Sophos report reveals AI transforming cybercrime with compressed attack timelines

AI Transforming Cybercrime Through Speed and Efficiency

Sophos has released its AI Security 2026 Report, revealing that cybercrime is undergoing a fundamental shift as attackers operationalize artificial intelligence to compress attack timelines from weeks to mere days1

1

2

2

. The research, based on findings from Sophos X-Ops MDR casework, SophosLabs analysis, and observations across more than 625,000 customers worldwide, demonstrates that AI security threats are no longer speculative but actively deployed in criminal operations1

1

. "Attackers still need initial access, still move laterally, and still exfiltrate through observable channels. What has changed is the clock," said John Peterson, Chief Technology Officer at Sophos2

2

.

First Documented Case of AI as a Force Multiplier

In one of the report's most significant findings, Sophos uncovered campaign STAC6994, representing one of the first provable demonstrations of attackers actively using AI agents to drive operations2

2

. The threat actor operated a software development operation inside a customer's network, deploying approximately 12 AI agents to write and test attacks against endpoint security tools including Sophos, CrowdStrike, and Microsoft Defender1

1

. These AI agents produced nearly 80 modules and more than 70 evasion techniques, turning what would have taken human operators weeks into just a few days2

2

. This dramatically accelerated timeline means security teams face shorter windows to detect and contain activity before impact, with greater pressure on defenders to respond to compressed attack timelines.

Ungoverned AI Identities Emerge as High-Value Targets

The report identifies enterprise AI adoption as the fastest-growing source of new exposure, with ungoverned AI identities becoming a critical vulnerability2

2

. As coding agents, assistants, and open-weight models gain privileged access to core systems, attackers are targeting OAuth tokens, AI service credentials, developer tools, and exposed AI infrastructure1

1

. This demonstrates that AI security is now as much an identity, governance, and supply chain issue as it is a model security issue2

2

. The shift is also reflected in the recent Sophos 2026 State of Ransomware report, which showed that for the first time in more than three years, identity has become the primary initial access vector1

1

.

AI-Assisted Social Engineering and Deepfakes Become Operational

AI-assisted social engineering and deepfakes are making scams more scalable, convincing across languages, and significantly cheaper to produce2

2

. The report highlights an AI-themed investment scam that drew a UK-based victim into a fake AI-powered investment platform through months of coordinated messaging and AI-themed lessons, ultimately resulting in losses of hundreds of thousands of pounds1

1

. Threat actors are incorporating AI into underground markets, recruitment, prompt engineering, jailbreaking, malware development workflows, and criminal services2

2

.

Supply Chain Risks and Infrastructure Targeting Intensify

AI development infrastructure is being targeted directly with attacks involving compromised developer tools and credential-stealing malware1

1

. Supply chain risks around model weights, training data provenance, MCP servers, and inference infrastructure are becoming more prolific2

2

. "As frontier models continue to advance, the next few months will be defined by how quickly organizations can govern AI use, secure the identities and connections around it, and keep pace with attackers who are capable of rapidly adopting new capabilities," Peterson noted1

1

. Organizations must prioritize securing AI identities, implementing robust governance frameworks, and monitoring for signs of AI-accelerated attacks to stay ahead of threats that are already operational.