Three incident reports published in 2026 describe attacks as “AI-assisted.” But the evidence behind those claims tells three very different stories.
One asserts AI involvement, another infers it, and the third provides direct visibility into how an attacker actually used AI.
The label tells you what the publisher thinks happened. The artifacts, logs, code, and transcripts are what defenders can actually use. That’s the difference.
Not all evidence is created equal
The three reports illustrate a progression from assertion, to inference, to directly observable AI activity. Each provides useful intelligence, but they establish very different things about AI's role in the attack.
Figure 1
| Evidence | What the publisher shows | Report | What this shows about AI |
|---|---|---|---|
| Asserted | A statement that AI was used. AI-tool filenames, but no activity record. | JPCERT/CC, Oct 21 [1] | The attribution, not how it was established. |
| Inferred | A pattern in the attacker’s output, with the doubt stated. | Cisco Talos, UAT-11985, Oct 8 [2] | A qualified inference about the lures. |
| Observed | The AI use itself: transcripts, logs, configuration. | The DFIR Report, Bissa Scanner, Apr 22 [3] | The AI’s documented tasks, not its full role. |
JPCERT/CC: the unexplained AI claim
JPCERT/CC, Japan’s national computer emergency response team, investigated the servers behind a run of break-ins and data leaks at web services in Japan. A single sentence carries the AI claim: “We confirmed that the attackers had used AI to scan for known vulnerabilities and carry out attacks via APIs.”
Besides the title, that’s the only sentence in the post that mentions AI.
The published evidence centers on familiar attacker techniques: reverse-engineering Android applications to identify API endpoints, analyzing Flutter applications, and using Python scripts to test for server-side request forgery (SSRF).
The published file listing includes .claude/ and .claude.json, but the report provides no corresponding prompts, model logs, or other direct evidence establishing what the AI did.
That limitation does not invalidate JPCERT/CC's conclusion. Investigators may have access to evidence they cannot disclose. But without the underlying artifacts, readers cannot independently evaluate the AI claim or determine what role AI played in the attack.
Cisco Talos: the inference, with the doubt left in
Talos tracked a spear-phishing campaign against people at Taiwan research organizations. UAT-11985 is its label for the actor. The lures were event invitations on different geopolitical topics, built on the identical structure. Talos reads them as “generated from a reusable prompt template rather than independently authored.”
Talos cannot conclusively determine whether a large language model fully generated the emails.
That’s honest. But it’s not where the risk is.
The substantive threat is an adversary-in-the-middle phishing kit that impersonates Google's authentication flow to capture authenticated sessions. It forwards the password, waits for Google’s MFA challenge (the second sign-in step, a code or a phone prompt), shows the victim the matching screen, and relays the answer. The attacker keeps the signed-in session.
Whether AI generated the invitation does not change the defensive priority. The attack exploits weaknesses in authentication workflows, making phishing-resistant MFA, including FIDO security keys and properly configured passkeys, the more consequential control.
Was AI involved? Probably. Does it change what you fix first? No, not at all.
The DFIR Report: the transcripts
The DFIR Report found an exposed server that an operator used to stage and review a mass-exploitation campaign. On it: Claude Code project transcripts, logs from OpenClaw (a local AI-control surface with browser control and a Telegram-linked bot handle), and a script called claude_env_fix.sh. [1] Claude Code is Anthropic’s command-line coding agent.
This is the only one where you can actually watch the AI work.
The recovered transcripts show Claude Code analyzing the scanner's codebase, troubleshooting missed targets, reviewing benchmark results, and planning improvements. They do not establish that the AI independently selected victims or executed exploits against victim systems.
Claude Code and OpenClaw “were used as an operator-side harness supporting exploitation activity and workflow orchestration.”
The operation behind it was not small: more than 900 confirmed compromises, over 30,000 distinct .envfilenames collected. These configuration files frequently contain application secrets, credentials, and API keys. The scanner exploited React2Shell (CVE-2025-55182), a React Server Components vulnerability affecting Next.js applications. Next.js is a widely used web framework. The operator dug deepest into financial, cryptocurrency, and retail targets.
One more detail. Across everything the operator stole, DFIR reports “AI providers emerging as the single largest category” of credentials.
AI on both ends. In the operator’s tooling, and in the haul.
But absence of artifacts isn’t absence of AI. That’s the obvious objection.
JPCERT/CC may hold more than it published. Talos may be right about the template.
And the top rung cuts against overreading too. The published excerpts don’t show the AI touching a victim. By DFIR’s account, it made the operator’s collection and triage more efficient.
The ladder doesn’t say the lower rungs are wrong. It says what each one establishes about AI.
What does each rung let you change?
Don’t make the mistake of reading “AI-assisted” as “new techniques.”
In the DFIR case, AI helped the operator maintain and improve an exploitation pipeline. But the entry point remained a known vulnerability in an internet-facing framework, followed by the harvesting of exposed secrets. AI amplified the operation without fundamentally changing the initial access technique.
This points defenders right back to the boring lists. DFIR’s own recommendations say it:
- Patch internet-facing frameworks on a tight cadence.
- Move secrets out of .env files and into a secret manager.
- Use workload identity instead of long-lived keys.
- Plant canary tokens and decoy credentials that alert the moment a stolen key is used.
Add one more line to that list. AI provider keys are now loot. Inventory and rotate them like any other production secret. Don’t wait for a headline.
Before a report labeled “AI-assisted” has you reconsider your priorities, ask at least three questions:
- What was recovered?
- Who recovered it?
- What was the AI shown doing?
Ask which rung the AI claim sits on before you let the label move anything. Don’t let a headline set your priorities.