Analysis · DiggingBeagle record
Five numbers that describe different stages of AI-assisted attacks
Honeypot attempts, successful laboratory scenarios, exploited browser builds, generated scripts and confirmed intrusions cannot be combined into one success rate.
- Published
- Oct 31, 2026
Overview
A honeypot records 601 hostile requests. A model completes three of thirteen simulated cyber scenarios. Another experiment constructs chains against six Firefox builds. Investigators recover hundreds of scripts from compromised servers, while a large campaign targets more than two hundred organizations and has post-exploitation evidence at nine. These are not five measurements of the same phenomenon. Each counts a different unit, sometimes before the attacker reaches a meaningful target.
Put the denominator next to the verb
| Observation | What was counted | What would require additional evidence |
|---|---|---|
| InferD: 601 encoded credential-theft requests | Inputs received by monitored AI or MCP service honeypots | Command execution or stolen real credentials |
| Irregular: 3 of 13 multi-stage scenarios completed at least once | Distinct simulated objectives reached in a controlled harness | Per-run reliability or real-world intrusions |
| Epoch: six vulnerable Firefox builds | Lab-tested browser versions with completed chains | A field campaign or the cost of a fresh attack setup |
| Wiz: 99 Flowise scripts, 602 gateway steps, more than 150 GraphQL scripts | Three separate observed post-compromise work traces | One unified actor or success of each probed target |
| CrowdStrike: more than 200 targets, nine confirmed post-exploitation organizations | Targeting population versus verified follow-on effects | Two hundred compromised organizations |
The original InferD research instruments AI-facing services and records attempts, not successful theft. Irregular's simulated operations count distinct tasks that succeeded at least once, not a stable success probability for every retry. Epoch's browser experiment reports capable lab chains under chosen versions and substantial initial investment. The cost of a marginal rerun cannot be compared with the cost of starting a campaign.
Activity traces are not actor identity
Wiz's three intrusion investigations involve actual compromised systems and iterative scripts. Those traces are stronger evidence of a realized process effect than a model's proposed answer. Yet a script changing after an error is not, by itself, a cryptographic identification of which model generated it. The entry point, command, network response and observed side effect should be tied to one host and time before an attribution claim is made. The Flowise, Java gateway and GraphQL MCP dossiers are therefore separate.
CrowdStrike's VAPOR PANDA case illustrates another denominator shift. ARTEX helped an operator coordinate efforts against more than two hundred organizations, but post-exploitation was verified at nine. Even a very large token count describes work by a tool, not an additional victim. This kind of distinction also prevents overlap between campaigns that happen to use the same framework.
A reporting rule that scales
Describe each finding using its unit and certainty: requests received, scripts executed, attempted access, tested versions, successful objectives, confirmed victim hosts or reported loss. Preserve the original incident date and disclose what independent confirmation is missing. A security reader can then compare genuine progress in offensive automation without inflating a benchmark into an epidemic or dismissing an observed intrusion merely because model attribution remains uncertain.