Flashpoint: Illicit AI chatter up 18% in September 2026, KYC bypass posts up 56%, AI agent frameworks used in offensive ops
Flashpoint reports that illicit-community discussion of artificial intelligence rose to 8,837,186 posts in September 2026, up about 18% from 7,461,908 in August. Telegram remained the dominant venue with 6,309,872 posts, up about 29%. Posts advertising or discussing AI-enabled KYC bypass, including deepfakes, reached 1,171,914, up about 56% month over month and nearly triple the July figure of 394,567. Flashpoint also cites September reporting (The Register, citing Gambit) of a Chinese-speaking operator who reportedly used three open-source AI agent frameworks, including Strix and Cairn, to automate vulnerability discovery and exploitation across multiple targets.
Detalhes técnicos
- Counts measure observed posts, not unique advertisements, actors or confirmed attacks. Repeated cross-posting inflates the totals.
- Other sources in September: GitHub Gist (20,361), Pastebin (6,288), Signal (6,123) and Reddit (5,882), with smaller volumes on 4chan, BlackHatWorld, Discord and Mastodon.
- KYC bypass activity is concentrated in Telegram channels advertising generative-AI and deepfake methods to defeat identity verification.
- Malicious and unrestricted LLMs continue to be developed or modified to bypass safeguards. They are used for phishing, social engineering and harmful code generation.
- The AI agent frameworks case is second-hand reporting (The Register, citing Gambit), not Flashpoint's own investigation.
Remediação
- Financial institutions and other organizations that rely on digital identity verification should review onboarding and account-recovery processes for resilience against deepfake and AI-enabled impersonation.
- Protect AI development environments and fix exploitable weaknesses before attackers can use agent-based tooling against them.
- Maintain visibility into the illicit communities where AI capabilities are advertised and tested.
Linha do tempo
-
Flashpoint: Illicit AI chatter up 18% in September 2026, KYC bypass posts up 56%, AI agent frameworks used in offensive ops
ler a análise desta fonte ocultar
Flashpoint reports that illicit-community discussion of artificial intelligence rose to 8,837,186 posts in September 2026, up about 18% from 7,461,908 in August. Telegram remained the dominant venue with 6,309,872 posts, up about 29%. Posts advertising or discussing AI-enabled KYC bypass, including deepfakes, reached 1,171,914, up about 56% month over month and nearly triple the July figure of 394,567. Flashpoint also cites September reporting (The Register, citing Gambit) of a Chinese-speaking operator who reportedly used three open-source AI agent frameworks, including Strix and Cairn, to automate vulnerability discovery and exploitation across multiple targets.
Technical Details
- Counts measure observed posts, not unique advertisements, actors or confirmed attacks. Repeated cross-posting inflates the totals.
- Other sources in September: GitHub Gist (20,361), Pastebin (6,288), Signal (6,123) and Reddit (5,882), with smaller volumes on 4chan, BlackHatWorld, Discord and Mastodon.
- KYC bypass activity is concentrated in Telegram channels advertising generative-AI and deepfake methods to defeat identity verification.
- Malicious and unrestricted LLMs continue to be developed or modified to bypass safeguards. They are used for phishing, social engineering and harmful code generation.
- The AI agent frameworks case is second-hand reporting (The Register, citing Gambit), not Flashpoint's own investigation.
Remediation
- Financial institutions and other organizations that rely on digital identity verification should review onboarding and account-recovery processes for resilience against deepfake and AI-enabled impersonation.
- Protect AI development environments and fix exploitable weaknesses before attackers can use agent-based tooling against them.
- Maintain visibility into the illicit communities where AI capabilities are advertised and tested.