Cisco Talos researchers found that cybercriminals are using AI coding assistants like Claude Code, Codex, Cursor, and Gemini to create malware. Attackers bypass safety guardrails by using task fragmentation, which involves splitting malicious requests into harmless-looking parts across multiple sessions and files.
The research, published in August 2026, highlights that attackers do not require complex jailbreak techniques to generate functional hacking tools. Existing AI safety controls currently struggle to detect malicious intent when it is distributed across separate interactions.
Cisco has been developing its Integrated AI Security and Safety Framework since late 2025. The company released the initial version in December 2025 and updated it in September 2026 to address threats such as goal hijacking, jailbreaks, and failures related to agentic autonomy.
Talos maintains a global threat intelligence network using tens of millions of sensors. The division combines AI-driven threat hunting with human analysis to monitor evolving cyber risks. The findings suggest that behavioral analytics and AI-focused red teaming are becoming essential for modern security.
