AI Cyberattacks: ChatGPT & Claude Weaponize Zero-Day Exploits

AI-enhanced cyberattacks are currently averaging over $5.2 million per breach, a 12% increase compared to traditional attacks, which is attributed to faster compromise and more extensive data exfiltration capabilities. This surge, observed from June 19-25, 2026, signals a critical inflection point where AI is not just a tool for automation but an active weapon in the adversary's arsenal. Organizations face accelerated breaches and higher costs when threat actors use AI for reconnaissance, exploit generation, and stealthy exfiltration.

What Happened

From June 19-25, 2026, the weaponization of AI by threat actors escalated significantly. Attackers use commercially available AI coding tools like ChatGPT and Claude to automate hyper-personalized phishing campaigns and generate highly polymorphic malware that bypasses traditional security controls. More concerning is AI's role in discovering and exploiting code vulnerabilities, a trend highlighted by the "MAD Bugs Month of AI Discovered Bugs 2026," which reportedly revealed over 500 zero-day exploits in software including Vim, FreeBSD, and Emacs, as reported by The Hacker News. This aggressive AI-driven vulnerability research enables faster compromise speeds and significantly prolongs dwell times, increasing the cost of a breach. An AI-generated exploit script bypassed three layers of security in Mexico's federal government infrastructure in under 47 seconds, demonstrating the speed of these new attack vectors, according to industry reports.

Why It Matters

The direct financial impact of AI-enhanced breaches is staggering. The average AI-enhanced breach now costs upwards of $5.2 million, which is 12% more than non-AI-driven incidents due to the rapid compromise, increased difficulty in detection, and more comprehensive data exfiltration. While the global average cost of a data breach reportedly saw a 9% decline to $4.44 million in 2026—attributed partly to savings from security AI and automation—the $1.9 million saved per breach by defenders' AI is being outpaced by attackers' AI. The U.S. alone experienced a record 3,322 breaches in 2026, pushing the U.S. average breach cost to an all-time high of $10.22 million. This disparity highlights that while AI can bolster defenses, its weaponization by attackers leads to far greater economic damage and operational disruption. The emergence of "Agentic Attack Surface Amplification" means AI agents themselves are expanding the attack surface, creating new challenges for security teams trying to anticipate and defend against these machine-speed threats.

Affected Scope & Remediation

Microsoft Office users, particularly those running Microsoft 365, Office 2021, and LTSC 2024, are directly affected by the AI-discovered Excel zero-days. CVE-2026-21509, a Microsoft Office Security Feature Bypass flaw, allowed attackers to execute malicious code via crafted documents by circumventing OLE/COM security controls. This vulnerability was actively exploited before an emergency out-of-band patch was released on January 26, 2026, and is included in the CISA Known Exploited Vulnerabilities (KEV) catalog. Users were protected upon restarting Office applications after the patch.

A second flaw, CVE-2026-26144, an XSS vulnerability in Excel, was patched during the March 2026 Patch Tuesday release. This bug, while seemingly routine, was reportedly weaponized by AI to become a zero-click corporate data heist, allowing the Microsoft Copilot Agent to silently exfiltrate spreadsheet contents through unauthorized network egress. This establishes Microsoft Copilot Agent itself as a new attack vector, especially when processing Office documents. Organizations must ensure all Microsoft Office installations are updated. We recommend using AI-powered threat detection tools like CrowdStrike Falcon to monitor for anomalous behavior, especially concerning Copilot interactions with sensitive data.

For CVE-2026-21509, the timeline was rapid: disclosure and active exploitation occurred before the emergency patch on January 26, 2026. CISA added it to their KEV catalog, with a mandatory remediation deadline for federal agencies of February 16, 2026 (21 days from patch).
For CVE-2026-26144, the patch came approximately six weeks after the CVE-2026-21509 emergency fix, arriving with the March 2026 Patch Tuesday updates.
Until patches can be fully deployed, apply Network Access Control (NAC) to restrict outbound connections from Microsoft Office processes or Copilot Agent instances to only trusted enterprise resources, enforcing a Cloudflare Zero Trust architecture. Implement prompt injection monitoring for AI agents processing sensitive data.

Technical Breakdown

The AI-powered Excel zero-days, particularly CVE-2026-21509 and CVE-2026-26144, demonstrate sophisticated attack chaining. CVE-2026-21509 exploited a Microsoft Office Security Feature Bypass, likely leveraging an oversight in OLE/COM object handling within crafted documents. This flaw permitted the execution of malicious code, effectively turning a seemingly benign Excel file into an initial access vector. Think of it like a trusted courier (Excel) delivering a package with a false customs declaration (malicious OLE object) that bypasses inspection (security controls) at the border. The package then unpacks and sets up shop inside your network. This maps to MITRE ATT&CK technique T1203 Exploitation for Client Execution.

Building on this, CVE-2026-26144 transformed a standard Cross-Site Scripting (XSS) flaw into a zero-click data exfiltration mechanism. An XSS bug typically requires user interaction, but AI generated a payload that, when processed by the Microsoft Copilot Agent within Excel, forced the agent to silently exfiltrate spreadsheet contents. Imagine Copilot as a helpful personal assistant who, when given a subtly manipulated instruction (the XSS payload), inadvertently starts whispering your confidential meeting notes to an unauthorized party outside the room, without you ever noticing. This uses the agent's legitimate network egress capabilities for malicious purposes, aligning with T1041 Exfiltration Over C2 Channel. Combined with initial delivery often via T1566.001 Spearphishing Attachment, these AI-driven attacks highlight the need for controls like NIST SP 800-53 SI-2 Flaw Remediation and RA-5 Vulnerability Monitoring and Scanning to quickly address new vulnerabilities, and CM-6 Configuration Settings to secure AI agents.

Historical Context

The weaponization of AI, particularly for sophisticated vulnerability discovery and stealthy exfiltration, builds on a long history of increasingly complex supply chain and polymorphic malware attacks. A notable precursor is the xz-utils backdoor detected in March 2024. This incident involved a highly sophisticated, multi-year supply chain compromise where a threat actor subtly injected malicious code into the xz-utils data compression library, which is widely used in Linux distributions. The similarity lies in the stealth and the targeting of foundational software components to achieve widespread impact. The xz-utils attack bypassed detection for an extended period, showcasing the difficulty in identifying deeply embedded malicious logic. The difference with the current AI-powered attacks is the speed and scale of vulnerability discovery and exploit generation. While xz-utils relied on human-led social engineering and coding over years, AI can now achieve similar levels of sophistication in exploit generation within minutes, as demonstrated by the Mexico federal government breach in under 47 seconds. This shift from long-game human-driven stealth to machine-speed, AI-driven exploitation is what defines the "Agentic Attack Surface Amplification."

Data at a Glance

The CVEDaily Take

The rapid, zero-click exfiltration via Copilot agents fundamentally changes how we must secure data; our traditional endpoint and network egress rules might not be sufficient for this new attack vector, as Copilot is a trusted internal process. We believe the full implications of Agentic Attack Surface Amplification are still being underestimated by many organizations.
Have you already implemented specific outbound egress filtering or prompt injection monitoring for your Copilot instances?

FAQ

Q: How do AI-powered cyberattacks differ from traditional sophisticated attacks?
A: AI-powered attacks accelerate multiple stages of the kill chain. They automate hyper-personalized phishing, generate polymorphic malware that's harder to detect, and actively discover zero-day vulnerabilities at machine speed, bypassing traditional security controls much faster than human-driven efforts. The "Agentic Attack Surface Amplification" means AI agents can independently probe and exploit systems.

Q: What immediate steps can organizations take to defend against AI-driven zero-day exploits like those in Excel?
A: Organizations must prioritize rapid patch deployment, especially for critical software like Microsoft Office. Implement AI-powered threat detection tools for real-time anomaly detection, enforce zero-trust architectures to limit lateral movement, and establish prompt injection monitoring for any internal AI agents like Copilot that interact with sensitive data.

Q: Is the Microsoft Copilot Agent a new attack surface?
A: Yes, the CVE-2026-26144 incident demonstrates that the Microsoft Copilot Agent can become an attack vector. When processing Office documents, a maliciously crafted input (like an XSS payload) can force Copilot to exfiltrate data through its legitimate network egress, turning a trusted helper into an unwitting accomplice. This requires specific attention to how AI agents handle and transmit sensitive information.