Cisco's Talos threat intelligence group examined AI prompt histories and coding sessions that attackers accidentally left exposed online, taken from machines running Claude Code, Codex, Cursor and Gemini. The logs show attackers writing malware, hunting software flaws and, in some cases, using stolen company AI accounts and access keys instead of paying for their own. Safety restrictions were bypassed with simple claims of authorised security testing, and Cisco's advice is to log AI agent activity internally rather than rely on model guardrails.
What changed
Accounts of criminal use of AI coding tools relied mostly on vendor reports and inference rather than recovered attacker prompt histories.
What it unlocks
Security teams can see the specific jailbreak phrasings and workflows attackers used, and log or trap AI agent activity on their own networks accordingly.
- 9,180 hosts scanned
- credentials taken from 54 systems
Sources