AI Hacking Is Real. It’s Still Not How You Got Hacked.

On 4 November, CERT-In published an advisory about an attacker it calls Crafty Falcon, working its way through Indian non-bank lenders, fintech firms, payment aggregators and crypto exchanges. The detail every outlet picked up was AI hacking: the attackers are using publicly available AI penetration-testing tools to run attack chains, in CERT-In’s words, autonomously at machine speed.

It reads like the beginning of a very bad story. So we spent a day checking it, went through the biggest confirmed breaches of 2026 one by one, and found something we did not expect.

AI hacking is real, documented, and happening right now. It is also not how almost anybody actually got broken into this year.

What AI hacking actually looks like in 2026

Start with what is genuinely established, because it is not nothing.

CERT-In’s advisory names four tools — ARTEX, PentAGI, CyberStrikeAI and Cairn. These are real, public, and in use. The attackers entered through internet-exposed testing and staging environments, moved into production using shared credentials, abused AWS management services, and ran ₹1 test transactions before pushing large transfers out. Firms that had been warned in early October and patched incompletely were hit again.

The damage is not hypothetical. Reuters reported two Mumbai-based non-bank lenders losing roughly $2 million across more than 700 unauthorised instant transfers from ICICI-linked accounts on 8 and 9 October. State Bank of India disclosed a dark-web leak of 3,897 customer records. Spandana Sphoorty reported unauthorised debits on 1 November. AU Small Finance Bank is investigating a possible customer-data leak. CERT-In has not said which of these are Crafty Falcon’s work.

Separately, Anthropic published a threat-intelligence report in September documenting its Claude models being used in real intrusions: an actor linked to Midnight Blizzard against more than twenty Ukrainian government, military and diplomatic bodies; suspected ShinyHunters affiliates taking over 2,100 Azure AD token sets across more than forty tenants in about thirty-four hours; Chinese-speaking operators against roughly fifty organisations.

So yes. AI hacking happened, at scale, this year. Hold that thought.

Now look past AI hacking, at how the big websites were actually broken into

Here is where it falls apart. We went through the major confirmed breaches of 2026 looking specifically at initial access — how the attacker got in the first time. Not the headline number. The door.

Klue — roughly 200 customer companies affected, including Jamf, HackerOne and LastPass. The way in was a credential the company had issued in 2022 for a limited pilot and never switched off. Four years later somebody stole it and walked in.

Carnival Corporation — around 6 million people, by the Texas Attorney General’s estimate. Names, addresses, dates of birth, driving licence and passport numbers. Initial access: an employee was socially engineered.

AdaptHealth — 4,115,802 people. Initial access: social engineering that compromised a third-party contractor’s user session.

Instagram — tens of thousands of accounts taken over across several months. Attackers posed as account owners and asked Meta’s own AI chatbot to send password-reset codes to email addresses the attackers chose. There was no exploit. They asked politely and the help desk said yes.

The software supply chain — backdoored versions of Aqua Trivy, Bitwarden CLI, Checkmarx tooling and a major npm package, installed or auto-updated by the people who trusted them. Credentials harvested from developer machines, then used to spread further. OpenAI and Vercel both lost some customer data downstream. An EU cyber agency lost cloud keys.

Data that was simply left out in the open — a hotel check-in system holding around a million passports and licences, a money-transfer app’s Amazon server, a prison payphone provider exposing 300,000-plus callers, a UK visa portal leaking selfies. More than two million people, combined. TechCrunch’s description was “simple security lapses,” and that is being generous.

Across every one of those incidents where the entry method was actually stated, not a single one was a zero-day or a novel exploit. A forgotten password from 2022. Staff tricked on the phone. A chatbot that handed over reset codes. Files on a server with no lock on it.

The number that reframes the whole thing

Rapid7 looked at how attackers achieved initial access across 2025. The most common route, at 44%, was a valid account with no multi-factor authentication — a working username and password, used as intended, by the wrong person.

Exploiting a software vulnerability at all, of any kind, AI-assisted or otherwise, accounted for 25%.

Nearly twice as many break-ins came from a password that should have had a second factor as from every software exploit in the world put together. That is the real shape of AI hacking in its proper context: a genuine and growing capability, sitting on top of a problem that has not changed in twenty years. Every AI hacking headline you read this year was written about the 25%, not the 44%.

Even the AI hacking campaigns started with stolen passwords

This is the detail that changed how we read the whole story, and it comes from Anthropic’s own report.

Across every AI-assisted intrusion they documented, the attackers needed access to Claude to use it. How did they get it? Anthropic states it plainly: In every instance, the API keys involved were stolen from Anthropic customers’ environments.

The AI hacking campaigns did not begin with AI. They began with somebody’s key lying around where it should not have been — the same failure as Klue’s forgotten 2022 credential, one layer up. Strip the stolen credential out and the AI hacking does not start.

Anthropic also says humans stayed in the loop throughout, setting the targets and reviewing what got stolen. And in its earlier November 2025 disclosure, the company reported something quietly fatal to the robot-hacker narrative: the model frequently overstated what it had found and sometimes fabricated data outright during autonomous stretches, which Anthropic itself described as an obstacle to fully autonomous attacks. The AI hallucinated, and the hallucinations made it worse at the job.

The AI hacking statistic everyone quotes, and why it does not hold up

You have probably seen the claim that AI has collapsed the window between a vulnerability becoming public and a working exploit existing — from about 32 days down to about 5. It is quoted constantly, including in a Cloud Security Alliance white paper that calls AI the primary force behind the compression.

The figure is real. The attribution is not.

That drop measures 2022 to 2023. The AI tooling being blamed for it largely arrived afterwards — the same paper notes there were fewer than five open-source AI pentest tools before April 2023. The compression mostly happened before the cause showed up.

Google’s Threat Intelligence Group, measuring actual disclosures and actual in-the-wild exploitation through August 2026, found something less dramatic and more useful. Yes, CVE disclosures roughly doubled, from 5,045 a month in January 2026 to 10,740 in August. Yes, exploited vulnerabilities rose from an average of 10.5 a month in 2025 to 18. But exploitation grew 127% while disclosure grew 128% — in tandem, not outpacing. And only about 0.23% of 2026’s disclosed vulnerabilities, roughly one in 431, were ever observed being exploited at all.

Google’s team does find that AI-discovered bugs skew more severe: 50% led to remote code execution, against 26% for bugs found the old way. They have one documented case of an AI-found flaw being exploited within four days of disclosure. They call it an early indicator rather than an established trend. That is a careful, honest framing of what AI hacking has achieved so far, and it is not the one in the headlines.

So what should you actually do?

If you run a company, CERT-In’s advisory is worth reading properly, but the short version is unglamorous: separate your test environments from production and stop sharing credentials between them, monitor over weekends and holidays because that is when these attacks land, and finish your remediations — Crafty Falcon’s speciality is returning to firms that half-fixed things.

If you are a normal person reading this because the news made you anxious, the honest answer is smaller than you expect:

Turn on multi-factor authentication on email, banking and anything holding money. That single step addresses the 44%. Nothing else you do comes close to it.

Use a password manager, so a breach at one company does not become a breach at six.

Install updates. Almost every frightening story we have covered this year — the PHP vulnerability, the exploit chain behind those fake shopping websites — ended with the fix having already shipped, protecting only the people who installed it.

Be suspicious of people, not algorithms. Carnival, AdaptHealth and the Instagram takeovers all came down to somebody being convinced to help. That is still the most reliable way in, and no AI was required.

The Honest Fine Print

We have a conflict of interest here, and you should know it. This article was drafted with assistance from Claude, made by Anthropic — one of the companies whose AI models were documented being used in these attacks, and a company with an obvious commercial interest in how the “is AI making hacking worse” question gets answered. We have tried to handle that by leaning on Anthropic’s own admissions rather than its reassurances, and by checking its claims against Google’s independent measurements. Judge the argument accordingly.

Anthropic is the only source for Anthropic’s claims. No independent party has reviewed the logs behind that report. A vendor reporting misuse of its own product is simultaneously the best-placed observer and the least neutral one. Victim counts are given as “at least” and “more than,” attribution is hedged, and no figure is offered for how much of the attack chain was actually automated.

We could not read the main critical coverage. There is a piece in The Conversation in which outside experts raise questions about an AI lab’s espionage claims. Its publisher blocks automated access, so we could not read it and will not pretend to know what those experts said. If you want the sceptical case properly argued, go and read it yourself before you take our word for any of this.

“No stated exploit” is not “no exploit.” For many large 2026 breaches, nobody has said publicly how the attackers got in. We can only report the ones where the entry method was stated. The pattern across those is strong and consistent, but it is a pattern in the subset that disclosed.

Several figures are disputed. The Instructure breach was claimed at 275 million users by the attackers; an analysis of actual filings found about 18,400. DentaQuest’s own filings say 15 million in one place and 27.4 million in another. We have avoided leaning on numbers that come only from the people doing the extortion.

This will age. Google’s own researchers say we are in the early days of the data. The honest position on AI hacking today is that it makes existing attackers faster and cheaper, with early signs it finds nastier bugs. If that changes into something qualitatively different, we will say so.

Frequently Asked Questions

Is AI hacking actually happening, or is it just hype?

Both. It is documented and real — CERT-In named four AI tools in active use against Indian financial firms, and Anthropic traced its own models through intrusions against dozens of organisations. But it accounts for a small share of how people and companies actually get breached, and the big 2026 breaches were caused by stolen credentials, social engineering and exposed data.

Can AI hacking tools write working exploits on their own?

Partially, and with supervision. Benchmarks show AI reproducing proof-of-concept exploits for already-published vulnerabilities in minutes for a few dollars. Finding genuinely new bugs is harder, and the AI’s own tendency to invent results has been a real obstacle — Anthropic reported its model overstating findings and fabricating data during autonomous operation.

What was the most common way hackers got in during 2025?

A valid username and password on an account with no multi-factor authentication, at 44% of cases per Rapid7. Exploiting a software vulnerability accounted for 25%. The boring failure is still the dominant one by a wide margin.

Which big companies were hacked in 2026?

Among the confirmed ones: Klue and roughly 200 of its customers, Carnival, AdaptHealth, Instructure’s Canvas platform, DentaQuest, Medtronic, Charter, CareCloud, Boston Scientific and Stryker, plus tens of thousands of Instagram accounts. Scale varied from thousands to millions of records.

Does this affect Indian users directly?

The CERT-In advisory targets financial institutions rather than consumers, but the consequences reach customers — unauthorised debits, leaked records, drained accounts. If you bank with a smaller NBFC or hold crypto on an Indian exchange, enabling MFA and checking statements this month is a reasonable response. We took a similar view on the Bank of Baroda data breach.

Should I change all my passwords?

Not all of them, and not in a panic. Change any password you have reused across sites, and any on a service that has confirmed a breach. Then enable MFA, which is worth more than a hundred password changes.

Bottom line

AI hacking is not a myth. It is being used, today, against Indian financial firms, and the money it has taken is real money from real lenders.

But the question worth asking is not whether AI hacking works. It is how people are actually getting hacked — and in 2026 the answer was a credential from 2022 nobody turned off, employees talked into helping, a chatbot that handed over password-reset codes, and files sitting on servers with no lock on the door. Even the AI-driven campaigns had to begin by stealing somebody’s API key.

The attackers got a faster tool. They are still walking in through the same unlocked door. Lock that one first.

Sources

• Infosecurity Magazine — CERT-In advisory CIAD-2026-0058 of 4 November 2026, Crafty Falcon and the named AI tools
• IDRW / PTI — the Indian incidents, Reuters figures on the Mumbai lenders and SBI
• Anthropic — September 2026 threat intelligence report, including the stolen-API-key finding
• The Register — the November 2025 disclosure and the model’s fabrication problem
• Google Threat Intelligence Group — disclosure and exploitation measurements through August 2026
• Cloud Security Alliance — the collapsing exploit window paper and the Rapid7 initial-access figures
• TechCrunch — the 2026 breach list and initial access methods
• eSecurity Planet — record counts and the disputed figures