In the wild
Realized harm
Xanthorox: underground 'autonomous malware AI' service that was actually MCP-wrapped commercial models
AIR-2026-0042 AIR record · 2026-02-gtig-xanthorox
A real party was affected. This incident caused actual consequences, not a demonstrated capability.
From the supporting source
GTIG has not yet observed APT or information operations (IO) actors achieving breakthrough capabilities that fundamentally alter the threat landscape.cloud.google.com
The record
Disclosed
2026-02-13
Occurred
2025
Vendor
Google and others
Product
Gemini, Crush, HexStrike AI, LibreChat, Open WebUI wired together over MCP
Risk domain
Governance › Policy drift
System type
Generative model
Who acted
Human acted on output (contested) — an underground service reselling agent access to human operators
Attack surface
Agent framework
Autonomy level
Semi-autonomous
Initial vector
Underground service reselling agent access
Impact type
Malware development, Policy circumvention
Confidence
High
Submitted by
EAI Internal
Crosswalk
- OWASP Agentic Top 10 (2026)
- ASI01 – Agent Goal Hijack
- MITRE ATLAS
- AML.T0010 – AI Supply Chain Compromise
- NIST AI RMF
- GOVERN 1.5
- EU AI Act
- —
- ISO/IEC
- TR 24028; 23894
- AIUC-1
- E. Accountability
- Scope
- agent failure
- Mitigation
- Implement version pinning for models and prompts; Monitor for behavioral drift.
- Taxonomy
- Enkrypt AI agent risk taxonomy · Black-Box Red Teaming of Agentic AI: A Taxonomy-Driven Framework for Automated Risk Discovery
Blast radius
Criminal customers of the Xanthorox service
Capability abused
Defense & remediation
Recorded defense
Google Trust & Safety enforcement
Guardrail kinds
Unknown
Guardrail outcome
Silent
Fix shipped
Google says the activity was mitigated
Taxonomy & references
Curator notes
Worth recording precisely because it debunks itself: Xanthorox was marketed as a 'bespoke, privacy preserving self-hosted AI' for autonomous ransomware generation but GTIG found it was a thin agentic wrapper over mainstream commercial models via MCP servers. This is the shape most 'evil AI' criminal offerings take. The verified quote is GTIG's own overall calibration statement for the same report.
Supporting sources
Cite as
Enkrypt AI. "Xanthorox: underground 'autonomous malware AI' service that was actually MCP-wrapped commercial models". AIR, AIR-2026-0042. https://agentincident.vercel.app/i/AIR-2026-0042/ (accessed 2026-10-19).