AIImpactLab
9 impact clustersWork & marketsCognition & learningTechnical failuresPrivacySecurityEnvironmentLaw & informationSocial good & healthSystemic risk
Search the evidence

Find the signal.

Search titles, impact clusters, countries, organizations and the full text of every analysis.

5 stories found

A forensic analyst examines a government server while a separate regulatory inquiry desk appears in the background.
SecurityGlobal / United States+3 clusters01

AI-assisted espionage and a safety probe show two sides of the control problem

A line of attacker code can tell us something about how it was written, but not everything about who controlled the attack. Palo Alto Networks' Unit 42 describes a campaign against government and state-affiliated Linux infrastructure observed from October 2025 through April 2026. Investigators found scripts with conversational annotations and reasoning comments consistent with AI-generated payloads. They say the code may have been copied from a language model or executed by an AI agent. That is an important distinction: the evidence supports AI assistance, not proof of an autonomous agent running the operation. The investigators have not attributed the campaign to a known state or criminal group. They report reconnaissance, persistent access and attempts to take database and mailbox data. Separately, Axios reports that the US Federal Trade Commission sent civil investigative demands to OpenAI and Anthropic seeking records about safety incidents, safeguards, privacy and marketing. That is a reported investigation, not a finding that either company broke the law. These two developments are not the same case and should not be presented as cause and effect. Together they expose a control gap at different points in the chain: defenders need visibility into how attackers use AI tools, while the public needs credible evidence of how model providers test and govern powerful capabilities. The most useful next evidence would be independent investigation of the campaign's actual AI role, public findings from any regulator process, and measurable controls that reduce harm without relying on a lab's promise alone.

6 min
A glass vault door has a visible gap where a repair remains incomplete.
SecurityIndia+2 clusters02

The attackers came back. Was the repair ever finished?

There is a moment after an incident when everyone wants the answer to be “fixed.” The services are back, the customers are waiting and the next report is due. That is precisely when a reassuring status can become dangerous. India’s CERT-In reports an ongoing AI-assisted campaign against financial businesses and repeat attacks after incomplete remediation. Its November 4 advisory names the activity CRAFTY FALCON. That is an agency account of incidents, not AIImpactLab’s independent reconstruction of the affected systems. The public advisory does not establish the attackers’ nationality or state sponsorship, and it supplies no aggregate loss figure we can responsibly attach to this story. The practical lesson is about recovery, not an exotic nationality label. A repaired public-facing service may coexist with a compromised credential or an unchecked route elsewhere. These are general examples of why restoration and eradication are different tasks, not claims about an identified victim in this campaign. Faster attacker tooling makes the distinction more urgent; it does not prove the software selected its own victims without human direction. An organization should be able to explain who tested the repair, what access was checked, which exceptions remain and when it will look again. Those answers do not need to expose sensitive architecture to the public. They do need to reach the people accepting the residual risk. A team may reasonably restore an essential service before every question is answered. It should say that is a controlled, incomplete recovery rather than silently turning uncertainty into a green tick.

4 min
A security analyst studies anonymized network traces near an exposed agent-control interface without readable details.
SecurityGlobal+3 clusters03

Exposed AI-agent panels reveal a larger cyber campaign, but not a complete damage count

NorForge reports finding more than 20 publicly exposed control panels for Cairn, an AI-agent framework, that it assesses were associated with malicious cyber operations. One cluster of 14 dashboards contained more than 1,100 projects. Those figures describe a discovered sample of exposed panels and associated project records, not 1,100 confirmed intrusions or a census of all agent-enabled attacks. The company behind Cairn says its framework was not designed for criminal use. Reuters separately reviewed actor activity, identified organizations it said were targeted, and sought responses. Some organizations confirmed incidents or containment work, while the full extent of access and any exfiltration remains unclear. That independent reporting strengthens the existence of a real campaign without validating every project as a successful breach. We are deliberately not reproducing any access details, victim data or tactical instructions from the exposed material. The defensible lesson is about operational boundaries: agents with broad credentials and external tools can expand the speed and range of an attacker, and a neglected control surface can expose the entire workflow. But the same research cannot tell us how much harm would have happened without AI, or which apparent targets were actually compromised. Defenders should inventory agent permissions, isolate management interfaces, record actions and practice revoking access quickly. The next public evidence should come from independently confirmed incidents, scoped impact assessments and transparent reporting by operators. The headline should not outrun the verified outcome.

6 min
A torpedo silhouette appears through dark water and uncertain sonar rings, with no confirmed target lock.
SecurityKorean Peninsula+2 clusters04

North Korea claims an AI-guided torpedo test, but autonomy remains unverified

North Korea's state news agency says a new Zam-2.0 torpedo system underwent an underwater test on October 15, with AI applied to target detection and guidance. ABC carried the claim; Yonhap and Associated Press reporting trace it to the Korean Central News Agency. The public reports do not disclose the targeting architecture, the quality of the test, operational status or whether a human selected the target. Independent observers have not verified the claimed AI capabilities. That matters because 'AI-assisted guidance' and 'an autonomous weapon that chooses and attacks a person or vessel on its own' are not the same proposition. A sensor-classification feature might help track a preselected target. A much broader system might identify and engage one without meaningful human control. The policy stakes are dramatically different, and the available evidence does not distinguish them. The announcement arrives amid other North Korean naval weapons demonstrations, but a claimed test is not evidence that this particular system is deployed or reliable under real conditions. The risk of simply repeating Pyongyang's label is that it amplifies a strategic message while bypassing the engineering questions. The risk of shrugging it off is that states may be moving targeting decisions into software faster than public accountability can follow. The strongest next evidence would include independent observation, credible performance data and a clear description of human control.

5 min
A digital map of Taiwan is surrounded by parallel artificial intelligence attack paths and layered government cyber defenses while a human operator directs the campaign.
SecurityTaiwan+4 clusters05

Taiwan says human operators and AI agents combined in an attack on government systems

Taiwan's Ministry of Digital Affairs says government agencies were targeted in July by an overseas cyberattack that combined manual operations with AI-agent assistance. The ministry detected abnormal activity, began issuing warnings on July 20, investigated, and said affected agencies completed incident handling. It cited tools such as OpenClaw as examples of agent assistance and responded with protection guidelines and stronger monitoring. The statement did not name China. Reuters also reported a security-firm account of a multi-agent campaign against an unnamed Asian government, later identified by the Financial Times as Taiwan, but the public evidence does not establish that every detail belongs to the same incident. A security expert quoted by Reuters stressed that a human operator still chose the target, objective, and direction. That distinction matters: the threat is not a machine inventing its own war. It is a person using agents to parallelize reconnaissance, credential attacks, and adaptation at a tempo defenders must now match.

5 min