How we grade an incident
An incident is one real operation against real targets where attackers used AI, or where credible evidence says they almost certainly did. 95 meet that bar today. Each one gets a grade for how strong the evidence of AI use is, which is a separate question from how bad the attack was.
The model provider, the victim, a government, or the primary investigator states that AI was used in this operation, with evidence such as provider telemetry, recovered prompts, or malware that calls an LLM.
A credible security firm or agency attributes AI use from artifacts, such as LLM-written code or comments, but the attribution is an inference rather than direct observation.
The case is reported and AI use is plausible, but the evidence is thin, comes from one secondary source, or rests on the victim's or attacker's own claim.
The model column
We record the model or tool exactly as the source names it, and how we know it. "Stated by vendor" means the model's maker saw the activity on its own platform. "Stated by researcher" means a third party named it from artifacts. "Inferred" means the model is a best guess. "Unspecified LLM" means the source confirms AI use but names no model.
What is in and what is out
- In: intrusions, malware, phishing, fraud and social engineering where AI did part of the work, from January 2023 on, including attempts that were blocked.
- Out: pure influence and propaganda operations with no hacking, vulnerability research with no attacker use, and proof-of-concept tools that never touched a victim.
- Vendor reports are primary sources about their own platforms. They also have reasons to publish, so we quote what they state and grade the claim, not the press coverage.
Attribution
This site makes no attribution of its own. Every actor name is the label the source uses, shown with the source that assigned it, and the grade never goes higher than the source's own wording. A victim is named only when the source names it.
Well-known claims we do not count
- PromptLock, the "first AI ransomware," turned out to be an NYU research prototype that never touched a victim.
- MalTerminal and the Villager framework are AI attack tools with no documented use against a real target.
- Report-wide statistics (for example "four unnamed agentic actors") are not single operations, and influence campaigns with no hacking are out of scope.
- Prompt-injection payloads found on the web with no confirmed hijacked agent are attacks on AI, not attacks using AI.
The data
The full dataset is at /incidents.json. Each record carries the grade, the reason for it, the roles AI played, the models, the model basis, the outcome, a supporting quote and every source URL.