In May, Sophos found something inside a customer's network that looked less like an intrusion and more like a software team at work. A threat actor, tracked internally as STAC6994, had provisioned four virtual machines and was running roughly a dozen AI agents, coordinated through the Cursor IDE and a commercial coding assistant, to write and test malware against three different endpoint products at once: Sophos, CrowdStrike, and Microsoft Defender.
One agent, running Claude Opus 4.5, handled core operations and rule-setting. Others managed OPSEC hardening, documentation, proxy stress testing, and VM deployment. Code commits flowed to Git through Model Context Protocol. The agents read technique write-ups scraped from the SpecterOps blog, mapped them to MITRE ATT&CK, built a lab to reproduce each one, and logged the results. Over the course of the operation, they produced close to 80 modules and tested more than 70 evasion techniques. Sophos's Counter Threat Unit later confirmed the same operator went on to deploy ransomware and steal data using the tooling built in that environment.
Sophos published the case as the anchor story in its first AI Security report, and the headline finding isn't that AI invented some new form of attack. It's that the same tradecraft moved at a different speed. The report is explicit about this: what used to take a human developer weeks of manual iteration took the agents a few days. Nothing about the malware itself was novel. The clock was the story.
That distinction matters for how you think about defense. The report separates AI threats into two categories: malicious use of AI, where attackers use AI tools the way STAC6994 did, and malicious targeting of AI, where the AI systems and infrastructure themselves become the target. The second category is where Sophos says the more immediate, provable damage is happening right now, and it's squarely a developer problem.
A campaign Sophos calls SANDWORM_MODE planted at least 19 typosquatted npm packages designed to mimic legitimate developer utilities and AI coding tools. Once installed, the packages dropped a rogue MCP server and used prompt injection to get legitimate AI assistants to quietly retrieve SSH keys and cloud credentials on their own. Separately, a compromised Nx Console VS Code extension pulled credentials out of HashiCorp Vault, npm, AWS, GitHub, 1Password, and Anthropic API keys, as part of a broader campaign researchers have linked to TeamPCP. And in March, source code from Claude Code, roughly 1,900 files and 500,000 lines, ended up published inside an npm package by mistake. Anthropic said no customer data was exposed, but the leak still gives attackers a map to work from.
None of that requires a sophisticated attacker. It requires a developer trusting a tool the way developers are supposed to trust their tools, and an attacker who understood that IDE extensions and coding assistants now sit close enough to credentials and repositories to be worth compromising directly.
The identity layer around those tools is where Sophos sees the exposure concentrating. IBM X-Force found more than 300,000 ChatGPT credentials for sale on the dark web during 2025. The Salesloft/Drift breach showed the mechanism clearly: OAuth tokens issued to a chatbot were enough to compromise multiple Salesforce environments. Sophos points to a similar pattern at Vercel in April, where an employee granted broad OAuth permissions to a third-party AI tool from their corporate account; when that tool was compromised through an infostealer infection, the attacker inherited the tokens and used them to reach Vercel's internal environment.
The governance numbers behind all of this are the ones worth sitting with if you're the one setting policy for a team. Citing Saviynt and Cybersecurity Insiders research, the report says 71% of large enterprises have deployed AI agents with access to core business systems, and only 16% actually govern that access. Only 1% of enterprises have a dedicated AI security budget, per Pentera. Three-quarters of CISOs have already found shadow AI tools running inside their organizations, and 95% of them doubt they'd catch misuse if it happened.
Sophos's recommendations read like a checklist for anyone building agentic systems rather than just buying security products: sandbox the agent process, isolate credentials so the agent never sees secrets directly, put a broker between the agent and any tool it calls, restrict and monitor egress traffic, extend EDR coverage to agent hosts and ephemeral VMs, require human approval for irreversible actions, and treat memory writes and cross-agent handoffs as security events worth logging. Sophos tested one of these principles directly against OpenClaw, running its own red team against it and finding 23 actionable issues. Its take: the tool was powerful enough to be worth using, but only after the security framework around it was built first, which took longer than the test itself.
The report ties back to Sophos's own State of Ransomware 2026 data, which found identity had become the top initial access vector for ransomware for the first time in three years. The AI Security report's argument is that this isn't a coincidence. The tools generating the most productivity gains right now, coding assistants, agents, OAuth-connected AI services, are also the newest and least governed part of the identity fabric. STAC6994 is one confirmed case. Sophos is fairly direct that it's unlikely to be the only one; AI assistance mostly doesn't show up in telemetry, and this one only got caught because the framework was left running on a device Sophos could examine.