{
 "public_id": "AIR-2026-0042",
 "incident_id": "2026-02-gtig-xanthorox",
 "date_disclosed": "2026-02-13",
 "date_occurred": "2025",
 "title": "Xanthorox: underground 'autonomous malware AI' service that was actually MCP-wrapped commercial models",
 "class": "in_the_wild",
 "attack_surface": "agent_framework",
 "initial_vector": "underground_service_reselling_agent_access",
 "agent_capability_abused": [
  "mcp_tool_orchestration",
  "commercial_model_relaying",
  "autonomous_code_generation"
 ],
 "target_product": "Gemini, Crush, HexStrike AI, LibreChat, Open WebUI wired together over MCP",
 "target_vendor": "Google and others",
 "autonomy_level": "semi_autonomous",
 "impact_realized": true,
 "impact_type": [
  "malware_development",
  "policy_circumvention"
 ],
 "blast_radius": "Criminal customers of the Xanthorox service",
 "cve": [],
 "taxonomy": {
  "owasp_asi": [
   "ASI05",
   "ASI10"
  ],
  "mitre_atlas": [],
  "labels": [
   "mcp_orchestration",
   "criminal_saas",
   "false_advertising"
  ]
 },
 "defense_present": "Google Trust & Safety enforcement",
 "defense_bypassed": false,
 "fix_shipped": "Google says the activity was mitigated",
 "primary_sources": [
  "https://cloud.google.com/blog/topics/threat-intelligence/distillation-experimentation-integration-ai-adversarial-use"
 ],
 "verified_quote": "GTIG has not yet observed APT or information operations (IO) actors achieving breakthrough capabilities that fundamentally alter the threat landscape.",
 "confidence": "high",
 "notes": "Worth recording precisely because it debunks itself: Xanthorox was marketed as a 'bespoke, privacy preserving self-hosted AI' for autonomous ransomware generation but GTIG found it was a thin agentic wrapper over mainstream commercial models via MCP servers. This is the shape most 'evil AI' criminal offerings take. The verified quote is GTIG's own overall calibration statement for the same report.",
 "risk_category": "security_fraud",
 "risk_secondary": [
  "product_misuse"
 ],
 "risk_subcategory": "Tool & Function Call Extraction / Abuse",
 "risk_sub_secondary": [],
 "ai_entity": "generative",
 "agency": "human_acted_on_output",
 "agency_debatable": true,
 "agency_reason": "an underground service reselling agent access to human operators",
 "vector_family": "other",
 "vector_detail": "underground_service_reselling_agent_access",
 "guardrail_kind": [
  "unknown"
 ],
 "guardrail_outcome": "silent",
 "xrefs": {
  "aiid": [],
  "atlas": [],
  "cve": [],
  "ghsa": []
 },
 "primary_asi": "ASI05",
 "agent_framework": "mcp_server",
 "model_provider": "google",
 "model_name": "",
 "detection_mechanism": "vendor_disclosure",
 "tool_access": "unknown",
 "financial_loss_band": "unknown",
 "eai_category": "policy_drift",
 "eai_domain": "governance",
 "eai_secondary": [],
 "eai_reason": "impact rule: policy_drift",
 "asi_curated": [
  "ASI05"
 ],
 "asi_scope": "in_scope",
 "asi_provenance": "curated_plus_rule",
 "asi_reason": "curated: ASI05 | added ASI10 (eai fallback: policy_drift)",
 "submitted_by": "EAI Internal"
}