In its new Cybercrime in the Age of AI report, ThreatDown points to a January 2026 attack on a Mexican municipal water utility as evidence that AI can help attackers work faster and beyond their existing expertise.
After compromising the utility’s enterprise network, an attacker used Anthropic’s Claude AI to conduct internal reconnaissance. Claude found a server hosting an industrial gateway and software used to manage industrial systems. It recognized the server as a possible route toward the utility’s operational technology, then generated possible credentials for a password-spraying attack.
Industrial cybersecurity company Dragos found no evidence that the attacker reached the operational environment. The incident nevertheless showed how AI could help someone target an unfamiliar technical system using well-established attack methods.
Criminal AI Runs on Mainstream Technology
ThreatDown found that AI services marketed to cybercriminals are not confined to dark-web forums or underground marketplaces. Some operate openly on the web, with storefronts resembling those of legitimate software companies. Some were even indexed by Google.
Behind those storefronts, however, several appeared to offer little proprietary technology. According to ThreatDown, the operators repackaged access to mainstream AI models while relying on commercial cloud infrastructure.
This reliance on mainstream technology suggests that criminal AI services may not need to develop sophisticated systems of their own. They can instead rent or resell capabilities that are already widely available.
The report doesn’t establish that the commercial providers knowingly supported the operations. The findings nevertheless show how legitimate technology companies can become part of the infrastructure behind criminal services without endorsing—or necessarily knowing about—the activity.
The Local-Model Blind Spot
ThreatDown researchers found 6,644 Hugging Face models whose publishers described them as “uncensored” or used similar labels suggesting that safety restrictions had been removed. Across those models, ThreatDown counted more than 22 million downloads over 30 days.
The figures don’t show how many people downloaded the models, whether they are still being used, or what they are being used for. They do show that models marketed as having fewer safeguards are widely available.
Locally run models are harder for AI providers to monitor. Hosted AI providers may be able to flag suspicious prompts or suspend an account, but a model running on a private computer or server sits outside those controls.
That doesn’t make the resulting malicious activity invisible, though; endpoint or network security tools may still detect it. But the AI provider can no longer see the interaction or cut off access.
“Guardrails can reduce opportunistic misuse, but they are not a complete defense,” said Margaret Cunningham, vice president of security and AI strategy at Darktrace.
AI-Assisted Vulnerability Discovery Moves Into Cybercrime
In May 2026, Google researchers reported finding the first known case of criminals using AI to develop a zero-day exploit. ThreatDown cites it as evidence that AI-assisted vulnerability discovery has already moved beyond defensive research.
A month earlier, Anthropic had announced Claude Mythos Preview, which it said could identify previously unknown vulnerabilities in major operating systems and web browsers. The company didn’t release the model broadly, instead providing access to vetted defensive partners.
In a UK AI Security Institute evaluation, Mythos completed a 32-step simulated corporate-network takeover from start to finish in three of 10 attempts. Separately, Anthropic reported that the model had found previously unknown vulnerabilities in real open-source software.
The results don’t show how reliably the model could compromise a monitored production environment. Defensive tools or security personnel might interrupt such an attack, while some AI-generated findings could prove inaccurate. But even with those limitations, the tests suggest that work previously reserved for experienced vulnerability researchers is becoming easier to automate. ThreatDown predicts that models with similar capabilities could reach criminal marketplaces within roughly six months, although that is its forecast rather than a confirmed timetable.
What Defenders Should Do Now
ThreatDown argues that Mythos-class models could surface more vulnerabilities—and trigger more patches—than many organizations can absorb. The report notes that Firefox shipped 423 bug fixes in April 2026, compared with 31 during the same month a year earlier. It warns that each newly released patch may also give attackers information they can use to build an exploit.
Organizations should start by identifying which internet-facing systems are exposed and giving priority to known exploited vulnerabilities. ThreatDown also recommends automating patching where practical and using continuous monitoring to catch signs of an attack after preventive controls fail.
The report also urges IT teams to identify AI tools, agent skills, and system connections introduced without approval. Those unsanctioned tools can expose company data and create additional routes into connected systems if they are compromised.
That leaves security teams with the job of verifying AI-generated findings, determining which systems are affected, and deciding what to patch first. Each finding should be verified, matched to affected systems, and ranked according to its likelihood of exploitation and potential impact.
“Security teams must operate on a much shorter clock, assuming public vulnerabilities will be weaponized within hours rather than weeks,” said Shane Barney, chief information security officer at Keeper Security.
The actual window will vary. But organizations that leave critical patches in a backlog could face greater exposure as exploit development becomes faster and cheaper.
