FBI Reports AI Use by Threat Actors in Broader Cyber Context Including Infrastructure Intrusions

FBI Deputy Assistant Director Cynthia Kaiser stated that adversarial actors, particularly those affiliated with China and organized cybercriminal groups, are increasingly integrating AI tools across the cyberattack lifecycle, with documented use cases reportedly including purported AI-generated spear phishing, business identity fabrication, internal network mapping, and deepfake-enabled fraud. The tools are allegedly already assisting intrusions targeting U.S. infrastructure.

Risk classification

• Primary risk domain: 4 Malicious actors
• Primary risk subdomain: 4.2 Cyberattacks, weapon development or use, and mass harm

The primary threat described is the use of AI systems, specifically Anthropic's coding tools, by state-backed hackers to develop autonomous agents and conduct sophisticated cyberespionage campaigns against critical infrastructure and major corporations.

Additional risk subdomains

• 4.3 Fraud, scams, and targeted manipulation: Criminals are using deepfake videos and voice clones to impersonate CEOs and swindle millions of dollars from businesses through targeted wire-transfer scams.
• 2.1 Compromise of privacy by obtaining, leaking or correctly inferring sensitive information: The autonomous AI agents were used to target, locate, and compromise sensitive datasets belonging to government agencies and private corporations.

Causal factors

• Entity: Human
• Intent: Intentional
• Timing: Post-deployment

The incident was caused by human malicious actors (state-backed hackers and cybercriminals) intentionally abusing deployed commercial AI systems to conduct cyberattacks and financial fraud.

EU AI Act risk tier

• Risk tier: 2 High Risk

High Risk: The report describes AI systems being integrated into cyberespionage campaigns targeting critical infrastructure (telecommunications, energy, and water networks), which falls under the High Risk category of the EU AI Act.

AI system and alleged parties

• AI system: unspecified
• AI purpose: Code Generation; Technical Text Generation
• Behaviour type: Agent
• Alleged developer: Unknown generative AI developers
• Alleged deployer: Government of China, Chinese Communist Party
• Alleged harmed parties: United States critical infrastructure, Private companies, Government agencies, Employees targeted by phishing, Employees targeted by deepfake impersonations

Harm severity

Severity ratings are based on this scale.

Highest direct severity in any category: Substantial. Severity is scored from Negligible to Catastrophic in each harm category, for harm the reports describe as caused directly or indirectly by the AI system.

• Physical: direct Negligible, indirect Negligible
• Infrastructure: direct Negligible, indirect Minor
• Property: direct Negligible, indirect Negligible
• Financial: direct Negligible, indirect Substantial
• Environmental: direct Negligible, indirect Negligible
• Malicious content: direct Minor, indirect Negligible
• Differential treatment: direct Negligible, indirect Negligible
• Civil rights: direct Negligible, indirect Negligible
• Democracy: direct Negligible, indirect Negligible
• Privacy: direct Substantial, indirect Severe
• Psychological: direct Negligible, indirect Negligible
• Epistemic: direct Minor, indirect Negligible
• Child sexual exploitation and abuse: direct Negligible, indirect Negligible

Infrastructure

Reported: The report explicitly describes Chinese government-backed crews targeting and compromising critical infrastructure networks, though physical destruction is not reported.

Indirectly caused: Chinese state-backed groups compromised and burrowed into US critical infrastructure facilities, including telecommunications, energy, and water networks.

Inferred additional harm: While no immediate physical damage was reported, the persistent access gained by hackers poses a severe latent risk of future infrastructure disruption or shutdown.

Financial

Reported: The report explicitly describes financial losses, noting that criminals are using deepfake videos to swindle millions from businesses.

Indirectly caused: Businesses lost millions of dollars due to deepfake-enabled wire transfer scams and executive impersonation.

Inferred additional harm: Victim organizations likely incurred substantial unquantified costs related to incident response, cybersecurity remediation, and system patching following the espionage campaigns.

Malicious content

Reported: The report explicitly describes the creation of malicious content, specifically fictitious business profiles and highly convincing spear-phishing messages.

Directly caused: Large language models were used to generate believable spear-phishing messages and fake profiles at scale to facilitate social engineering campaigns.

Inferred additional harm: A large number of corporate and government employees were likely exposed to highly sophisticated phishing emails generated by these AI tools.

Privacy

Reported: The report explicitly describes privacy violations resulting from cyberespionage campaigns targeting sensitive datasets.

Directly caused: AI agents were used to locate and compromise target datasets containing proprietary or sensitive information from tech companies, financial institutions, and government agencies.

Indirectly caused: The compromise of nine US telecommunications networks by Salt Typhoon exposed sensitive communication data.

Inferred additional harm: The personal data and communications of millions of telecom customers and corporate employees were likely exposed or accessed during these espionage campaigns.

Epistemic

Reported: The report explicitly describes epistemic harm through the use of deepfake videos and voice clones to impersonate trusted individuals.

Directly caused: Deepfake videos and voice clones were used to fabricate realistic executive communications, leading employees to believe they were interacting with their actual CEOs.

Inferred additional harm: The proliferation of highly realistic deepfakes is likely to erode general trust in digital communications and corporate verification processes.

People affected

• Occurrences reported: 1
• People reportedly exposed: 1000000

Potential causes

Management

• CISA Workforce Reductions: One-third staff cut and high vacancy rates gutted federal cyber posture.
• Lack of Stable Leadership: Absence of confirmed directors at CISA and NSA left strategy in limbo.
• Underestimating AI Threats: Federal attention wandered from critical cyber espionage and AI threats.

Technology

• Abuse of AI Coding Tools: Hackers abused Anthropic's coding tool to build autonomous espionage agents.
• Vulnerable AI Browsers: AI browsers with access to sensitive data can be hijacked by outsiders.
• AI-Enabled Target Mapping: AI helps adversaries map victim networks more effectively after initial entry.

Data Inputs

• Vast Code Repositories: AI analyzes vast amounts of code to find logic flaws and vulnerabilities.
• Exposed Personal Data: AI browsers access corporate data, creating targets for hijacking.
• Target Datasets: Autonomous AI agents successfully located and exploited target datasets.

Human Factors

• Lack of Human Oversight: Autonomous AI agents ran espionage campaigns with little human oversight.
• Susceptibility to Deepfakes: Employees easily fooled by AI-generated deepfake videos of executives.
• Social Engineering Vulnerability: Believable spear-phishing messages crafted using LLMs trick targets.

Process and Methods

• Unpatched Software Vulnerabilities: AI tools easily find and exploit unpatched vulnerabilities in target systems.
• Inadequate Verification Processes: Lack of multi-factor authentication or safe words to verify deepfakes.
• Tricked Client-Side AI Programs: Victim's AI programs tricked into performing tasks like revealing passwords.

Regulatory Environment

• Rollback of Telecom Standards: FCC dropped security standards, leaving critical networks unsecured.
• Lack of Government Guidelines: Few guidelines exist as companies roll out risky AI features like AI browsers.
• Stalled Foreign Product Bans: Bans on risky foreign tech stalled at high levels during trade talks.

Information quality

• Classification confidence: High
• Reason for confidence: The reports provide detailed, authoritative accounts from the FBI and Anthropic regarding the specific methods and targets of the AI-driven cyberattacks. The descriptions of the autonomous agents and deepfake scams are clear and directly map to the taxonomy classifications.
• Ambiguities identified: The exact technical specifications of the autonomous agents developed using Anthropic's tools are not fully detailed due to security classifications.
• Alternative interpretations: The incidents could be viewed as traditional cyberespionage where AI is merely an incremental tool, rather than an AI-driven safety incident, but the autonomous nature of the agents supports the AI-centric classification.

Chinese state-backed hacking groups successfully integrated autonomous AI agents and deepfake technology into cyberespionage campaigns targeting US critical infrastructure, government agencies, and financial sectors. This represents a severe national security threat, compounding vulnerabilities in telecommunications, energy, and water networks.

• Overall national security impact: Severe
• Scope: Single nation
• Primary target: United States
• Alleged perpetrator: China

Threat characteristics

• Imminence: Near-term. Active and evolving campaign requiring constant monitoring as state-backed actors continue to integrate AI into cyberattack lifecycles.
• Autonomy: Full autonomy. AI agents autonomously scanned for targets, identified vulnerabilities, and executed espionage tasks with minimal human intervention.
• Novelty: Evolved capability. Represents a significant advancement of existing cyberespionage tactics through the integration of autonomous AI agents and deepfakes.

Impact by dimension

• Physical security: Severe. State-backed actors used autonomous AI agents to target and compromise critical infrastructure networks including telecommunications, energy, and water, posing a severe threat to national physical security.
• Information security: Severe. AI-driven espionage campaigns compromised government agencies and nine US telecommunications networks, exposing highly sensitive communications and data to foreign adversaries.
• Sovereignty: Substantial. Foreign state-backed actors targeted government decision-making networks and federal agencies, exploiting gaps exacerbated by a 30 percent CISA staff reduction.
• Economic security: Substantial. Deepfake technology was used to swindle millions from businesses, while AI cyberagents targeted proprietary datasets of major financial and tech corporations.
• Societal stability: Minor. The compromise of telecom networks exposed private communications of numerous citizens, though it did not result in direct civil unrest or systemic oppression.