Timeline
Volume per month and the reports that shaped each year. Must-reads are shown first. Switch to all entries for the full record.
2026
209 entries, 7 must-reads
January
GreyNoiseThreat Actors Actively Targeting LLMs (opens greynoise.io)- Category
- AI-Targeted
Breached.company
Unit 42 (Palo Alto Networks)
Resecurity
February
Snyk
Moonlock Lab
Google Threat Intelligence GroupGTIG AI Threat Tracker: Distillation, Experimentation, and (Continued) Integration of AI for Adversarial Use (opens cloud.google.com)- Category
- AI-Enabled
- Marker
- Must-read
ESET Research
Amazon Threat Intelligence
Hunt.io / cyberandramen.net
TrendAI Research
OpenAIDisrupting malicious uses of AI (opens openai.com)- Category
- AI-Enabled
- Marker
- Must-read
March
Moonlock Lab- Palo Alto Networks Unit 42
IBM X-ForceA Slopoly start to AI-enhanced ransomware attacks (opens ibm.com)- Category
- AI-Enabled
- Unit 42
Datadog Security Labs
April
SekoiaEvilTokens: an AI-augmented phishing kit for automating BEC fraud (opens sekoia.com)- Category
- AI-Enabled
- Marker
- Must-read
Gambit Security
OWASP GenAI Security ProjectOWASP GenAI Exploit Round-up Report Q1 2026 (opens genai.owasp.org)- Category
- AI-Targeted
Validin
Abnormal AI
Google
May
Cloud Security Alliance
Microsoft Security
Trend Micro- Google Threat Intelligence Group
EclecticIQ- Trend Micro
Straiker
PermisoChatGPhish: The Page Is the Payload (opens permiso.io)- Category
- AI-Targeted
June
Anthropic
FortiGuard LabsThreat Actors Weaponize AI Hype to Deliver AsyncRAT (opens fortinet.com)- Category
- AI-Enabled
Help Net Security- SekoiaAPT28: An Evolution of Tradecraft from X-Agent to LLM Malware (opens sekoia.com)
- Category
- AI-Targeted
- Marker
- Must-read
July
Sysdig
Zscaler ThreatLabz- MoonlockNew Gaslight malware evades AI analysis (opens moonlock.com)
- Category
- AI-Targeted
Flare
Elastic Security Labs
Tel Aviv University
Hunt.io- ZscalerClaudeFix: Shared Claude Chats Meet ClickFix (opens zscaler.com:443)
- Category
- AI-Enabled
Hugging FaceSecurity incident disclosure , July 2026 (opens huggingface.co)- Category
- AI-Targeted
Darkatlas
SophosAI Security 2026 (opens assets.sophos.com)- Category
- AI-Enabled
Huntress- Anthropic
August
Cyber Insurance News
Genians Security Center
Pillar SecurityDeadbugz: Currently Active MCP Supply-Chain Campaign (opens pillar.security)- Category
- AI-Targeted
SpecterOps
Cisco Talos
CyeraFirst Alert 4 (KMOV)
Trail of BitsVMs won't contain cyber-capable agents (opens blog.trailofbits.com)- Category
- AI-Enabled
- Gambit Security
- Huntress
- Unit 42
September
Unit 42- Genians
Gen DigitalInfostealers Have Found a New Target: Your AI Agent (opens gendigital.com)- Category
- AI-Targeted
JFrog Security Research- JFrog Security Research
SentinelOne
Sophos
ASEC (AhnLab Security Emergency response Center)August 2026 Threat Trend Report on APT Groups (opens asec.ahnlab.com)- Category
- AI-Enabled
- AnthropicDetecting and countering misuse of AI: September 2026 (opens anthropic.com)
- Category
- AI-Enabled
- Marker
- Must-read
heyitsas.im
CNN- GreyNoise
Check Point Research21st September - Threat Intelligence Report (opens research.checkpoint.com)- Category
- AI-Targeted
- Cisco Talos
- Cisco Talos
- Gambit Security
- HuntressAI Attacks Move Faster. Huntress' Agentic SOC Keeps Up (opens huntress.com)
- Category
- AI-Enabled
SpyCloud
Team CymruLLM Gateways: How They Enable Frontier Model Abuse (opens team-cymru.com)- Category
- AI-Targeted
The Record
ThreatDownCARBONATO: a botnet built around an AI agent (opens threatdown.com)- Category
- AI-Enabled
Zimperium
Group-IB
Socket
Transluce- Datadog Security Labs
Zenity Labs
Krebs on Security- Microsoft Security Blog
- Check Point Research28th September - Threat Intelligence Report (opens research.checkpoint.com)
- Category
- AI-Enabled
Cleafy- Huntress
- AnthropicGLM-5.3 and the spread of advanced cyber capabilities (opens anthropic.com)
- Category
- AI-Enabled
arXiv- Jose Enrique Hernandez (X/Twitter)
- Google Threat Intelligence Group
October
Abstract Security- Cisco TalosThe Fine Art of Frustrating the Adversary (opens blog.talosintelligence.com)
- Category
- AI-Targeted
OpenSourceMalware
The OpenSourceMalware Show #23 (opens opensourcemalware.com)- Category
- AI-Enabled
- Check Point Research5th October - Threat Intelligence Report (opens research.checkpoint.com)
- Category
- AI-Enabled
GitLab- Help Net Security
- MicrosoftMicrosoft Digital Defense Report 2026 (opens microsoft.com)
- Category
- AI-Targeted
Wikimedia Foundation- Datadog Security Labs
- Flare
SOCRadarswarmcha.se
We found a Chinese agent fleet (opens swarmcha.se)- Category
- AI-Enabled
CrowdStrike- Cisco TalosOne breach, please, and make no mistakes (opens blog.talosintelligence.com)
- Category
- AI-Enabled
Hudson Rock- Microsoft Security Blog3 lessons from frontier AI vulnerability research (opens microsoft.com)
- Category
- AI-Enabled
Black Lotus Labs (Lumen)Canto incognito: tracking the PoeLLM malware (opens lumen.com)- Category
- AI-Targeted
- Cisco Talos
- Cisco Talos
- OpenAIDisrupting AI-enabled “false front” operations (opens openai.com)
- Category
- AI-Enabled
Spectrum SecuritySyed Anas Mohiuddin (Independent Security Researcher)
Protocol Pivoting, Four Months Later (opens anas-security-portfolio.vercel.app)- Category
- AI-Targeted
- Zenity Labs
- Zscaler ThreatLabz
- Anthropic
- The OpenSourceMalware Show #24 (opens opensourcemalware.com)
- Category
- AI-Targeted
Unit 42
rogueauthority.org
The Register
AIR SecurityVerCellBreak: How we escaped Vercel's hardened sandbox (opens air.security)- Category
- AI-Targeted
- Check Point Research12th October - Threat Intelligence Report (opens research.checkpoint.com)
- Category
- AI-Enabled
- Genians
- SOCRadarInside ICMacOS: From an Infostealer to a Persistent RAT (opens socradar.io)
- Category
- AI-Enabled
- Check Point Research
Signals CorpsWhat llms.txt files tell AI agents (opens signalscorps.com)- Category
- AI-Targeted
- ASEC (AhnLab)
- ASEC
ReliaQuest- Team Cymru
- Datadog Security Labs
Forescout- Google Threat Intelligence GroupARMORY CASTLE Exploits BeyondTrust (opens cloud.google.com)
- Category
- AI-Targeted
- Hunt.io
Symantec
- Unit 42
CloudWave- OpenCode
Security Affairs- Check Point Research19th October - Threat Intelligence Report (opens research.checkpoint.com)
- Category
- AI-Targeted
- Datadog Security Labs
NorForge
PrevidianCVE-2026-105740 Exploitation Observed , langflow (opens previdian.com)- Category
- AI-Targeted
- SekoiaA honeypot's tale: Deconstructing an attack on GenAI infrastructure (opens sekoia.com)
- Category
- AI-Targeted
- Marker
- Must-read
agentgateway- Check Point Research
- Flare
- SOCRadar
Wiz- CloudWave
- CrowdStrike
JPCERT/CC- Microsoft Security Blog
Securelist (Kaspersky)
SecurityWeek- Straiker
- Unit 42
- Zscaler ThreatLabzInside a Global AI-Assisted Hacking Campaign (opens zscaler.com:443)
- Category
- AI-Enabled
BlackFog
AI Security InstituteInvestigating alignment failures in AISI’s incident (opens aisi.gov.uk)- Category
- AI-Targeted
- OpenAISecuring our frontier model training environment (opens openai.com)
- Category
- AI-Targeted
VirusTotal
CohereConcerning behavior from a popular open-weight AI model (opens cohere.com)- Category
- AI-Targeted
- Flare
- Help Net Security
- Help Net Security
PlaintextHacking Back AI Pentesting Agents (opens plaintext.do)- Category
- AI-Targeted
SecurityBreak Research- ASEC
- Check Point Research
GitGuardian- Trend Micro
Forever Security
- SOCRadar
- Unit 42
- Cisco Talos Intelligence Group
- Cisco Talos
- CrowdStrike
- CrowdStrike
- Microsoft
Nextron Systems- Group-IB
- SophosAI used in Aur0ra ransomware testing and execution (opens sophos.com)
- Category
- AI-Enabled
- Unit 42
- Zimperium
- Cisco Talos
Profero
November
Censys- Check Point Research2nd November - Threat Intelligence Report (opens research.checkpoint.com)
- Category
- AI-Enabled
- Google Threat Intelligence Group
- CyberStrikeAI attacks educational institutions (opens securelist.com)
- Category
- AI-Enabled
RST Cloud- Unit 42
- Binance
Bitdefender- Check Point Research
Acronis Threat Research Unit
Group-IB- Hunt.io
WorkOSOctober 30th, 2026 Data Security Incident (opens workos.com)- Category
- AI-Enabled
No must-read recorded for 2026. Use “Show all entries” to see the full record.
2025
37 entries, 5 must-reads
January
- Trend MicroInvisible Prompt Injection: A Threat to AI Security (opens trendmicro.com)
- Category
- AI-Targeted
- Google DeepMind
- Google Threat Intelligence GroupAdversarial Misuse of Generative AI (opens cloud.google.com)
- Category
- AI-Enabled
- Marker
- Must-read
Wiz Research- Abnormal AIHow GhostGPT Empowers Cybercriminals with Uncensored AI (opens abnormal.ai)
- Category
- AI-Enabled
- Unit 42
February
- Unit 42
April
Anthropic
- Unit 42, Palo Alto Networks
May
- EclecticIQ
June
- SecurityWeek
- Zscaler ThreatLabz
- Check Point Research
- Cisco Talos
July
guardsix
August
The Hacker News- ESET Research
- AnthropicThreat Intelligence Report: August 2025 (opens anthropic.com)
- Category
- AI-Enabled
- Marker
- Must-read
September
NetskopeSecuring LLM Superpowers: When Tools Turn Hostile in MCP (opens netskope.com)- Category
- AI-Targeted
- Malicious MCP servers used in supply chain attacks (opens securelist.com)
- Category
- AI-Targeted
- Unit 42 (Palo Alto Networks)
- Genians
- A new RevengeHotels campaign targets Latin America (opens securelist.com)
- Category
- AI-Enabled
Dataconomy
Koi Security- ESET Research
October
- OpenAIDisrupting malicious uses of AI: October 2025 (opens openai.com)
- Category
- AI-Enabled
VolexityAPT Meets GPT: Targeted Operations with Untamed LLMs (opens volexity.com)- Category
- AI-Enabled
- SekoiaTransparentTribe Targets Indian Military with DeskRAT Malware (opens sekoia.com)
- Category
- AI-Targeted
- Marker
- Must-read
November
- Google Threat Intelligence GroupGTIG AI Threat Tracker: Advances in Threat Actor Usage of AI Tools (opens cloud.google.com)
- Category
- AI-Enabled
- Marker
- Must-read
Infosecurity Magazine- AnthropicDisrupting the first reported AI-orchestrated cyber espionage campaign (opens anthropic.com)
- Category
- AI-Enabled
- Marker
- Must-read
- NetskopeThe Future of Malware is LLM-powered (opens netskope.com)
- Category
- AI-Enabled
- Unit 42
December
- Unit 42 (Palo Alto Networks)
- HuntressAI-Poisoning & AMOS Stealer: The Biggest Mac Threat (opens huntress.com)
- Category
- AI-Enabled
No must-read recorded for 2025. Use “Show all entries” to see the full record.
2024
17 entries, 1 must-read
February
- Trend Micro
- Microsoft Threat IntelligenceStaying ahead of threat actors in the age of AI (opens microsoft.com)
- Category
- AI-Enabled
- Marker
- Must-read
May
OpenAI
AI and Covert Influence Operations: Latest Trends (opens cdn.openai.com)- Category
- AI-Enabled
June
- Google Threat Analysis Group
July
FBI- Mandiant
- Trend Micro
August
- Trend Micro
The CyberWireBlack Basta and the Use of LLMs by Threat Actors (opens thecyberwire.com)- Category
- AI-Enabled
- Unit 42
September
Knostic
October
- Permiso
- Unit 42 (Palo Alto Networks)
November
- Unit 42
December
- Trend MicroLink Trap: GenAI Prompt Injection Attack (opens trendmicro.com)
- Category
- AI-Targeted
- Unit 42
- Unit 42 (Palo Alto Networks)
No must-read recorded for 2024. Use “Show all entries” to see the full record.
2023
9 entries, 0 must-reads
January
- Check Point Research
Recorded FutureI, Chatbot (opens recordedfuture.com)- Category
- AI-Enabled
February
Check Point Research- IoC detection experiments with ChatGPT (opens securelist.com)
- Category
- AI-Targeted
May
- Recorded FutureI Have No Mouth, and I Must Do Crime (opens recordedfuture.com)
- Category
- AI-Enabled
June
- Unit 42
July
NetenrichFraudGPT: The Villain Avatar of ChatGPT (opens netenrich.com)- Category
- AI-Enabled
August
LevelBlue (SpiderLabs)WormGPT and FraudGPT - The Rise of Malicious LLMs (opens levelblue.com)- Category
- AI-Enabled
December
- Recorded Future
No must-read recorded for 2023. Use “Show all entries” to see the full record.