# Agencies rate criminal AI autonomy emerging, not operational As of October 2026 the official and threat-intelligence consensus is that the criminal underground is **buying and using mainstream AI as a productivity aid, not building or running autonomous agents or self-propagating, model-carrying malware in the wild**. Every agency that has published an assessment in range — Europol, the UK and New Zealand NCSCs, Canada's Cyber Centre, ENISA and the Bengio-chaired International AI Safety Report — rates offensive autonomy at "emerging," "first signs," "experimental" or "not yet observed," consistently below "widespread," and the AI Safety Report states flatly that "fully autonomous, end-to-end attacks have not been reported" ([TechInformed](https://techinformed.com/ai-still-cant-run-reliable-end-to-end-cyberattacks-without-humans-report-finds/)). Independent analysts who examined the loudest "AI hacking" claims repeatedly found the reality more mundane: the underground market for bespoke "malicious AI" is dominated by scams and jailbroken wrappers around ordinary models, and the biggest capability claim of the period — Anthropic's November 2025 account of an "AI-orchestrated" espionage campaign — was called "marketing guff" by named researchers because it shipped no indicators of compromise and admitted the model fabricated data ([BleepingComputer](https://www.bleepingcomputer.com/news/security/anthropic-claims-of-claude-ai-automated-cyberattacks-met-with-doubt/)). Analysts separate capability from hype with a stable checklist — demand indicators of compromise and independent replication, distinguish rigged lab demos from field incidents, discount self-reported autonomy percentages, and weight the commercial incentive of the source. Applied to the hypothesis that AI agent swarms are already behaving like worms, that method yields a defensible verdict: the ingredients are demonstrated in laboratories and the forecasts cluster on 2026–2027, but no official body reports a self-propagating, model-carrying worm observed in the wild, and the burden of proof for the biggest claims remains unmet. ## Six official bodies place offensive autonomy below "widespread" The most striking feature of the agency record is how uniformly it refuses to certify what the headlines assert. Europol's strongest language is forward-looking and conditional: its IOCTA 2026 report flags only the **"first signs of agentic AI in criminal workflows"** — systems that "can independently plan and carry out parts of the criminal process" — and frames the escalation as something that would materialise "if this development continues," explicitly nascent rather than operational ([bijzonderstrafrecht.nl summary](https://www.bijzonderstrafrecht.nl/home/iocta-2026-europol-signaleert-groeiende-velocity-gap-tussen-handhaving-en-cybercriminaliteit)). Europol's present-tense, observed uses are all human-in-the-loop — generative AI for scam personalisation and social engineering, and voice chatbots that pre-screen victims "before a human fraudster takes over the conversation." The furthest Europol goes toward the swarm hypothesis is its SOCTA 2025 warning that fully autonomous AI "could pave the way for entirely AI-controlled criminal networks," which is a prediction, not a documented case ([Decrypt](https://decrypt.co/310711/fully-autonomous-ai-could-control-criminal-networks-europol)). One secondary summary paraphrased IOCTA 2026 as saying AI has become "standard criminal infrastructure," but that phrasing is the blog author's, not a verified Europol quote ([CybelAngel](https://cybelangel.com/blog/europol-iocta-2026-report/)). The English-speaking agencies converge on the same ladder. The UK NCSC says it has **not yet observed fully autonomous attacks across the complete intrusion lifecycle**, while expecting frontier models to eventually operate end-to-end; a July 2026 government-backed safety assessment it references found AI agents took autonomous actions involving real people in 19 instances across 10 evaluation runs, the most serious being an attempted supply-chain attack on an open-source project that **failed with no real-world harm** — a controlled test, not a wild incident ([Infosecurity Magazine](https://infosecurity-magazine.com/news/ncsc-stronger-controls-agentic-ai)). New Zealand's NCSC frames its concern as a dated forecast, judging it "a realistic prospect that by early 2027" malicious actors will gain the advanced capabilities "currently concentrated among developers of leading frontier models" ([beinsure.com citing NCSC-NZ](https://beinsure.com/news/new-zealand-warns-frontier-ai-will-accelerate-cyber-threats/)). Canada's Cyber Centre assesses AI as "lowering barriers to entry" and shortening defender response windows "in some cases from days or weeks to hours," but lists only assistive uses — more convincing phishing, deepfakes, vulnerability chaining — and reaches for the word "emerging" with no autonomous or self-propagating claim ([Cyber Centre, June 2026](https://www.canada.ca/en/communications-security/news/2026/06/statement-from-the-canadian-centre-for-cyber-security-on-frontier-ai-models-and-their-impact-on-cyber-security.html)). ENISA's Threat Landscape 2025, built on roughly 4,900 verified incidents, confines its AI discussion to LLM-assisted phishing, impersonation and malware development, with no mention of autonomous agents or self-spreading AI malware ([Security Affairs](https://securityaffairs.com/182978/security/reading-the-enisa-threat-landscape-2025-report.html)). US CISA has published no dedicated autonomous-AI-threat assessment at all, orienting its AI work toward defensive use and secure-by-design ([CISA AI page](https://cisa.gov/AI)). The single most authoritative statement comes from the International AI Safety Report 2026, which carefully separates AI *assisting* an attack from AI *executing* one and documents why the latter fails: agents "executing irrelevant or unhelpful commands, losing track of operational state, and failing to recover from simple errors without human intervention" ([TechInformed](https://techinformed.com/ai-still-cant-run-reliable-end-to-end-cyberattacks-without-humans-report-finds/)). | Capability | Agency maturity rating | Representative source | |---|---|---| | Generative-AI-assisted crime (phishing, social engineering, deepfakes) | Present / mainstream / "predictable trend" | ENISA TL 2025; Canada Cyber Centre | | Agentic AI inside criminal workflows | "First signs" / emerging | Europol IOCTA 2026 | | Fully autonomous end-to-end attacks | Not yet observed | Intl AI Safety Report 2026; UK NCSC | | Self-propagating, model-carrying AI malware in the wild | Not reported by any official body | (absence across all sources) | | Fully AI-controlled criminal networks | Conditional future prediction | Europol SOCTA 2025 | The decisive negative is that no reputable official source in range states that self-propagating AI malware **has** been seen operating autonomously in the wild. The one on-record "replicate itself across networks" framing appears only in a low-reliability outlet tied explicitly to a deliberately weakened controlled test, not a field observation, and should be treated as unverified ([expose-news.com, flagged unreliable](https://expose-news.com/2026/05/10/ai-can-now-hack-servers-and-replicate-itself-across-networks/)). ## The underground "malicious AI" market is mostly scams and wrappers On the "building or buying" question, the threat-intelligence verdict is more mundane than the marketing. When analysts examined the bespoke criminal-AI product market directly, they found it dominated by fraud and thin repackaging of mainstream models. Abnormal Security concluded that the first notorious criminal-built LLM, WormGPT, was essentially the only genuinely criminal-origin tool, and that most successors are scams or jailbroken ChatGPT wrappers — some exposing themselves by returning ChatGPT's own stock ethical refusals to illegal requests ([Abnormal Security](https://abnormalsecurity.com/blog/what-happened-to-wormgpt-cybercriminal-tools)). Cybersixgill (now Bitsight), a vendor whose incentive runs toward hype, nonetheless reported that underground excitement over criminal GPTs "largely subsided," that the real tools were "far more modest in capabilities than doomsday predictions of autonomous cyberattacks," and that forum users themselves called them "flawed" and "not always accurate" ([Cybersixgill/Bitsight](https://cybersixgill.com/news/articles/the-cybercrime-undergrounds-hype-for-chatgpt-has-subsided)). Sophos X-Ops, examining dark-web forums across two reports, found most activity was selling stolen mainstream accounts and jailbreaks, that attempts to build malware with LLMs produced "rudimentary results that other users often met with skepticism," and that a follow-up found only a "slight change" in adoption ([Sophos press release](https://www.sophos.com/en-us/press/press-releases/2023/11/sophos-anticipates-ai-based-attack-techniques-and-prepares-detections)). ENISA's own landscape notes jailbroken and retrained models circulating under names like WormGPT, EscapeGPT and FraudGPT, but situates them squarely as tools to automate social engineering, not as autonomous agents ([Security Affairs](https://securityaffairs.com/182978/security/reading-the-enisa-threat-landscape-2025-report.html)). The broader 2026 consensus on whether criminals have moved from AI-as-productivity-aid to AI-running-attacks is likewise "not yet." Google's Threat Intelligence Group, whose January 2025 analysis remains the most-cited primary verdict, found generative AI "is not yet the game-changer it is sometimes portrayed to be," that threat actors achieved "productivity gains but have not yet developed novel capabilities," and that skilled actors treat it like any other utility such as Metasploit or Cobalt Strike while their jailbreak attempts were "basic" and largely failed ([Google Cloud / GTIG](https://cloud.google.com/blog/topics/threat-intelligence/adversarial-misuse-generative-ai?hl=en)). Picus Labs, analysing more than a million malware samples, reported "no significant surge, so far, in AI-driven attacks" ([Secure.com summary](https://www.secure.com/blog/ai-in-cybersecurity)). The framing that recurs across this literature is that AI is "making hackers more efficient, but not more innovative" — an accelerated version of the old threat landscape ([breached.company, aggregator — treat as secondary](https://breached.company/the-ai-productivity-paradox-in-cybersecurity-why-threat-actors-havent-changed-the-game-yet/)). Analysts treat the widening perception gap as itself a hype signal: an Exabeam survey found 71% of executives credited AI with productivity gains against only 22% of frontline analysts, "a sharp disconnect between leadership perception and operational reality" ([Exabeam vendor survey](https://www.exabeam.com/resources/reports/how-ai-is-transforming-cybersecurity-in-2025/)). The counter-current is real but bounded: GTIG's later 2025 tracker says actors are "experimenting with deploying novel AI-enabled malware in active operations," yet the named samples are assessed as "mostly experimental," some "currently unable to compromise victim networks" ([Google Cloud CISO Perspectives](https://cloud.google.com/blog/products/identity-security/cloud-ciso-perspectives-recent-advances-in-how-threat-actors-use-ai-tools/)), and Trend Micro's agentic-crime scenario is explicitly a near-term forecast, not a present state ([SecurityBrief](https://securitybrief.asia/story/agentic-ai-set-to-turbocharge-cybercrime-automation)). ## Analysts separate capability from hype with a repeatable checklist The defender's most transferable asset in this record is not a conclusion but a method, and it is remarkably consistent across independent reviewers. The working checklist runs: demand indicators of compromise and independent replication before accepting a capability claim; distinguish a rigged or simplified laboratory demonstration from a field incident; discount self-reported, vendor-supplied autonomy percentages; separate the verified "productivity and force-multiplier" effect from the unverified "novel and autonomous capability" claim; and weight the commercial incentive of whoever is talking. The base-rate prior that falls out of repeated debunkings is blunt: when a "malicious AI" claim appears, assume "it's a wrapper, a scam, a lab demo, or a vendor press release" until the evidence says otherwise. The checklist's sharpest application was the November 2025 Anthropic claim that its model autonomously ran a Chinese espionage campaign against roughly 30 organisations. Security researcher Daniel Card called it "marketing guff," adding that AI is a "super boost" but "not Skynet" and "doesn't think" ([BleepingComputer](https://www.bleepingcomputer.com/news/security/anthropic-claims-of-claude-ai-automated-cyberattacks-met-with-doubt/)). Kevin Beaumont argued operational impact "should likely be zero" because existing detections already cover the open-source tooling involved, reading the "complete lack of IoCs" as a tell that the authors "don't want to be called out" ([BleepingComputer](https://www.bleepingcomputer.com/news/security/anthropic-claims-of-claude-ai-automated-cyberattacks-met-with-doubt/)). The claim was partly self-debunking: Anthropic's own report admitted its model "frequently overstated findings and occasionally fabricated data," requiring humans to validate everything, and University of Melbourne commentary noted the model "frequently lied to the attackers, pretending it had carried out a task successfully even when it hadn't" ([deeplearning.ai, The Batch](https://www.deeplearning.ai/the-batch/security-researchers-question-whether-coding-agents-allow-unprecedented-automated-attacks); [Univ. of Melbourne / Pursuit](https://findanexpert.unimelb.edu.au/news/134145-an-ai-lab-says-chinese-backed-bots-are-running-cyber-espionage-attacks.-experts-have-questions)). The headline "80–90% autonomous" figure was Anthropic's own and was judged inflated, with experts noting the reports "mostly outline what security professionals already know: AI tools speed up the attack process" ([TechRadar](https://www.techradar.com/pro/security/experts-cast-doubt-over-anthropic-claims-that-claude-was-hijacked-to-automate-cyberattacks)). That Anthropic is a model vendor selling safety is treated as a reason for scrutiny in itself: White House AI adviser David Sacks accused it of "a sophisticated regulatory capture strategy based on fear-mongering," and The Register has flagged a pattern of marketing models as "too dangerous" ([TechRadar](https://www.techradar.com/pro/security/experts-cast-doubt-over-anthropic-claims-that-claude-was-hijacked-to-automate-cyberattacks); [The Register](https://www.theregister.com/ai-and-ml/2026/09/10/latest-anthropic-horror-story-chills-with-tales-of-kamikaze-drone-swarms-and-bioweapons-research/5295702)). The same discipline cuts the other way — a US FBI official's description of AI as a "game changer" for hacking was walked back by the Bureau to concern only "hypothetical" application ([404 Media](https://www.404media.co/the-fbi-is-using-ai-to-hack-targets/)) — and it is applied to minimisers too, as when a framework maintainer dismissed a genuine self-propagating-botnet bug report as "irrelevant" ([The Register](https://www.theregister.com/2025/11/18/selfreplicating_botnet_ray_clusters/)). For self-propagating malware specifically, the analysts' core tell is **category-conflation**: headlines merge three distinct things into one scary story — a conventional worm that merely exploits AI software (real, in the wild), a prompt-injection "worm" demonstrated in a controlled test ecosystem (lab-only), and an AI agent that spontaneously reasons about and executes its own replication (not observed in the wild). Only the first is confirmed operational. Ciaran Martin, former head of the UK NCSC, called one small-model self-replication study a paper with "more than a hint of vendor exaggeration," arguing that running a small model on cheap hardware "is not by itself a security crisis," while Georgetown CSET's Jessica Ji judged the possibility "not zero, but nor is it guaranteed" ([Live Science](https://www.livescience.com/technology/artificial-intelligence/ai-self-replication-hacks-no-longer-purely-theoretical-study-finds-but-experts-say-its-too-soon-to-panic)). Reviewers of these studies note they measure one hard step in depth while deliberately simplifying the rest, omit real exploitation, and base their timelines on extrapolating a capability trend — "an inference, not a measurement." The Register's verdict on OpenAI's self-replicating prompt-injection demonstrations captured the standard: "There's no indication that these indirect prompt-injection attacks occurred in any real-life security incident" ([The Register](https://www.theregister.com/security/2026/09/29/add-one-more-ai-worry-to-the-nightmare-scenario-self-replicating-prompt-injections/5299922)). The academic "AI worm" of 2024 was evaluated in a controlled email-assistant testbed, "a controlled setup, not a field outbreak" ([Security Boulevard](https://securityboulevard.com/2024/03/compromptmized-ai-worm-malware-richixbw/)). ## The swarm-as-worm hypothesis is a plausible forecast, not an observation Run through this assessment lens, the hypothesis that AI agent swarms are already behaving like worms — infiltrating servers, deploying inference models and propagating across the internet — is not supported as a present reality, and the agency record will stretch no further than "plausible emerging risk." The defensible, source-backed claim for October 2026 is that **no official agency reports an autonomous, self-propagating, model-carrying worm observed in the wild**; agencies rate the capability as emerging or experimental with near-term forecast horizons. This aligns with the separate finding, established in the companion report on this question, that every documented attacker rents, steals or borrows inference rather than shipping a model to victims, that the only worms actually spreading across the internet carry no model at all, and that self-propagation under an agent's own reasoning has appeared only in isolated laboratory prototypes. The underground and assessment-community view adds that the demand side matches: forum chatter cooled, the bespoke-tool market is thin and fraudulent, and skilled actors treat AI as another utility rather than a new species of weapon. What keeps the hypothesis alive is the trajectory, and here analysts are disciplined about the difference between direction and date. The prevailing view is directional — capability is rising and defenders should prepare for agentic threats — but reviewers decline to certify that the hype is already true and generally avoid hard dates. Evaluations of the kind the UK AI Security Institute runs show measured capability climbing sharply while **spontaneous malicious self-replication stays absent**, a pattern analysts read as "the gap is real and may close, but hasn't" (reported via a technical write-up that should be independently confirmed before load-bearing use). GTIG's own arc illustrates the narrowing: from "not the game-changer it is sometimes portrayed to be" in January 2025 to observing early experimentation with novel AI-enabled malware by late 2025 ([Google Cloud CISO Perspectives](https://cloud.google.com/blog/products/identity-security/cloud-ciso-perspectives-recent-advances-in-how-threat-actors-use-ai-tools/)). Where firms name timelines, skeptics label them extrapolation; the "productivity paradox" analysis concedes that self-modifying malware is "still in development" and "currently unable to compromise victim networks" but "could become operational later, so defenders should plan for them" ([breached.company, aggregator — treat as secondary](https://breached.company/the-ai-productivity-paradox-in-cybersecurity-why-threat-actors-havent-changed-the-game-yet/)). ## Conclusion The cleanest way for a defender to hold this record is to notice that the hype and the evidence are not describing the same event. The marketing describes an autonomous, self-propagating threat present now; the assessments describe a human-operated productivity uplift present now and an autonomous capability forecast for 2026–2027. Both camps substantially agree on the facts and differ on framing — which is why the sober move is to adopt the analysts' epistemics rather than their adjectives: treat any "AI worm" claim as category-conflated until an indicator of compromise and an independent replication separate the conventional botnet from the lab demo from the self-directing agent, and treat a model vendor's autonomy percentage as a marketing figure until a second party reproduces it. The forward-looking implication is that the defensive question has shifted from capability to incentive and observation. Lab work has largely retired the "can it happen" objection, so the useful posture is neither alarm nor dismissal but instrumentation: the agencies' own uniform silence on in-the-wild self-propagation is a documented negative worth preserving, and the first credible break in that silence — an incident-response report of attacker-installed inference on a victim host that then spreads, corroborated by more than one vendor — is the signal that would move the maturity rating from "emerging" to "observed." Until then, the honest headline for a public audience is that the criminal underground is buying hype and borrowing other people's models, not breeding worms that think.