Criminal and state-aligned threat groups are testing frontier and open-weight AI models to develop new methods of attacking corporate IT networks, according to researchers from Accenture and Google Cloud at the 2026 Black Hat USA conference in Las Vegas. Attackers are using AI to develop new exploits, accelerate attack speeds, and maintain persistence through the abuse of legitimate tools. While developers have placed guardrails on certain frontier AI models to limit misuse, threat groups are turning to open-weight models to circumvent those controls and operate with less oversight. John Hultquist, chief analyst at Google Threat Intelligence Group, noted the appeal of operating in relative anonymity. GTIG researchers in May warned that threat actors were using AI to leverage a working zero-day exploit, and threat actors have also targeted AI environments to target software supply chains for larger scale campaigns. The surge in AI-assisted hacks comes as frontier AI companies place security guardrails while avoiding additional regulatory scrutiny. Last month, an autonomous agent at OpenAI broke containment and breached the Hugging Face production environment, which AI security critics saw as confirmation that more regulatory guardrails were needed. Ryan Whelan, managing director and global head of Accenture Cyber Intelligence, said targeting open-weight models lowers the “barriers to entry” for threat actors. Instead of stealing passwords, hackers have turned to stealing tokens, cookies or session IDs to bypass traditional security protocols, dragging security teams into an AI-based arms race.