Cyber Criminals Left Their AI Hacking Tools Open to the Internet
Coalition security researchers have uncovered thousands of AI hacking harnesses on the open internet.
Not all of these harnesses are being used for malicious activity, but those that are provide a rare view of how threat actors use AI in live attacks. The traces show AI handling the high-volume work, such as running scans and writing exploit variants, while humans still run the infrastructure and move money.
We’ve already seen signs of how attackers are adopting AI, but our latest discovery is a smoking gun that carries implications for the future of the cyber insurance market.
Thousands of Harnesses, 66 With Signs of Real Intrusions
A harness gives an AI model access to a suite of security tools and capabilities. Harnesses allow models to run the same open-source scanners and testing tools used by professional penetration testers, pull known exploits from public libraries, and execute code against live systems.
The harness also gives an AI model persistent memory of what it has tried and lets it run multiple agents in parallel, so the work can continue unattended without a skilled human directing each step.
Coalition searched for IP addresses with activity that suggests an offensive security harness is in use and identified thousands of instances across various open-source harnesses.
Many of these consoles belong to legitimate penetration testers, but 66 hosts had open working folders or exposed agent interfaces that suggest these harnesses are being used for real intrusions. Two cases illustrate what is possible with these harnesses.
1. A Gambling Platform Compromised for Two Weeks
One operator ran the open-source Strix harness against gambling sites. Strix's built-in instructions tell the model that the user is “a verified, authorized tester,” but the base model can still refuse to respond to a prompt if it suspects the prompt is malicious.
To get around this problem, the operator cycled through DeepSeek, Gemini, and Z.ai’s General Language Model (GLM) until a model cooperated.
After finding a compliant model, the operator managed to compromise a gambling platform's admin backend for about two weeks, using both software exploits and stolen credentials. The script ran 2,968 health checks and re-compromised the platform four times, before losing access for good.
2. A US Water Utility on the Target List
Another Strix operator left their home folder exposed to the internet. This provided evidence that the operator was conducting reconnaissance of a US water utility's customer billing and water portal, and that the operator had a mass target list for Adobe ColdFusion servers.
We saw no evidence of a breach; this was a customer portal rather than the control systems. Targeting this utility may have been accidental, given that Strix's built-in instructions tell the model that the target list is “the starting scope, not a ceiling.”
However, this example illustrates a threat of harnesses operating without human oversight, as an attacker would likely avoid targeting critical national infrastructure due to the potential backlash that comes with it.
Why Harnesses Matter
A harness changes what an AI model can accomplish. Compare this with how a broker might use an LLM to analyze a new policy form:
Basic prompt: Typing “is this policy any good?” gets a bland answer.
Expert prompt: A prompt that incorporates the broker’s expertise of what factors lead to claims would more reliably identify coverage gaps.
Hacking works the same way:
Bare model: When told to “find vulnerabilities,” an off-the-shelf LLM may get stuck or give up before finding an exploitable flaw.
Harness: When given access to pen testing tools, software exploits, a record of failed attempts, and many agents working at once, the model keeps going until it finds a way in.
The difference is visible in practice. Daniel Stenberg, maintainer of the popular curl project, announced that Anthropic's Mythos and OpenAI's Codex Security had both been run against it and had nothing more to report. Nine days later, a security company called AISLE pointed its own harness at the same code and reported six new vulnerabilities in curl, highlighting how harnesses elevate the performance of even frontier models.
Will Today’s Experiments Become Tomorrow’s Cyber Claims?
It might be easy to dismiss our findings as attackers conducting clumsy experiments that can barely gain initial access and maintain persistence, let alone extract financial gains that might motivate an attacker to scale up these attacks.
But the more worrying line of thought is that our scans only reveal the incompetent attackers. The good ones won’t leave their tools exposed to the internet; instead, they’ll learn from these experiments and start to build better harnesses, not least because the harnesses Coalition identified were released as open-source projects that anyone can modify. Eventually, we expect this kind of technology to be industrialized, much like AI-enabled phishing kits were earlier this year.
One such kit, EvilTokens, first appeared in February 2026 and was sold on Telegram as a SaaS solution that could use AI to write lures, bypass multi-factor authentication, and search compromised inboxes. By September, Microsoft had tied it to more than 12,000 inboxes at over 10,000 organizations. The creators of EvilTokens extracted over $1 million of revenue before the service was taken down.
There’s serious money in cybercrime, and that will motivate some enterprising criminal to use AI to scale it. That is the threat to the cyber insurance market that Coalition is monitoring.