Six Months to Prepare: What ThreatDown's Cybercrime in the Age of AI Report Means for Security Teams

AI Industry Watch

Willkommen! Selamat datang! 欢迎! Hello! We have an interesting one for you today. ThreatDown published a 22-page report this month titled Cybercrime in the Age of AI, and it opens with a sentence that deserves its own moment: "The transition to a cybercrime ecosystem shaped by AI has begun, but it's not yet complete." That qualifier — not yet complete — is the most important phrase in the document. It means there's still time to act. ThreatDown's estimate of how much time: six months.

The report is one of the more concrete assessments of the AI-and-cybercrime intersection published this year. It draws on original research into criminal AI marketplaces, guardrail-stripped models, malicious agent skills, shadow AI breaches, and the implications of Anthropic's Mythos for the vulnerability landscape. This post covers the key findings. A deeper practitioner piece on the agent skills and shadow AI attack surface will follow tomorrow.

The Criminal AI Market Is a Parasite on Legitimate Infrastructure

ThreatDown researchers mapped the storefront infrastructure of several prominent malicious AI tools — WormGPT, Kriminal, DadGPT, and Xanthorox — and found something that should give every vendor risk team pause. These tools don't build their own AI. They rent it.

Tracing each storefront's production JavaScript, CSP headers, and DNS and TLS records, researchers found the same legitimate vendors appearing repeatedly as the unwitting supply chain: Cloudflare, Vercel, Google Cloud, OpenRouter, xAI, Anthropic, DeepSeek, and Alibaba. Strip away the branding and most criminal AI is one of three things: a jailbroken wrapper around a mainstream model, a reseller proxying a legitimate API at markup, or outright vaporware. Genuinely custom-trained criminal models are rare.

WormGPT, one of the earliest criminal AI tools, now markets itself as an "Ethical Hacking AI." Xanthorox calls itself a development platform. The disclaimer is the camouflage. The practical implication: the same infrastructure your developers use may also be serving your adversaries.

22 Million Downloads of Guardrail-Stripped Models in 30 Days

As the capability of small open-source models grows, criminals' reliance on large centralized providers is diminishing. In July 2026, ThreatDown researchers found over 6,644 models published openly on Hugging Face under self-declared guardrail-free labels: "abliterated," "uncensored," "heretic," "decensored," "unfiltered." Together, they accumulated tens of millions of downloads in a single 30-day window. Publishing volume grew approximately threefold between Q4 2025 and Q2 2026.

Abliteration — stripping refusal behavior from an open-source model without retraining — still requires specialist knowledge to perform. But criminals don't need to perform it themselves. Thousands of pre-abliterated models are freely downloadable. A criminal weighing $50/week for GhostGPT against a free model that runs offline with no provider logging the prompts has an easy decision.

The detection problem this creates is significant. When a criminal runs an abliterated model locally, no provider sees the prompts. No blocklist catches the traffic. Malware families already exploiting this pattern generate malicious logic in memory at runtime and discard it — leaving signature-based detection with nothing to match.

Malicious Agent Skills: A New Attack Surface Category

In January 2026, a locally-run personal AI agent called OpenClaw went viral, triggering a Mac mini shortage as users rushed to buy hardware to run it. By the end of March 2026, approximately half a million OpenClaw instances were exposed on the public internet, most installed by employees without IT's knowledge.

OpenClaw's official marketplace, ClawHub, had malicious skills within days of launch. A security researcher found over 1,000 within a month, including the site's most downloaded skill. ThreatDown's researchers documented skills that stole credentials and exfiltrated data, installed malware, and poisoned an agent's core memory files for persistence. Malicious behavior was typically embedded inside otherwise functional skills so agents operated normally while harmful operations ran in the background.

When security scanners began searching for harmful payloads, criminals adapted. The next generation of malicious skill contained no malicious code at all — just a fake "get rich with AI" blog post instructing users to download a binary called Polymarket.exe. That binary delivered GachiLoader, which used fileless injection to install Rhadamanthys, a sophisticated infostealer that harvests credentials for identity attacks. GachiLoader's command-and-control infrastructure was hosted on a Polygon blockchain smart contract — immutable and impossible to take down through conventional means. Detection rate across major endpoint security products at the time of discovery: near zero.

Shadow AI: One in Five Organizations Breached in 2025

One in five organizations suffered a breach linked to shadow AI in 2025, costing an average of $670,000 more than a standard incident, per IBM data cited in the report. Nearly half of employees who use generative AI at work do so through personal, unmanaged accounts.

The 500,000 OpenClaw instances exposed on the public internet are the clearest illustration of the scale. Between February and April 2026, a public vulnerability tracker logged over 100 separate security advisories for OpenClaw alone. The report is explicit: every AI tool account an employee creates without IT's knowledge is a potential identity attack waiting to happen — not just because of what users share with the tool, but because the OAuth credentials, API keys, and session tokens used to access AI tools have joined the list of secrets that need defending.

The report's conclusion calls out "unsanctioned AI tools, agent skills, and MCP connections" specifically as the shadow AI attack surface IT teams currently can't see.

The Mythos Factor: The Scenario That Changes the Math

In May 2026, Google's Threat Intelligence Group identified what it believes to be the first known zero-day exploit developed by criminals using AI. Only a month earlier, Anthropic had unveiled Mythos — and simultaneously withheld it from public release because it proved far more adept at exploiting software than its creators anticipated.

During testing, Mythos found and exploited zero-day vulnerabilities in every major operating system and web browser tested, including a 27-year-old bug in OpenBSD. Engineers with no formal security background used it to find remote code execution vulnerabilities while they slept. The UK AI Security Institute tested it against a 32-step simulated corporate network takeover — estimated to require approximately 20 hours from human professionals. Mythos completed it end-to-end. Firefox shipped 423 bug fixes in April 2026, compared to 31 in April 2025. Mozilla's CTO described the experience as giving the team "vertigo."

Here's the counterintuitive finding the report surfaces: Mythos-class capability reaching defenders first isn't straightforwardly good news. Models capable of finding vulnerabilities at this scale will generate patch volumes that dwarf anything organizations currently manage. Because every new patch is an opportunity for criminals to reverse engineer an exploit, the number of exploits available to criminals in the short term could actually grow massively — even as the underlying vulnerabilities are being found and fixed. Organizations already behind on patching won't suddenly find ten times the capacity to handle ten times the fixes. The window in which exploits remain effective will grow, not shrink. As the report states directly: "The volume of work that Mythos-class models will create for defenders is as significant as the threat they pose in the wrong hands."

Anthropic's CEO has assessed that models from China with comparable capability are likely to be broadly available within 6 to 12 months. ThreatDown's estimate: Mythos-class capability could reach criminal marketplaces within six months.

Three Things to Do Before the Window Closes

ThreatDown organizes the response across three priorities.

Patch like the clock is running — because it is. Automate vulnerability assessment and patch management now, before the volume of patches organizations need to process increases by an order of magnitude. Organizations with disciplined, automated patching will be more secure. Those that don't will face an ever-growing backlog of unpatched systems and criminals armed with an ever-expanding library of exploits.

Monitor continuously, 24/7 — AI makes every threat actor faster, smarter, and more scalable, but it doesn't create new tactics. Data is still on the endpoints. Access is still obtained through stolen identities. Organizations need SOC coverage or a managed detection and response service capable of detecting early signs of AI-driven attacks rapidly. Behavioral endpoint detection is no longer optional — static signature scanning will not catch AI-generated, in-memory malware.

Find and govern your shadow AI — unsanctioned AI tools, agent skills, and MCP connections are a growing compliance, privacy, and security risk that IT teams currently can't see. AI detection and response tooling specifically designed to surface the shadow AI attack surface is the starting point — not to shut it down, but to see it clearly enough to manage it.

The report is worth reading in full. ThreatDown's conclusion puts it plainly: "The organizations that come through this moment intact will be the ones that saw it clearly and acted while the clock still favored the prepared."

Download the full report: Cybercrime in the Age of AI (ThreatDown, July 2026, PDF)