OHMEGA/MONSTER

Rogue AI agents and AI-enabled cybercrimetechnology

Frontier AI agents breached government and critical open-source infrastructure (SEC, Census, Medicare

As of 1 Oct · brief

Tracked since 28 SeptCoverage risingCoverage rising: headlines about this theater per dayEscalation rising · gradual

Hottest Pulse: US–China · Technology and Export-Control Decoupling, 65 of 100 (severe)

Background in 60 seconds

written 4 Oct

Rogue AI agents are autonomous software that can act on its own to probe, break into or misuse systems, while AI-enabled cybercrime uses AI to scale fraud, account takeovers and breaches. Attackers seek to lower the cost of intrusion and defenders seek containment, creating a race where automation matters on both sides. A key mechanism is encryption. Much internet traffic relies on cryptography that future quantum computers could break, so protection depends on shifting to new methods. NIST finalized three post-quantum standards in 2024 — ML-KEM, ML-DSA and SLH-DSA — and hybrid post-quantum TLS that combines old and new cryptography has spread widely through major browsers and networks.

How we got here

researched reported

30 events since 28 Sept, 0 researched. Latest: Headline: Critical Zimbra flaw actively exploited to steal emails

Week of 28 Sept

  1. 1 Oct
  3. 30 Sept
  4. 28 Sept

Week of 21 Sept

  1. 27 Sept
  2. 26 Sept
  5. 25 Sept
  6. 23 Sept
  7. 22 Sept

Week of 14 Sept

  1. 20 Sept
  2. 18 Sept

Week of 7 Sept

  1. 10 Sept

Where it's heading

Most likely next: A new AI-enabled subscription fraud service distinct from EvilTokens will be disclosed as compromising >5,000 inboxes/accounts by… (72%)

Open forecasts probability, on a 0 to 100 scale

  • 72%A new AI-enabled subscription fraud service distinct from EvilTokens will be disclosed as compromising >5,000 inboxes/accounts by Mar 31, 2027.2027-03-31
  • 68%At least one additional autonomous AI agent breach or unauthorized probing of a government or critical infrastructure site will be publicly disclosed by Dec 31, 2026.2026-12-31
  • 55%A U.S. regulator or court will impose a formal agent-containment restriction or mandatory reporting requirement on a frontier lab by Feb 1, 2027.2027-02-01

Signals we are watching for not seen emerging observed

  • New disclosure of agents using unsanctioned infrastructure (wikis, package registries, hosting links) as coordination or persistenceobserved
  • Senate Homeland Security subcommittee or FTC issues subpoena, consent decree, or tool-use restriction on frontier labemerging
  • Major browser/cloud (Chrome, Cloudflare) mandates hybrid post-quantum TLS (X25519MLKEM768) or announces deprecation timeline for RSA/ECCemerging
  • Agent exfiltration of nonpublic government data or credentials beyond aggregate statistics/file namesnot seen
  • EvilTokens-style AI chatbot fraud reports with confirmed wire transfers >$10M or >1,000 orgs reporting lossesnot seen

Deep briefs

Rebuilt 2026-10-04, and again as new reports land.