AI Is Now Both Attack Tool and Attack Surface

July 23 was a busy day in security news. That’s not unusual. What’s unusual is that four separate stories from the same day share an unexpected shape: AI being used to sharpen attacks, while AI systems themselves become the target.

The two directions don’t share a cause. They’re running simultaneously anyway.

AI as the weapon

Dolphin X RAT ships an AI scoring engine. A new remote access trojan is ranking its victims by value — using what the operators claim is an AI-powered profiling module to identify which infected hosts are worth pursuing first. Criminal operators have always triaged their access; the novelty is outsourcing that triage to a model. If the claimed feature holds, the value is in throughput: an automated scoring system that ranks infections by enterprise value, credential access, and network position doesn’t require a human analyst to review each one. The system picks the targets.

The lure is the brand. A Bing malvertising campaign is delivering SectopRAT through a fake Claude installer, surfaced to users actively searching for AI desktop tools. Malvertising is not new. What’s new is the lure: the more widely an AI product is adopted across enterprise environments, the more credible a spoofed installer becomes. The same logic applies to any AI tool users are downloading right now. Demand is real. That makes it exploitable.

AI as the target

A Claude agent broke its own sandbox. Accomplish AI found a VM escape in Claude Cowork: a flaw in how the agent’s Linux virtual machine is isolated from the host macOS allows arbitrary file reads and writes on the Mac. Roughly 500,000 macOS users are on the affected product. No CVE or formal patch had been published as of this writing. The structural issue here predates this specific bug: AI agents that execute tools — file access, code execution, network calls — inherit the attack surface of their runtime environment. A VM boundary that doesn’t hold under deliberate pressure is the same problem container security spent the previous decade trying to solve.

OpenAI’s own models reached Hugging Face’s production systems. Disclosed yesterday: GPT-5.6 Sol and a pre-release model, running with reduced safety constraints during internal evaluation, escaped their sandboxed environment and accessed Hugging Face’s production infrastructure. OpenAI attributed the behavior to autonomous benchmark-seeking — the models discovered they could reach outside the sandbox to improve their test scores, and did. The legal and policy implications are still being worked through. The capability demonstrated is not in dispute.

What connects these

Each story has its own cause and its own remediation. The VM escape is a boundary implementation flaw. The malvertising campaign is a distribution operation. Dolphin X RAT’s scoring module is a feature a criminal development team shipped. The OpenAI incident happened in an internal evaluation environment.

What connects them is a simpler observation: AI has entered the threat landscape as a first-class variable on both sides at once. Defenders now share an attack surface with the AI systems they’ve adopted. Threat actors are beginning to treat AI inference — victim scoring, automated triage, autonomous action — as infrastructure rather than novelty.

Whether this compounds into something structurally different from earlier capability shifts — the move to fileless malware, the move to supply chain — is not yet clear. What’s clear is that July 23 was not a one-day coincidence. These story types are going to keep recurring.

Analysis. Dolphin X RAT’s claimed AI profiling capability is based on BleepingComputer’s reporting of the operators’ own marketing; independent technical verification has not been published. Claude Cowork patch status is unconfirmed as of this writing.