AI is changing how some malicious groups work, but it has not replaced familiar threats such as ransomware, phishing, vulnerability exploitation, and supply-chain attacks. The clearest evidence points to AI as both an enabler of malicious activity and a new attack surface when organizations deploy AI systems. It does not establish what share of all cyberattacks is caused by AI, or a new global security rule created by AI.
How are hackers using AI in 2026?
AI can help people carry out or improve parts of an operation; that does not mean every attack is autonomous or that an AI system is acting without human direction. The distinction matters: a person can use AI as a tool against a conventional target, or an attacker can target an AI system itself.
As an Amazon Associate I earn from qualifying purchases.
Using AI to assist malicious activity
Malicious groups are increasingly using AI to facilitate or enhance their activities, according to the European Union Agency for Cybersecurity (ENISA). Potential uses include helping with phishing, fraud, and other steps in an operation. A December 2025 NIST initial preliminary draft describes possible AI assistance across attack stages, including vulnerability discovery, faster attack paths, data exfiltration or tampering, and support for less sophisticated actors. Because this is a preliminary draft, it is an emerging-risk assessment, not a finalized standard or proof that every listed use is widespread. NIST IR 8596 initial preliminary draft
Attacking AI systems
AI systems can also be targets. NIST’s final adversarial machine-learning taxonomy describes several attack categories, with the categories and their application varying between predictive and generative AI:
#1 Best Overall
- A FIDO security key with PUF technology provides a unique, hardware-rooted trust anchor that resists tampering and cyber attacks, offering stronger security than conventional designs.
- FIDO2 Certified Protection – Enjoy phishing-resistant security with FIDO2 certification, ensuring top-tier account safety across Windows, macOS, Linux, iOS iOS, Android and more.
- Easy to use & Portable – Designed with a compact USB-C interface, Clife key fits easily on your keychain for secure access anywhere. Simply plug in and authenticate with ease.
- Universal Compatibility – Works seamlessly with hundreds of FIDO2/U2F compliant services, including popular cloud, email, and social platforms.
- Backup recommended – To ensure continuous access, register a backup Clife security key as a spare in case your primary key is lost.
- Evasion: manipulating inputs so a model behaves differently when it is being used.
- Poisoning: tampering with data used to train or otherwise shape a model.
- Privacy attacks: trying to infer or expose information about data associated with a model.
- Misuse: exploiting a system’s capabilities in ways that undermine its intended use.
These categories help teams reason about AI-specific risks; they are not a claim that every AI deployment is vulnerable to every attack. NIST AI 100-2 E2025
Are AI cyberattacks actually increasing?
There is evidence that malicious groups are using AI more, but the sources available here do not provide a defensible percentage of all attacks caused by AI. “AI cyberattack” can mean an operation assisted by AI, an attack against an AI system, or an incident in which AI was only one tool among many. Counting those consistently is difficult, so claims that a specific share of cybercrime is AI-driven should be treated cautiously unless they explain their definition and methodology.
Rank #2
- Hardware-Rooted Security with PUF Technology – PUFido Drive Clife Key uses Physical Unclonable Function technology to generate a unique, hardware-based identity that cannot be duplicated, delivering stronger resistance against tampering and cyber attacks than conventional security keys.
- FIDO2 Certified Phishing-Resistant Protection – Fully compliant with FIDO2/U2F standards, enabling secure passwordless login and two-factor authentication to help protect accounts from phishing and credential theft.
- Security Key + Flash Drive in One Device – Combines a FIDO security key with a built-in USB flash drive, allowing you to carry files and a hardware authentication key together in a single compact device.
- Easy to Use & Portable – Compact USB-C design fits easily on a keychain or in a pocket. Simply plug in the Drive Clife Key to authenticate or access stored files with no extra software required.
- Universal Compatibility – Works with hundreds of FIDO2/U2F compatible services and supports Windows, macOS, Linux, iOS, Android, and other major platforms.
ENISA’s Threat Landscape 2026 analyzes EU incidents and events from 1 January through 31 December 2025. It presents AI within a broader threat picture: ransomware remained the most impactful short-term incident type, while phishing, social engineering, vulnerability exploitation, supply-chain exposure, and ideology-driven distributed denial-of-service (DDoS) also featured. These figures describe the EU threat landscape, not AI-caused attacks or global rates:
- Among targeted organizations, 73% were essential or important entities under NIS2.
- Public administration accounted for 32% of reported targeting.
- More than 48,000 new CVE identifiers were published in 2025, a 22% increase over the prior year.
- Ideology-driven DDoS made up 82% of recorded public-administration events.
The figures are from ENISA’s analysis of EU activity in 2025; they should not be read as rates of AI use. ENISA Executive Director Juhan Lepassaar said the report highlights how threats are becoming more interconnected and how groups can spread their impact across digital services and infrastructure. ENISA Threat Landscape 2026, published 22 September 2026
Rank #3
- Ultra-Compact FIDO2 Security Key - Plug-and-stay or carry on a keychain. This USB-A hardware security key offers portable, always-on protection for desktop and mobile use. (Item Size: 0.75 X 0.74 IN x 0.25 IN)
- USB-A Hardware Key for All Devices - Works with USB-A ports on PC, Mac, Android, and other laptop/notebook device. Enables secure, cross-platform login with FIDO2.0 passkey support.
- FIDO Certified Security Key - Meets FIDO and FIDO2 standards. Works with Google, Microsoft, GitHub, Dropbox, and more. Please check service compatibility before purchase.
- Passwordless Login with Passkey - Supports passkey login via WebAuthn and CTAP2. Enjoy password-free sign-ins where supported. Not all websites or services currently support passkeys.
- Advanced Multi-Factor Authentication - Offers 200 FIDO2 passkey slots and 50 OATH-TOTP slots. Strong, flexible 2FA/MFA support across various apps and authentication platforms.
Can AI hack a company?
AI can assist a person trying to compromise an organization, and AI systems used inside the organization can introduce additional exposure. That does not mean a chatbot or model can automatically break into a company. Outcomes still depend on the attacker’s access and choices, the organization’s weaknesses, and the controls around its systems and data.
When an AI system is integrated into business operations, it can connect models to information, software, or workflows that matter to the organization. Each connection and use case needs to be considered as part of the system’s attack surface. ENISA specifically warns that AI systems integrated into business environments extend that surface. This is why AI governance belongs alongside ordinary asset, access, and vulnerability management, rather than replacing them. ENISA Threat Landscape 2026
Rank #4
![Thetis Pro FIDO2 Security Key Passkey with Complex Pin [PinPlex], Hardware Device Supports USB A, Type C &NFC, TOTP/HOTP Authenticator APP, PIV Certificates, FIDO 2.0 Two Factor Authentication 2FA MFA](https://m.media-amazon.com/images/I/31ugrBqG6SL._SL160_.jpg)
- Dual USB-A and USB-C Security Key – Features both USB-A and USB-C connectors for seamless compatibility across desktops, laptops, and tablets. Supports plug-and-stay use or keychain carry.
- NFC-Enabled for Mobile Access – Built-in NFC allows fast, wireless authentication with Android and iPhone devices. Ideal for mobile logins and on-the-go security.
- FIDO Certified for Strong Authentication – [CHECK COMPATIBILITY before purchase] Fully compliant with FIDO2 and FIDO U2F standards. Works with major platforms like Google, Microsoft, GitHub, and Dropbox.
- Passwordless Login with PinPlex – Supports secure passkey login via WebAuthn and CTAP2 with added protection from PinPlex, a complex PIN system that enhances physical security.
- Multi-Layer Authentication Support – Includes PIV certificates and supports both TOTP and HOTP for strong 2FA/MFA coverage across enterprise and consumer apps.
What security rules are changing?
“Security rules” can mean day-to-day security practices, voluntary frameworks, technical standards, or binding laws. The evidence here supports changes in security practice and voluntary NIST guidance; it does not establish a new global legal rule caused by AI. The NIST materials below have different purposes and publication statuses, so they should not be treated as interchangeable mandates.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
| Guidance | Scope and coverage | Status and audience |
|---|---|---|
| NIST AI 100-2 E2025 | Taxonomy and terminology for adversarial machine-learning attacks, with mitigation discussion. | Final report published in March 2025; voluntary guidance for people working with AI systems. |
| NIST AI Risk Management Framework (AI RMF) | A risk-management framework for AI, rather than an attack taxonomy alone. | Voluntary; NIST says AI RMF 1.0 is being revised. NIST released a critical-infrastructure profile concept note on 7 April 2026. |
| NIST IR 8596 | Preliminary discussion of AI’s possible role across cyberattack stages and defensive concepts. | Initial preliminary draft from December 2025, not a finalized standard; relevant to organizations considering cyber risks involving AI. |
| Critical-infrastructure profile concept note, described on the NIST AI RMF page | Proposed AI risk-management profile for critical infrastructure. | At concept-note stage as of 7 April 2026; intended for critical-infrastructure contexts, not a binding requirement. |
What should organizations do to defend against AI-powered attacks?
Start with controls that reduce risk from established intrusion routes, then extend risk management to AI systems and their integrations. NIST’s December 2025 preliminary draft specifically calls out training, email security, authentication, and integrated defenses; these are guidance, not guarantees. ENISA’s threat landscape also makes clear that organizations still need to account for vulnerabilities, dependencies, ransomware, and social engineering.
Maintain systems and dependencies
- Keep operating systems, applications, and exposed services maintained, and prioritize fixing vulnerabilities based on exposure and organizational impact.
- Track important suppliers and software dependencies so teams can assess where a compromise or disruption could affect business services.
Make impersonation and account compromise harder
- Strengthen email protections and authentication, particularly for accounts with access to sensitive data or administrative functions.
- Train personnel to verify unusual requests through a separate, trusted channel, especially requests involving payments, credentials, or changes to account details.
- Provide a clear way to report suspicious messages or unexpected instructions so a potential incident can be reviewed quickly.
Govern AI systems across deployment and use
- Keep an inventory of AI systems used in business, including who owns each system and what information or workflows it can access.
- Assess risks at the system’s actual points of connection and use, and define who can approve changes or respond to suspected misuse.
- Use a risk-management process appropriate to the organization. NIST’s AI RMF is voluntary guidance, while its adversarial-ML taxonomy can help teams name and discuss attacks against AI systems.
No single measure prevents every attack. Organizations should combine these controls with established incident-response practices and adapt them to the systems and services they need to protect.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
