MisuseSerious1 sourceFirst seen
Spies Outsourced Their Scripting to AI, and the Scripts Left Their Reasoning Notes Behind
Ourtake
The espionage crew's AI-written scripts were so chatty they explained themselves, which is the one thing a spy should never do.
What happened
Palo Alto Networks Unit 42 reported espionage campaign CL-UNK-1211 against government-linked Linux servers from October 2025 to April 2026. Attackers likely used AI-generated PHP and shell scripts for persistence, credential theft and mailbox exfiltration. Some of the scripts failed on syntax errors.