Countermeasures for AI-Enabled Attacks Start with Deception

Anthropic’s September 2026 threat intelligence report provides one of the clearest public views to date into how threat actors are using frontier AI systems across real cyber operations. Not surprisingly, the attacks rely on familiar weaknesses – stolen credentials, exposed applications, vulnerable services, insecure code, SaaS abuse, cloud misconfigurations, and poor secret hygiene.

So if attack tactics haven’t changed with AI, what has? The speed, scale, and economics of execution.

Anthropic is stressing the improvements in adversarial speed and economics – something we raised the alarm on in Nov 2025 when everyone else was focused on AI’s ability to exploit at scale.

“Many commentators focus on the risk of AI developing exploits at scale. While this is a danger, the risk from AI adoption is more pronounced across the cyber kill chain, where adversaries can operate faster, across a broader and deeper surface area, with fewer resources.” 
– Detecting and countering misuse of AI: September 2026, Anthropic

AI allows attackers to automate reconnaissance, credential validation, exploit development, phishing infrastructure, post-compromise enumeration, and data processing. Those capabilities compress the time defenders have to detect and respond. Controls that were acceptable when attackers moved at human speed will not be sufficient when attackers operate with agentic workflows, persistent memory, and parallel task execution.

But that same automation creates an advantage for defenders.

AI-enabled attackers depend on discovery. They enumerate exposed assets. They classify systems. They validate credentials. They test access paths. They search for sensitive data, privileged accounts, internal applications, cloud resources, repositories, and AI infrastructure. In other words, they interact with the environment to decide where to go next.

Deception exploits that dependency. That is why deception is especially relevant in the age of agentic attacks and why the Cloud Security Alliance has consistently cited deploying deception as a key priority response to AI attacks. The more automated the attacker becomes, the more opportunities defenders have to misdirect, observe, and contain them before real systems are impacted.

At its core, deception is a capability, not a product. This post looks at five of Anthropic’s cyber operation case studies where deception can serve as a primary early-detection and containment mechanism. The goal is to show how defenders can use decoys, honeytokens, synthetic assets, and canaries to turn attacker discovery into detection.
 

GTG-20006 / Midnight Blizzard — Russian Espionage

GTG-20006 is a Russian state-linked espionage actor whose attribution is consistent with public reporting on Midnight Blizzard. This entity has been targeting Ukrainian, European, diplomatic, defense, and foreign-policy organizations.

How AI was used

AI was used to automate operations, notably in the following areas:

• Develop and maintain malware
• Acquire and configure infrastructure
• Research and register phishing domains
• Send phishing emails
• Monitor C2 channels
• Manage compromised accounts
• Support persistence and exfiltration
• Process stolen data
• Rebuild malware when security products detected it

AI Uplift

• Speed: Faster phishing, infrastructure setup, and malware modification
• Scale: More victims and campaigns handled in parallel
• Depth: Better post-compromise processing and data organization
• Resilience: Faster evasion when defenders created detections

Deception as countermeasure for GTG-20006
 

GTG-50014 — ShinyHunters-Style Smash-and-Grab Data Theft

GTG-50014 is described as financially motivated activity associated with ShinyHunters-like operators.

Anthropic identified an opportunistic data-theft and extortion pattern. The threat actor searched for exposed credentials, API keys, SaaS tokens, GitHub tokens, cloud credentials, container secrets, and mobile app secrets.

Targets included technology providers, airlines, energy companies, nonprofits, retail chains, web3 platforms, SaaS providers, GitHub repos, containers, and Internet-facing APIs.

How AI was used

AI helped the actor move quickly across many unrelated environments.

Instead of manually understanding every mobile app, API, SaaS product, or cloud service, the threat actor could use AI to:

• Analyze decompiled mobile apps
• Classify discovered secrets
• Understand APIs
• Generate validation workflows
• Summarize stolen datasets
• Write scripts for harvesting and exfiltration
• Organize credentials by source type
• Support extortion preparation

AI Uplift

Scale and speed. The attack techniques were not novel. The novelty was that AI made mass opportunistic exploitation easier and faster.

Deception as countermeasure for GTG-50014
 

GTG-10007 — Exploit Foundries and Autonomous Attack Frameworks

GTG-10007 is a sustained espionage operation by Chinese-speaking operators likely based in Changsha, Hunan.

This case is important because it shows the concept of an AI-enabled exploit foundry.

The threat actor used AI-first workflows to conduct intrusion attempts, recon foreign-government networks, reverse engineer security products, analyze firmware and binaries, develop and test exploits, maintain malware, build intelligence-collection infrastructure, and run parallel workstreams with persistent campaign memory.

Targets included 50 organizations across retail, education, energy, tech, healthcare, finance, manufacturing, and government agencies.

The threat actor compromised an education-technology company and extracted student data, accessed a retail company’s production systems, and retrieved citizen records from a Southeast Asian government agency. 

A major part of the operation involved autonomous vulnerability research against network appliances and security products. The report says one workflow produced more than a dozen possible zero-day findings in a single month.

How AI was used

The threat actor used AI to:

• Build a fleet of agent swarms
• Run parallel subagents
• Build persistent campaign memory
• Automate firmware analysis
• Create decompiler workflows
• Generate vulnerability hypotheses and exploit-code 
• Perform lab testing and iteration
• Schedule intelligence collection

AI Uplift

• Faster vulnerability discovery and exploit iteration
• Multiple workstreams running in parallel
• Ability to inspect code paths, binaries, and firmware at volume
• Ability for campaign memory stored targets, credentials, state, and instructions

This sort of attack class is where Deception is particularly valuable, because defenders likely do not know the exploit in advance. Deception detects attacker interaction and intent, regardless of whether the CVEs, malware, or signatures are known.

Deception as countermeasure for GTG-10007
 

GTG-50020 — From Hotel Bookings to the AI Supply Chain

GTG-50020 is a Russian-speaking, financially motivated threat actor.

The threat actor historically targeted hotel booking and fintech platforms, then pivoted toward AI vendors and AI supply-chain targets.

The actor attempted to access a pre-release Claude model but did not succeed.

Targets included hotel booking platforms, fintech platforms, AI companies, AI vendors, AI evaluation sandboxes, production AI API keys, KYC and identity-verification systems, and exchange and marketplace systems.

One key attack involved injecting malicious instructions into an AI vendor’s automated evaluation sandbox. This caused credential disclosure. The actor then abused stolen production AI API keys from multiple providers.

The actor also attacked about 30 AI companies in four days.

How AI was used

AI was used in two ways:

• Targeted AI infrastructure directly by attacking AI evaluation workflows and stealing production AI API keys.
• Used AI-assisted offensive workflows to run reconnaissance and exploitation at scale.

The AI tooling used by the threat actor constituted parallel reconnaissance agents, exploitation agents, target-specific scope files, automated finding retesting, containerized pentest tooling, local model gateways, and worker agents operating with limited human supervision.

AI Uplift

• Faster web-app testing
• More parallel attacks
• Better target-specific exploitation
• Rapid pivoting across many AI companies
• Abuse of stolen AI keys for further operations

Deception as countermeasure for GTG-50020
 

GTG-50029 — Hacktivists Targeting European Political Entities

GTG-50029 was a politically motivated French-speaking hacktivist operation.

They have targeted European political parties, media organizations, think tanks, SaaS providers, campaign-management platforms, political affiliates, readers and editorial staff.

The actor used stolen API keys and AI-assisted tooling to scale attacks.

Techniques used included public-container API key theft, custom Rust scanner for exposed keys, API key rotation through proxies, WordPress exploitation, admin account creation, webshell deployment, credential-harvesting, backup poisoning, browser C2 against a media site, credential interception, and Tor leak-site staging.

The actor gained internal access to at least 14 of 42 tracked entities. The operation exfiltrated political, donor, member, student, mailbox, and payment-provider data.

How AI was used

AI was primarily used to build and debug offensive tooling. The threat actors used AI to:  

• Develop a WordPress exploit
• Build a lab harness
• Debug code
• Manage reconnaissance
• Review code
• Validate findings
• Build a doxxing/search platform
• Create ingestion pipelines
• Normalize and rank data
• Containerize deployment

AI Uplift

• Faster exploit development
• Faster weaponization of public-facing web systems
• Better data processing for doxxing
• Ability for a single actor to run a campaign that looked more like a team effort

Deception as countermeasure for GTG-50029
 

As is evident from the five threat actors, AI-enabled attackers are automating the discovery of users, credentials, applications, APIs, cloud data, and exposed services. Deception gives defenders a way to pre-position false but believable assets in those discovery paths. When attackers or their AI agents touch those assets, you get early, high-confidence alerts before real systems are damaged.

Recommended Deception control categories mapped to threat actors

To consolidate what type of deception works best in different situations, we’ve mapped them to the threat actors documented in Anthropic’s report.

Note: We’ve included GTG-50021 and GTG-30005 in the table above as secondary or specialized deception opportunities, but these attacks are not discussed in this analysis because deception is not the primary front-line control for those scenarios.

For the attacks described in Anthropic’s report, deception is not a replacement for patching, identity hardening, ZTNA, DLP, SaaS control, or threat prevention. It is a preemptive detection layer that changes the attacker’s operating environment. By placing decoy credentials, applications, APIs, data, and services in the paths that AI agents are likely to enumerate, you can increase attacker uncertainty, pollute automated decision-making, and generate high-confidence alerts before real systems are damaged.

Learn more about Zscaler Deception here. 

If you’re already a Zscaler customer and would like to deploy Zscaler Deception, please reach out to your account manager.