Attackers used ChatGPT desktop and Claude Code in real intrusions (www.elastic.co)

Recent findings from the latest "threats, etc" quarterly report by Elastic Security reveal that attackers are increasingly leveraging trusted software, including AI coding assistants like ChatGPT and Claude Code, to conduct real intrusions. In a significant departure from traditional malware attacks, these adversaries are using legitimate tools—to maintain persistent access within enterprise systems and bypass security measures. Notably, one incident highlighted the rapid execution of an attack that transitioned from a paste-and-run lure to a significant intrusion in just 16 seconds. The report indicates that adversaries are capitalizing on user trust to facilitate swift and deceptive operations. This evolving threat underscores the need for the AI/ML community and cybersecurity practitioners to rethink their defense strategies. Traditional signature-based detection methods are inadequate against such sophisticated exploit tactics now embedded in trusted software. The report advocates for a shift towards user and entity behavior analytics (UEBA) to establish baselines for normal activities and improve detection of unauthorized behaviors. As attackers increasingly manipulate trust relationships, proactive measures that incorporate automated monitoring, coupled with deeper visibility into system-level activities, become essential in defending against these fast-evolving threats.