Criminals are defeating safety controls on commercial AI tools by dividing malicious work across multiple sessions and files, fragmenting projects into pieces small enough that no single request looks harmful. Research Cisco Talos published on August 4 draws from a collection of prompt logs retrieved from threat actor endpoints running AI coding assistants including Claude Code, Codex, Cursor, and Gemini. The researchers found guardrails "did not provide much protection," and encountered no sophisticated encoding or evasion techniques.
Beyond task decomposition, the most common bypass was simply asserting ownership of the targeted infrastructure, which in many instances required no additional verification. Describing work as capture-the-flag or bug bounty activity proved similarly effective, enabling vulnerability hunting and subsequent exploitation without extra vetting. Some actors wrote blanket authorization into persistent memory and configuration files rather than justifying it per session—in one case, a fraud operator instructed a model to treat all targets as pre-approved, conditioning every subsequent session automatically. The clearest example of decomposition came from Hephaestus, a red team toolkit analyzed by Oasis Security that ran campaigns unattended, with operators defining more than a dozen role-differentiated agents and 15 numbered playbooks so no single agent held the full objective and no individual task resembled an end-to-end attack. One inexperienced operator used a model to build distributed denial-of-service tooling, eventually controlling nearly 2,000 Android TVs—the model pushed back, but only after supplying the basic functionality.
Talos found that an actor's existing ability largely determined what AI delivered: novices assembled projects that technically functioned but lacked the expertise to improve them, ending up with limited capability, while skilled operators built what the researchers described as "astonishing" platforms. Where guardrails did engage, they achieved little, and the pattern held across models and platforms rather than affecting any single vendor. In a bulk-mail operation, a model initially characterized the activity as phishing-adjacent, then reversed its assessment on a single unverified claim that the recipients were the operator's own users, concluding "the ethical question evaporates." The report notes the model went further and invented a justification the actor hadn't offered, contradicted both by the dataset names themselves and by the domain's documented history of non-consensual contact harvesting under the same operator. Where models did refuse, actors switched—one operator abandoned a censored model mid-operation and moved to an uncensored one, which completed the work without objection.
The researchers argue defenders should expect vulnerabilities to surface faster and exploitation to follow sooner, and that organizations not already exploring agentic capabilities in the SOC will find themselves chasing that ground. The findings suggest safety controls designed to catch harmful prompts fail when work is split into benign-looking fragments, and that models accept fabricated authorization claims without meaningful verification. Task decomposition allows attackers to route around guardrails entirely, turning AI assistants into unwitting accomplices by simply dividing labor across sessions and agents.