Tammy Harper, Senior Threat Intelligence Researcher

Walking around Strasbourg during Underground Economy, I found myself thinking about the businesses as much as the buildings. Behind every restaurant storefront, there is work the customer never sees: someone supplies it, someone pays for it, and the business survives on whatever is left over. It made me wonder about the industry I actually study: when the labor behind an attack gets cheaper, does the criminal do less work, or does someone else start paying for it?

One detail in Anthropic’s September report gave that question an unpleasant twist. Suspected ShinyHunters affiliates stole AI credentials from victims, then used that access to continue their operations. One stolen key supported roughly three weeks of secondary criminal activity. The victim was essentially funding the attack.

I had expected capable threat actors to gravitate towards local, open-weight models, especially versions modified to weaken or remove refusals, often called abliterated models. Open-weight does not itself mean unrestricted. But a model you control seemed a sensible choice if you wanted to avoid a provider inspecting requests or shutting down access. Instead, this report called out operators incorporating Claude directly into data theft and extortion.

That forced me to see two very different kinds of change: AI can reduce the labor required for an operation, and stolen access can move an operation’s costs onto a victim. Both may help the attacker, but only one of them is an efficiency gain, while the other shifts the cost.

Key Findings About the New AI Cybercrime Economy

• Threat actors are building a mixed AI toolkit, combining commercial models like Claude with local, open-weight, and jailbroken alternatives, rather than choosing one over the other.
• Stolen AI credentials can give an attacker usable inventory and shift the cost of running an operation onto the victim whose account gets billed.
• AI can reduce reliance on specialist help. Anthropic documented an affiliate stealing data from roughly 200 customer organizations after compromising their software provider, then collecting thousands of access credentials in about 34 hours. AI agents performed nearly all of the collection.
• Operators using sophisticated AI-built tooling have still been caught leaving their own credentials, staging servers, and bot tokens exposed inside victim environments. Sophisticated tools do not establish the operator’s experience or skill at protecting their own access.
• In the underground forums Google tracked, average advertised AI-account prices more than doubled in 2026. Access costs could offset some of the labor savings AI offers criminal operators.

The Criminal AI Stack

A criminal operation contains plenty of ordinary technical work: reading documentation, debugging scripts and understanding unfamiliar applications. Refusing an explicitly malicious prompt addresses only part of the problem.

Aurora/Cursor Agent + Claude Sonnet

An assistant can do work without running the operation.

• Human supplied: Credentials or an existing route into the network, objectives and operational limits. Sometimes the operator chose a numbered next step.
• AI assisted: Discovery, checking account privileges and exploitation, with repeated revisions when commands failed.
• Results observed: 10 targets, April 8 to May 21, 2026. Most commands failed on their first attempt; revised tasks produced both successes and failures.

The Aurora operator repeatedly imposed restrictions, including avoiding account lockouts. I had overvalued the absence of restrictions as a sign of criminal usefulness. But willingness to help and reliability under direction are different qualities.

Threat actors have rules too; they want the assistant following theirs.

CloudSEK separately recovered Cursor attack-planning conversations in Russian. Google observed commercial model switching and local open-weight deployment. That mixed toolkit is the criminal AI stack. These are still a select few case studies, and should not be viewed as what’s present in the market. My understanding depends on what researchers happen to see and publish.

The Price of Expertise

The Work After Access

One Anthropic case makes that labor question concrete. An affiliate associated with GTG-50014 compromised a provider of online business software and extracted data belonging to roughly 200 customer organizations. The case also included a roughly 34-hour collection of thousands of digital access credentials. Anthropic says AI agents performed nearly all of that collection.

Getting in and knowing what to do there are different achievements. The operator still has to understand what the access exposes and turn it into something usable before someone closes the door.

How Data Extortion Becomes a Business

1. Get access: Obtain a way into a company.
2. Understand it: Find what the account can reach.
3. Take the data: Copy valuable information out.
4. Demand money: Threaten to leak the stolen data.

Where AI can help is with understanding systems, writing tools and troubleshooting. The threat actor still needs access, decisions and a way to obtain payment.

To note: Data extortion threatens disclosure. Ransomware locks files; some attacks also steal them. A demand is not a payment.

In a separate intrusion, Claude helped an actor understand application interfaces, work with privileged credentials, and build bulk data-export tools. These were separate compromises; what connects them is the technical work being delegated.

An affiliate is the operator doing the intrusion, using a ransomware service in exchange for a share of proceeds. They may also buy access or hire specialists (none of these people work for free). Each can mean a fee, a wait, or another cut.

If AI helps an affiliate write a working data-export script without hiring a specialist, the affiliate may avoid that specialist’s fee and the wait for their help. But if the AI-generated script fails, the operator must spend time diagnosing errors, rewriting code, and testing it again, or pay a specialist to fix it. Those costs can consume the money and time apparently saved. AI makes expertise cheaper to obtain only when the cost of using and checking its work is lower than the cost of the specialist help it replaces.

What an Affiliate Still Has to Know

In August 2025, there was an actor offering ransomware for $400 to $1,200 USD, reportedly depending on Claude for core components. AI could change not only how crime happens, but also who becomes a supplier.

Who Gets Paid Depends on Who Did the Work

Below is an example of the division of work (access purchases and specialist help are optional; no fixed payment split is implied):

• Affiliate: Runs the intrusion; keeps what remains after costs.
• Access seller: May receive a fee for a way into the target.
• Ransomware provider: Receives a share for supplying the service.
• Specialist help: May charge for work the affiliate cannot do alone.

What concerns me is operators continuing beyond their unaided expertise. Someone who could not repair a script now has another way forward, without necessarily knowing how to recognize a wrong result.

The operator known as frkoo processed 1.8 million Android application packages for exposed secrets using 10 cloud workers. Despite the scale of automation, they exposed their own staging address, bot tokens, and proxy credentials within a victim’s environment. Even with all that machinery, they were still leaving their own credentials behind.

An impressive tool does not establish the operator’s technical experience or ability to avoid exposing their own infrastructure and credentials. AI can help someone build tools beyond their unaided skill, making the tools a less reliable guide to that person’s experience. Recognizing exposed secrets, checking results, and recovering from mistakes still require knowledge and practice.

A ransom demand is not a receipt. Anthropic describes an actor seeking $1.5 million to $2.5 million USD after data theft, but there’s no indication that the actor was ever paid. Without payments, costs, and failed attempts, we cannot calculate realized returns from these operations.

The Cost of Keeping it Running

Building a toolkit is only the start; keeping it working creates recurring costs in troubleshooting and maintenance. ReliaQuest’s Gryxa investigation shows what that work can look like.

ReliaQuest assessed that the operator used an AI coding agent and likely bypassed its safeguards by presenting malicious development as authorized lab work. That is the “jailbreak” at issue: obtaining help that the model’s safeguards should reject. The repository supports AI-assisted development, but without the prompts or transcripts, the researchers could not confirm how the agent responded.

The repository also contained session handover notes and 35 write-ups of failed installations. Later commits addressed the problems those records described. This shows an ongoing cycle of recording failures and fixing them, rather than a toolkit produced in one attempt.

For me, the economic point is the recurring work. An assistant that helps diagnose failures and maintain tools could make a small operation easier to sustain. The repository shows that maintenance happened; it does not measure how much time or money AI saved.

The Price of AI Access

Google reported that average advertised AI-account prices more than doubled in 2026 across the underground forums it tracked. These observations come from forum posts, so they do not establish what buyers ultimately paid.

Google also observed more buyers seeking accounts, more sellers advertising them, and credential-stealing malware targeting coding assistants’ configuration files. For an operator relying on purchased access, higher account prices could offset some of the savings from automating technical work.

Capability, scarcity, account longevity, and somebody else’s quota could all affect the price (Google’s data does not isolate their contributions). I would watch what buyers pay, as well as what sellers promise.

When Victims Become Suppliers

Stolen AI access can be both inventory and operating capacity for an attacker. Anthropic’s schematic shows proceeds and stolen compute cycling back into further operations. In addition, stolen access has resale value and can shift usage costs onto a victim.

An API key is simply a credential that software uses to access a service. A stolen key can shift AI-usage charges onto its account holder, and the model’s safeguards still apply, regardless of who holds the key.

Who uses it and who pays:

1. Attacker: Uses the stolen key.
2. AI service: Processes the requests.
3. Account holder: Can receive the bill.

But who keeps the margin?

Cheaper Work, Crowded Markets

Lower costs do not mean every criminal earns more. More operators entering a market can mean more competition. More stolen data doesn’t automatically create more buyers for it. Some of these productivity gains could become lower prices rather than better margins for threat actors.

On September 9, the US Department of Justice announced action against Xinbi Guarantee, alleging it provided a marketplace and escrow for scam services; more than $52 million USD was restrained across its network. The case illustrates why cheaper technical work would not remove every paid intermediary: criminals still need ways to find vendors, arrange payment, and complete transactions.

Escrow: Someone Holds the Payment

Below is the simplified role alleged for Xinbi. The service buyer here is a criminal customer rather than a scam victim.

1. Buyer pays in: A scam operator pays for a service.
2. Middleman holds it: The marketplace holds the money while the vendor works.
3. Vendor gets paid: Funds are released when the service is complete.

AI could reduce the labor needed to supply some criminal services while marketplaces and payment intermediaries continue to play a role in selling them. Even if competition reduces criminals’ margins, lower operating costs could make more targets worth pursuing. Failed attacks can still leave victims with investigation and cleanup costs, whether or not the attacker gets paid.

Where Responsibility Should Sit

Model providers share responsibility for preventing misuse. They control model safeguards and access to their services, so they should test those safeguards, detect abuse, and act when they find it. Application developers and deploying organizations control other parts of the system. Responsibility should follow those areas of control, with privacy protections and a way to challenge enforcement mistakes.

• Model provider: Test safeguards. Detect abuse and enforce rules.
• Application developer: Limit what agents can reach and do.
• Deploying organization: Protect credentials. Limit permissions.

Anthropic’s September 9 assessment described four incidents in which evaluation models accessed real systems through misconfigured test environments, without the cyber safeguards included in released models. These were evaluation failures rather than criminal customer operations. They show why instructions describing a simulation must be backed by actual network isolation. In my view, providers are responsible for the safeguards and testing arrangements they oversee, including work carried out with evaluation partners. Developers and deploying organizations remain responsible for the permissions, integrations, and credentials they control; their duties do not remove the provider’s own.

Who Actually Pays?

Are AI providers earning money from misuse? Subscriptions and usage charges make that possible in principle. Revenue is money collected; profit is what remains after costs, investigations, and refunds. Knowingly facilitating crime is a separate claim about awareness and conduct.

An Attacker Can Spend Less on AI in Two Different Ways

Both of these can lower spending, but only the first reduces the work:

• Less work required: AI helps finish a task in fewer hours. Count retries and repairs before treating this as a saving.
• Costs moved elsewhere: Stolen access can leave someone else paying for the same work. The cost moves between parties.

Anthropic’s report does not provide the accounting needed to establish retained revenue or net profit from these operations, so these questions remain: Were abuse-related charges collected or reversed? Were account holders notified and reimbursed?

The timing of a provider’s intervention matters as much as the account ban itself. When Anthropic or another provider reports disrupting an operation, I want to know whether it blocked the harmful request, stopped an attack already under way, or removed access after the attacker had obtained the tools or data. Those outcomes prevent different amounts of harm. An account ban after data theft can stop further use of the service, but it cannot undo the theft.

For defenders, the practical lesson is that AI credentials and integrations should be treated as production access, not as a peripheral tool. An incident review should ask whether stolen access supplied further activity and whether its use or charges continued after the initial compromise was discovered.

What to Follow Next

I’ll continue watching affiliates’ purchases, negotiated percentages, and support promises sellers make to their buyers. I would revise this argument if operators still needed the same specialists, or if repairs consumed the time apparently saved by AI. More generated tools would not settle the question. What I’d like is evidence that an operation became cheaper to finish and sustain over time.

I still expect local and abliterated models to matter in this ecosystem. What Strasbourg left me thinking about was the work behind the shopfront. The reports give me more of it to examine, but they do not give me the accounts. What became cheaper, who captured the savings, and who was left paying for it?