seen the mean time to exploit [MTTE] drop to just hours, like with the [Marimo](https://www.exploit-db.com/exploits/52673) and [PraisonAI](https://www.sysdig.com/blog/cve-2026-44338-praisonai-authentication-bypass-in-under-4-hours-and-the-growing-trend-of-rapid-exploitation) CVEs.”\n\nMaintainers of industrial control systems have begun adopting AI technologies to increase the efficiency of their operations.\n\nInitially industrial AI was an advisor. If a model predicted a failure or suggested a better setpoint then it would still be up to a human operator to decide what to do. This is now changing with operators adopting more autonomous, agentic AI technologies.\n\n“ML models and AI agents now write setpoints back to control systems to optimize energy, yield and throughput, often every few minutes and without a human approving each change,” says Thomas Plank, CEO of industrial cybersecurity specialists Tributech. “Protocols such as MCP are accelerating this, because they give LLMs and agent frameworks a standard way into live OT [operational technology] and IoT [internet of things] data.”\n\nThese changes are opening up new attack surfaces.\n\n“Once AI acts on a physical process, attackers no longer need to compromise the controller, they can live off the AI’s own authorized access,” Plank warns.\n\nOne attack scenario would involve poisoning the data the AI acts on so that decisions are made against manipulated sensor data rather than actual readings.\n\n“If values are tampered with, stale or simply wrong, the model makes a wrong decision with full confidence,” Plank explains. “An attacker does not need to touch the AI at all; changing the data it reads, or the data it was trained on, is enough.”\n\nPlank concludes: “In a closed loop, that wrong decision becomes a physical action.”\n\nThreat actors have been stealing stolen AI computing resources since early 2024, a form of attack known by some as LLMjacking.\n\nAttackers began LLMjacking to resell access but more recently some have moved onto using stolen resources to build malicious tools.\n\nFor example, in June 2026 the Sysdig Threat Research Team documented an [operator using a victim’s exposed, abliterated Ollama model to build an autonomous offensive framework](https://www.sysdig.com/blog/llmjacking-evolved-attackers-are-using-stolen-ai-compute-to-build-offensive-agentic-tools).\n\nThe threat landscape has shifted from abusing chatbots to building dedicated, weaponized AI stacks like Xanthorox AI.\n\nUnlike general-purpose LLMs, Xanthorox is a purpose-built offensive platform designed specifically for cybercrime. The platform features modules for functions such as malware generation and vulnerability exploits.\n\n“Hexstrike AI MCP integration allows Xanthorox to move beyond mere ‘assisted’ hacking into the realm of fully autonomous agent systems, moving it into the realm of ‘vibe hacking,’” says Radware’s Geenens. Hexstrike is an open-source, AI-powered offensive security framework originally designed for ethical penetration testing.\n\nZbyněk Sopuch, CTO of cybersecurity vendor Safetica, says that many attackers are no longer just exploiting software vulnerabilities, preferring instead to exploit the trust organizations place in AI.\n\n“This means security teams need to treat AI assistants the same exact way they treat human privileged users: with tight control, specific monitoring, and most importantly, never assume anyone or anything to be safe,” Sopuch concludes.", "url": "https://wpnews.pro/news/10-ways-attackers-abuse-ai-services-to-hack-your-business", "canonical_source": "https://www.csoonline.com/article/4154222/6-ways-attackers-abuse-ai-services-to-hack-your-business.html", "published_at": "2026-10-28 08:25:00+00:00", "updated_at": "2026-10-28 08:45:34.637673+00:00", "lang": "en", "topics": ["ai-safety", "ai-agents", "agent-protocols", "ai-tools"], "entities": ["Postmark", "ActiveCampaign", "Model Context Protocol", "Helmet Security", "Kaushik Shanadi", "Radware", "Pascal Geenens", "Jozu"], "also_reported_by": [], "alternates": {"html": "https://wpnews.pro/news/10-ways-attackers-abuse-ai-services-to-hack-your-business", "markdown": "https://wpnews.pro/news/10-ways-attackers-abuse-ai-services-to-hack-your-business.md", "text": "https://wpnews.pro/news/10-ways-attackers-abuse-ai-services-to-hack-your-business.txt", "jsonld": "https://wpnews.pro/news/10-ways-attackers-abuse-ai-services-to-hack-your-business.jsonld"}}