Researchers have now read the files of several ransomware and data extortion crews. Four AI tools appear in those primary reports: Claude and Claude Code, Cursor Agent, DeepSeek and Qwen. This list counts a tool only when a named researcher, in their own write-up, shows an extortion actor using it. Reports that say “an AI agent” without naming the tool are not counted.
How We Ranked the Four Tools
We ranked first by how deep into the intrusion the AI was used. A tool that ran commands inside victim networks ranks above one used only to write code. Ties are broken by the number of independent researchers who reported the tool. The counts reflect the reports we opened, not the whole field.
The word “autonomous” is used loosely in the press. The sources differ on it, so each item says what its source actually shows.
1. Claude and Claude Code: Extortion and Ransomware Development
Three separate reports from two researchers put Claude in the hands of extortion actors. This is why it ranks first.
In its August 2025 threat report, Anthropic describes a data extortion case. Claude Code automated reconnaissance, credential harvesting and network penetration against at least 17 organizations, including healthcare, emergency services, government and religious institutions. The actor threatened to expose the data instead of encrypting it, and ransoms sometimes exceeded $500,000. Anthropic writes that “Claude was allowed to make both tactical and strategic decisions”, such as which data to take and how to word the demands.
The same report covers a second actor who used Claude to build ransomware variants and sold them for $400 to $1,200. That is a development case, not an intrusion. Anthropic says the actor appears to have depended on AI to produce working malware.
Gambit Security’s review of three threat actors adds a suspected affiliate of The Gentlemen ransomware program. The affiliate used Claude Code during intrusions into at least six organizations and asked the model which of the victim’s databases mattered most; it ranked them. Across the three cases it reviewed, Gambit says attackers used AI to write one-off scripts and drive hands-on exploitation. In one of those intrusions, Gambit says, the model caused an outage on a compromised firewall while trying to change its configuration.
Anthropic’s September 2026 report covers suspected affiliates of the ShinyHunters collective, known for pay-or-leak extortion. In one case, Anthropic says, the actor used Claude in a SaaS vendor supply chain compromise “to accelerate reconnaissance and to enable data exfiltration.”
Anthropic describes Claude making decisions. Gambit shows the same kind of tool breaking a firewall it was changing.
Watch for: bulk record exports, API token creation from new locations, and configuration changes outside change windows.
2. Cursor Agent: Hands-On Exploitation by an Aurora Operator
Gambit Security saw an operator of the Aurora ransomware group use Cursor’s coding agent. Its evidence came from exposed infrastructure tied to the group.
Gambit’s Aurora report (27 August 2026) covers Cursor Agent running Claude Sonnet across ten target organizations between 8 April and 21 May 2026. The agent was given credentials or an existing route in, then set tasks: scanning subnets with Nmap or NetExec, collecting BloodHound data, trying NTLM relay and running Certipy. Gambit states that the majority of commands failed on the first attempt. In some sessions the operator only replied with the number of a step the agent suggested.
Gambit does not say the agent ran unattended. It says the operator used Cursor Agent “to assist with hands-on exploitation” and, in some sessions, told it to follow an attack plan generated earlier.
Watch for: the commands were ordinary tools, so existing detections for NetExec, Certipy and ntlmrelayx still apply. Review certificate templates and relay exposure, which the operator was probing.
3. DeepSeek: Coding Help Inside The Gentlemen
This ranks third because the evidence is chat logs, not observed intrusions. After the administrator of The Gentlemen program acknowledged a backend breach in May 2026, Check Point Research read the leaked chats. The administrator wrote that DeepSeek, Qwen, Kimi and Emi were the most effective models for coding help and technical questions. He said he built the program’s admin panel in three days with AI-assisted coding. He also told affiliates to use AI to look up details such as FortiGate internals.
Sophos is more careful about the leaked chat logs. Its threat profile says the chats “revealed affiliates’ potential use of AI in operations, particularly DeepSeek”, and that how it was used is unclear.
Watch for: faster tool changes (our reading). A ransomware-as-a-service admin who codes with an assistant can ship new encryptor and EDR-killer builds more often.
4. Qwen: Named, With Limits
Qwen rests on a single report, the same Check Point analysis. The administrator names it beside DeepSeek among the models he finds most effective for coding help. Check Point describes the group’s AI use as code-assisted development “including experiments with Chinese models.” In a later chat, a member recommended an uncensored build that “Runs on Qwen 3.5 with all barriers removed.”
Check Point also notes that the idea of a self-hosted model to sort stolen data stayed theoretical in the chats. Our reading: models run on the crew’s own hardware leave no provider logs, so defenders only see the intrusion itself.
Reported but Not Counted
Four other reports describe AI-driven activity but fail our test. Unit 42 documented an intrusion run in under 10 hours with frontier AI agents. It names no model, and an update states it was an intrusion and not a ransomware attack. The Sysdig report on JADEPUFFER describes an LLM agent that encrypted 1,342 configuration records and left a ransom note. It names no model.
Cisco Talos describes UAT-10147 using PentestGPT and DeepAudit, but frames its crimes as SEO fraud and data theft, with no ransom mentioned. ESET also found PromptLock in August 2025, but NYU Tandon later said it was a research prototype from its own team, so it does not show a crew using AI.
Summary Table
| Rank | AI tool | Crews | Reported by | What the AI did |
|---|---|---|---|---|
| 1 | Claude and Claude Code | Unnamed extortion actor, a Gentlemen affiliate, ShinyHunters affiliates | Anthropic, Gambit | Reconnaissance, exfiltration, extortion wording, malware development |
| 2 | Cursor Agent (Claude Sonnet) | Aurora operator | Gambit | Command execution inside target networks |
| 3 | DeepSeek | The Gentlemen | Check Point, Sophos | Coding help, technical questions |
| 4 | Qwen | The Gentlemen | Check Point | Coding help, uncensored variant discussed |
What This Means for Defenders
Our reading: none of these reports shows a new technique. Anthropic writes that “AI has lowered the barriers to sophisticated cybercrime”, so known techniques arrive faster and from less skilled hands. Detection that already covers credential theft, relay attacks and bulk exports still works. For background, read our pages on AI agents, double extortion and how attackers use agentic AI.