Evidence
One criminal with a coding agent extorted 17 organizations
| Date | Case | Country | What happened | Source |
|---|---|---|---|---|
| Aug 2025 | GTG-2002 "vibe hacking" extortion | Global | One criminal used Claude Code for data theft and extortion against at least 17 organizations | Source |
| Sep 2025 | GTG-1002 espionage | China | State-sponsored group ran 80% to 90% of an intrusion campaign through an agent | Source |
| Jan 29, 2026 | Ming family executions | China and Myanmar | 11 members of a Laukkaing scam clan executed after fraud above CNY 10 billion | Source |
| Jul 21, 2026 | UNODC regional crime report | Southeast Asia | $88.3 billion to $114.1 billion in scam losses; AI and deepfakes documented | Source |
| 2025 | Georgia prison drone surge | United States | 373 drone incidents, rising from 17 in January to 63 a month by autumn | Source |
Registry
Three registry incidents involve criminal use of agents
Registry incidents meet a stricter bar than the cases above: public sources name the developer, the failed control and who found it.
| Incident | Date | Agent | Control that failed |
|---|---|---|---|
| Stolen Drift Tokens Drain Salesforce Data | Aug 2025 | AI chat agent integration | Broad OAuth tokens held by an AI chat agent |
| Nx Malware Turns AI Coding Tools Against Their Users | Aug 2025 | Coding agents (Claude Code, Gemini CLI, Amazon Q) | Permission prompts skipped by command-line flags |
| Chinese State Group Runs Espionage Through Claude Code | Sep 2025 | Coding agent | Misuse safeguards bypassed by splitting attacks into routine-looking tasks |
Exposure
Eight of 17 agent types rate very significant or critical on identity and authentication or integrations and permissions
From the attack surface ratings, the agent types where this risk has the widest path in.
| Agent type | Dimension | Rating |
|---|---|---|
| Workflow agents | Integrations and permissions | Critical |
| Enterprise agents | Integrations and permissions | Critical |
| Robotaxis and autonomous vehicles | Identity and authentication | Very significant |
| Fleets and swarms | Identity and authentication | Very significant |
| Phones and tablets | Integrations and permissions | Very significant |
| Smart home assistants | Integrations and permissions | Very significant |
| Coding and research agents | Integrations and permissions | Very significant |
| Commerce agents | Integrations and permissions | Very significant |
Controls that bound it
- Monitoring and Anomaly Detection: seeing failures and misuse while they happen
- Identity and Cryptographic Attestation: who or what is acting, proven cryptographically
- Access Control and Permissions: what an agent can reach and on whose authority
Rules
Fraud law, not AI law, carries most enforcement
| Rule | Jurisdiction | What it requires | Status |
|---|---|---|---|
| Anti-Telecom and Online Fraud Law | China | Carrier, bank and platform anti-fraud duties | Effective Dec 1, 2022 |
| EU AI Act systemic-risk model duties | EU | Evaluate and mitigate risks including cyber offense | From Aug 2, 2025 |
| Take It Down Act | US | Criminalizes nonconsensual AI intimate images | Signed May 2025 |
Status colors: green in force, blue voluntary standard or framework, amber adopted and phasing in, gray draft or pending, red withdrawn.
Record
Page Record
- Risk group
- Human Risks
- Datasets
- ai_risk_evidence.csv (5 rows); registry incidents (3 linked); ai_attack_surface.csv
- Key sources
- GTG-2002 "vibe hacking" extortion
GTG-1002 espionage
Ming family executions
UNODC regional crime report
Georgia prison drone surge - Last verified
- October 2026