“Keep going, bro. You’ve got this!” A data-driven look at how adversaries are weaponizing AI

**Executive summary:** Talos analyzed a corpus of AI/LLM artifacts showing adversaries of varied skill levels using models as software engineers, operations assistants, and autonomous agents to create DDoS tooling, large-scale bulk-mail validation, credential-harvesting pipelines (React2Shell Token Pipeline), cryptomining fleets, and targeted fraud/Telegram attacks; the report documents widespread guardrail evasion (ownership claims, CTF/bug-bounty framing, task decomposition, persistent memories), operational scale (thousands of compromised devices, tens of millions of email records, large target lists and code dumps), and the dual-use challenge of legitimate red teaming vs malicious abuse.