TL;DR

Researchers at Cisco Talos examined prompt logs and artefacts pulled from threat-actor endpoints running Claude Code, Codex, Cursor and Gemini. Their finding is that model safeguards offer little resistance to anyone willing to reframe a request. Claiming you own the servers being targeted, or that the work is a capture-the-flag exercise or bug bounty, was frequently sufficient — and no proof was ever required.

What stands out is the absence of technique. Talos reported encountering no sophisticated encoding or trickery; most of the time an attacker asserted permission and the model went along with it. Where guardrails did intervene, the researchers judged they achieved little.

Beyond bare assertion, three patterns recur. Attackers spread work over many separate sessions and documents so that no single request carries enough context to trip a protection tuned to spot broader malicious intent. They condition a model’s persona by planting memories, markdown files and system-level prompts. And the researchers singled out malicious use of a red-teaming framework called Hephaestus, first reported by Oasis Security in May, which can carry an intrusion through to persistence without human input — its operators avoided refusals by describing actions in neutral verbs rather than overtly hostile ones.

There is a limit to the alarm. Talos concluded AI is a force multiplier for skilled operators rather than a leveller: unsophisticated actors produce projects that technically work but hit a ceiling they lack the expertise to push past. Capable attackers, by contrast, have gone further than the researchers expected.

Looking Forward

The defensive advice is uncomfortable but consistent: security teams should be deploying agents the way attackers already are, because alert volumes will require triage that analysts cannot do by hand. CrowdStrike puts the increase in attacks by AI-enabled adversaries at 89% over the past year, with practical patching windows compressed to 24 to 48 hours. Read alongside the UK AI Security Institute’s disclosure this week — where an agent with its cyber classifiers deliberately switched off social-engineered a real maintainer — the picture is of safeguards that assume good-faith use in a market where that assumption is now the exception.