Threat Watch

Every incident comes from a published source: threat intelligence reports from security vendors, misuse reports from AI developers, enforcement disclosures from online platforms, investigative journalism, and statements from law enforcement and governments. Each entry links back to its primary source.

• Operations that failed or were blocked. An attempt against a real target counts even if it achieved nothing. Its Impact score will reflect that.
• Narrow but real AI use. A single AI-generated lure in an otherwise manual operation counts, provided the lure mattered to the operation.
• Cases with weak but sufficient evidence of AI use. These are included and flagged in the entry (see Step 3).

• Trend and ecosystem reports. Statistics or toolkit profiles drawn from many unnamed "recent incidents", with no specific victim or campaign, are not logged.
• Advertised or claimed capabilities. A forum listing for an "AI-powered" tool, or a claimed capability with no evidence it was used against a real victim.
• Authorized security research. Work done by researchers with permission, however sophisticated the AI use.
• AI acting without a human directing it. Where an AI agent itself breached a real organization without a human actor behind the operation, the case belongs in AIRE's Agentic Incidents Monitor instead.
• AI-discovered vulnerabilities. Flaws found with AI and reported by defenders. When attackers exploit them afterwards, the AI’s role usually isn’t visible in the operation itself, so these downstream effects, which may be among AI’s most significant, fall outside what we can capture.

Yes. Deepfakes and consumer-facing fraud now meet the two tests so routinely that logging every case would flood the database. They are only included if they stand out on novelty, reach, or severity, where severity covers harm to public security, public safety, fundamental rights, or societal trust.

Each entry is labelled with the strength of its evidence of AI use:

• First-party: the AI developer investigated misuse of its own model and reports account activity, prompts or outputs.
• Confirmed: the source states AI use as fact, based on logs, prompts, the operator's own statements, seized material or a law-enforcement finding.
• Assessed likely: the reporting organization judges AI use likely from features of the artifacts and says so.
• Inferential: AI use is inferred from indirect signs only, such as the style of code comments, and nobody has confirmed it.

No single stylistic sign is enough on its own, because people produce the same signs. An inferential entry needs several independent signs, or a reporting organization that has assessed AI use itself.

One entry is one operation: one actor, one campaign window, one objective. A source can describe several operations, one, or none.

Every entry is coded against the same schema, so incidents can be filtered and compared. The fields fall into six groups.

Sophistication measures how much the operation relied on AI, and how advanced that use was. It adds up five aspects: how much decision-making was handed to AI (A), whether AI responded to what happened (P), how much of the operation's capability AI supplied (G), how many stages AI took part in (V), and which capabilities AI used and how far it took them (C). A higher score means more of the operation was AI-driven and that AI did more advanced things, but not necessarily that it was more dangerous.

Capability x depth (d) for Cyber Offense and Manipulation. Each capability has its own definition at each depth level.

Depth 0 adds nothing to C because C rewards only how far AI went beyond the most basic form of each capability; this stops a score from rising just because more capabilities were tagged.

The weights rank capabilities by how much of an operation each one lets AI run. For example, social engineering produces content that a person must still act on, while orchestration directs the whole operation. The equal 0.2 steps between them are a convention.

Cyber and influence operations are scored on the same five components, but the stages behind V and the capabilities behind C are different for each. The same score therefore does not mean the same thing in both, and scores should only be compared within a risk category.

We regularly check that scores still tell operations apart, for example whether too many operations sit at the top of one part of the scale. When a part fills up, we add new rungs above the current top. Existing rungs are never redefined or renumbered, so every earlier score keeps its meaning and stays comparable across years. Changing a weight needs no new judgments: each part is stored separately, and all scores are recalculated together. If a rung's definition ever had to change, that would be a new version of the method. Every affected operation would be rescored, and the change would be recorded in the change log.

Impact measures the documented harm of the whole operation, not just the part caused by AI. AI’s contribution is captured by Sophistication instead, and more concretely, by Dependence (G).

An operation can cause several kinds of harm, so each entry is tagged with every type of harm that applies.

Cyber Offense has four types that use three measures: dollars for financial loss, a count for personal data, and one shared severity score (0–100) for system compromise and for destruction and disruption. The three measures are never combined into a single number.

For operations that compromised or disrupted systems, we score severity by adapting CISA’s National Cyber Incident Scoring System. Each operation is rated on six components. Each component is first converted to a 0–1 scale using its own lowest and highest rung, so that components with more rungs do not count for more. The score is the average of the converted components that the sources document, multiplied by 100. All components carry equal weight.

Components the sources don't document are left blank, and the average is taken over the rest. This can make a thinly documented case look more severe than a fully documented one, for example when a report describes only the worst effects. Each score therefore shows how many of the six components are documented (for example "4 of 6"), along with a conservative score that counts every blank as the lowest rung. Scores with fewer documented components are less reliable to compare. If more than two of the first four components are unknown, the operation is not scored.

The first four components follow NCISS. Two are adapted:

• Victim criticality approximates NCISS’s cross-sector dependency, based on the victim’s sector and role.
• Scale replaces NCISS’s potential impact with realized scale, keeping the score on documented harm.

Impact is only as complete as the reporting. Many sources describe a compromise without quantifying the losses or data affected, and recent cases are often scored before the full damage is known. Reported losses and victim counts are therefore often floors: they can only grow as more becomes known. The severity score is different. Filling in a missing component can raise or lower it, so a recent severity score is provisional rather than a floor. Impact also measures the harm of individual operations: diffuse effects, such as a vulnerability discovered with AI and later exploited by others, fall outside it.

Manipulation entries cause different harms from intrusions, so they are scored on three measures of their own. As with cyber operations, each measure is scored only from what sources document, and the three are never combined into a single number.

These measures capture the visible traces of influence harm, not the harm itself. Damage to reputations, interference with how people vote or take part in civic life, and loss of trust in information are not measured directly. Spread and offline consequences are the closest available signals. As with cyber harm, they are often floors: views are rarely reported, and consequences surface late.

Sophistication by reporting quarter. Each dot is one operation, placed by its Sophistication score and the quarter it was reported. Boxes span the middle half of each quarter's scores. You can draw lines for the median, the 90th percentile, and the maximum to date. You can also add layers to explore the evolution of operations based on model availability, actor type, and country of origin.

Components of sophistication. Five bar charts show how operations are spread across each part of the score: Autonomy (A), Adaptivity (P), Dependence (G), Stage coverage (V), and Capability weight (C). Click a bar to filter every chart on the page to operations at that level; click again to clear it. The filter shows how many operations are selected.

Top 12 operations by sophistication. A carousel of the highest-scoring operations. Each card shows the reporting date, actor origin, headline, score, actor, model, sectors, and the start of the description, with a link to the source. Click a card to expand it.

AI capabilities used in operations. A bar chart of how many operations were tagged with each AI capability, split by the year they were reported. An operation can carry several capabilities, so the bars add up to more than the number of operations.

Models involved. A table of the model families named in operations, with counts by year, the median Sophistication score, and the top-decile score (shown only for groups of at least 10 operations). Most sources do not name a model. Counts also depend heavily on how much each AI developer investigates and publishes misuse of its own models, so this view measures disclosure as much as usage.

Attack sequence. MITRE ATT&CK tactics for cyber operations and DISARM tactics for influence operations, each in kill-chain order, shaded by how many operations carry each one. Switch between all-time counts and the share of the current year. Click a tactic to list its operations. Tactics only record the stages where AI played a role.

Threat actor nations. Switch between the main origins and a world map. The main-origins view gives a card for each of China, Russia, North Korea, and Iran: the number of operations, the median and top-decile Sophistication scores, the most active named actors, and how many of the country's operations name an actor at all. Each card links to a country profile.

Many operations have no assessed origin. Breakdowns by origin therefore undercount countries with weaker attribution norms, and are not a ranking of which countries misuse AI most.

Targeted sectors. Switch between a ranking of all sectors and a view of critical infrastructure sectors. Each sector shows operations by year, its count, and its median and top-decile Sophistication scores. The sector is the victim's: influence operations aimed at a general public carry no sector and are not counted.

Targeted countries. Switch between a map and a ranking. The map is shaded by how many operations targeted each country; countries with no recorded operations are shown separately from those with few. Some very small countries cannot be shown on the map. A country is only recorded where the source names a specific victim.

The full list of incidents is in the Threats Database, linked from the top of Threat Watch. You can filter it by reporting date range, actor, actor origin, risk category, and AI capability, and reset the filters in one click.

• Only reported operations. Undetected and undisclosed operations are missed, and AI involvement may go undocumented in many operations that are reported, because it often leaves no visible trace. Trends reflect both activity and visibility: a rise can mean more attacks, better detection, or a new source of reporting.
• Reporting is uneven. Western and English-language sources are over-represented, so operations by adversaries of the West, and against Western targets, are more often documented. A few organizations that report frequently account for many cases, so their focus areas are over-represented. Some AI uses are also easier to spot: an autonomous agent leaves traces, while AI-written lures or code often don’t.
• Some cases are left out by design. The higher bar for deepfakes and consumer fraud means these are undercounted relative to how often they happen. Authorized research, unproven claims, AI-discovered vulnerabilities and incidents without a human attacker are also excluded.

• Evidence of AI use varies in strength. Some entries rest on logs, prompts or reasoning traces, others on indirect signs. AI developers investigating their own models can see account activity and prompts that outside analysts can’t, which supports more confident judgments.
• Attribution is often missing. Actor identity and origin are frequently unconfirmed, and origin often reflects language or infrastructure rather than nationality. We record origin and actor type separately, so a commercial firm working for a state is typed as commercial and keeps its own origin. We do not record where an operation’s infrastructure was hosted. Sources often infer origin from language or infrastructure rather than nationality, so origin can point to a different country than the actor’s sponsor or servers.
• Impact figures are the sources’ own. Losses and victim counts are transcribed, not independently verified. Many sources don’t quantify harm, and recent cases are often recorded before the full damage is known, so low impact scores are often floors.
• Dates are reporting dates. Operations can be reported months after they happened, and recent quarters fill in as sources are triaged.

• Scores depend on documentation. A detailed forensic report can reveal much more of the AI’s role than a short news item covering similar activity. Differences between individual operations, or between groups with few cases, are weaker signals than trends across many operations.
• Scoring involves judgment. Each rung is defined in writing, but analysts still make calls, especially on dependence and adaptivity.
• The scales can saturate. As AI involvement becomes routine, parts of the scale that once separated frontier cases fill up. We check for this periodically.
• The taxonomy is still evolving. Recurring patterns that are not yet formal categories are noted in entry descriptions, not as tags.