5 AI-Driven Cyber Threats in 2026 and How to Defend

Most writing about AI and cybercrime mixes documented findings with fear. This article keeps to what government and standards bodies have actually published, and for each of five threats it explains what the source says, what it does not say, and what defenders can do. It is about defence. It contains no instructions for carrying out an attack.

1. How is AI changing fraud and phishing?

What the source says. In a public service announcement dated December 3, 2024, the FBI's Internet Crime Complaint Center warned that criminals use generative AI to commit fraud on a larger scale and make schemes more believable. It lists AI-generated text used for social engineering and spear phishing, for romance and investment schemes, for fake social media profiles and for translations that remove the grammar mistakes that once gave scams away.

What it does not say. The alert does not give a rate or a count of AI-assisted fraud. It describes methods, not how common each one is.

How to defend. The FBI advises not sharing sensitive information with people known only online or by phone, and not sending money, gift cards or cryptocurrency to people you have only met that way. For organisations, the practical consequence is that poor spelling is no longer a dependable warning sign, so training should focus on verifying requests, not spotting typos.

2. What is the risk from deepfake voices, images and video?

What the sources say. The same FBI alert says criminals clone the voices of public figures or family members, for example to pose as a relative in a crisis and ask for urgent money. It also describes deepfake video used in live chats to pose as executives or authorities, and generated images used as fake IDs or profile photos. Separately, the US Treasury's FinCEN issued an alert on November 13, 2024 reporting an increase in suspicious activity reports from financial institutions suspecting deepfake use, with the most common concern being fraudulent identity documents used to get past identity verification.

What they do not say. Neither source measures how often deepfake attempts succeed. FinCEN's observation concerns reports filed by institutions, which reflect what they noticed and reported.

For businesses, the lesson of the FinCEN alert is that a single check, such as a photo ID or a video call, should not be the only gate for payments or account changes. Layer the checks and require a second, independent confirmation for high-value requests.

3. What are prompt injection and agent hijacking?

What the sources say. OWASP's 2025 list of risks for large language model applications defines prompt injection as inputs that alter a model's behaviour in unintended ways. It separates direct injection, where a user's own input changes the model's behaviour, from indirect injection, where instructions hidden in outside content such as websites or files affect it. The UK NCSC's blog post of December 8, 2025 adds that current models do not enforce a security boundary between instructions and data, so prompt injection may never be fully mitigated the way SQL injection can. The NCSC recommends treating the model as an 'inherently confusable deputy' and reducing the likelihood and impact of attacks.

Why agents raise the stakes. A chatbot that can only write text can do limited harm if misled. An AI agent with access to email, files, code or payment tools can act on what it reads. OWASP separately lists 'excessive agency' as a risk, meaning a system given more capability than the task needs. That is why the permissions you grant an agent matter more than the cleverness of any filter.

What the sources do not claim. Neither says prompt injection is a solved or an unsolvable problem in practice. OWASP says it is unclear whether it can be fully prevented, so its mitigations aim to reduce impact.

• Least privilege. Give the application its own limited credentials and run privileged actions in ordinary code, not through the model. The NCSC puts it as: when a model processes information from a party, its privileges should drop to that party's level.
• Human approval for high-risk actions. Require a person to confirm anything irreversible or sensitive.
• Mark untrusted content. Label external content so it carries less weight than your own instructions, but do not rely on labels alone. The NCSC warns that deny-lists of known attack phrases can be bypassed by rephrasing.
• Validate outputs. Define expected output formats and check them with deterministic code.
• Log and monitor. Record inputs, outputs and tool calls so suspicious activity and failed attempts can be seen.
• Test adversarially. OWASP advises regular attack simulations and treating the model as an untrusted user.

If you are choosing or deploying agents, our guides on what an AI coding agent is and 10 AI agent platforms businesses are evaluating cover permissions and oversight questions to ask before granting access.

4. Will AI speed up the discovery and exploitation of software flaws?

What the source says. The NCSC's assessment 'Impact of AI on cyber threat from now to 2027', published on May 7, 2025, calls AI-assisted vulnerability research and exploit development a major shift. It states that the time between a flaw's disclosure and its exploitation has shrunk to days and that AI will likely shorten that window further. It also judges a realistic possibility that critical systems become more vulnerable to advanced threat actors by 2027, but only if mitigations lag or stay unchanged, and it expects a digital divide between organisations that keep pace and a large proportion that do not.

What it does not say. It is a forward-looking assessment with stated probability language, not a measurement of what has already happened. It is also scoped to intrusion, not to every kind of AI-enabled threat. We read the NCSC page's summary, not the full PDF, so check the original for the exact wording of each judgement.

How to defend. The assessment's practical message is that fundamentals, applied faster, matter most: shorten your patching cycle for internet-facing systems, know what software you run, and keep logging and recovery tested. The NCSC also notes AI can help defenders secure systems, so security teams should evaluate it for their own work.

5. What is data poisoning and the AI supply chain risk?

What the sources say. A joint Cybersecurity Information Sheet from CISA and partner agencies, 'AI Data Security: Best Practices for Securing Data Used to Train & Operate AI Systems' (May 2025, version 1.0), examines three data risks: the data supply chain, maliciously modified data and data drift. It describes 'split-view poisoning' of curated web-scale datasets, where a dataset points to content on domains whose registration has lapsed, so a buyer of the expired domain can control what the dataset serves. The sheet estimates that effective poisoning of some such datasets could cost roughly $1,000, and as little as $60 for one named dataset. Those are the agencies' own estimates and we could not verify them independently. NIST's report AI 100-2 E2025, a taxonomy of adversarial machine learning attacks published in March 2025, gives shared vocabulary for poisoning, evasion and privacy attacks.

What they do not say. They do not report how many real models have been poisoned. The risk is described as a viable threat, not a count of incidents.

• Verify before ingesting. Check datasets for malicious or inaccurate material, and add a digital signature at the time of ingestion.
• Track provenance. Source data from authoritative origins and keep records of where it came from, including content credentials for media.
• Hash raw data. Attach cryptographic hashes so unauthorised changes can be detected.
• Protect storage and access. Encrypt data and restrict who can change it.
• Watch for drift. Monitor deployed systems, since changes in input data can degrade results even without an attacker.

For ordinary users the equivalent step is knowing where a tool's data goes. Our explainer on AI data retention questions lists what to ask a vendor.

What do the five threats have in common?

Each exploits trust that cannot be checked at a glance: a message that reads as human, a voice that sounds familiar, text that a model cannot tell from an instruction, a patch window that closes sooner, or a dataset assumed to be clean. The recurring defences are therefore about adding checks that do not depend on trust: independent verification, narrow permissions, human approval, fast patching and records of where things came from.

These threats also overlap with the failures we document elsewhere. Our report on AI safety incidents and warning signs of 2026 shows how access and oversight gaps, not exotic behaviour, explain many real cases, and our risks of superintelligence page covers the longer-term questions that are separate from everyday security. For how we weigh claims like these, see our vendor claims versus verified findings guide and methodology.

What are the limitations of this article?

• It summarises public guidance. It is not tailored security advice, and it is not a substitute for a professional assessment of your systems.
• Several sources date from 2024 and 2025. Threats and guidance change, so check the originals for updates.
• We did not use vendor threat reports or loss statistics, because their methods varied and we could not check them. That means this article says little about how common each threat is.
• We read the NCSC AI assessment through its web page, not the full report, and the CISA sheet through a text extraction of its PDF. Check exact wording in the originals before relying on it.
• The list is not exhaustive and is not a ranking of severity.