Skip to content
ROAI

August 24, 2026 · Issue 8 · 5 min read

Criminal tooling shipped a natural-language operator layer this week, and the defender pay premium hit 14.9 percent

Cisco Talos published a two-part report on UAT-10147(opens in a new tab), a Chinese-speaking crew running SEO fraud and data theft across education, media, technology, and gaming targets. The interesting part is not the crew. It is where the AI sits. Talos found DeepAudit used for vulnerability scanning, PentestGPT running autonomously on the group's own command servers, AI used to refine exploits and generate payloads, and AI assistance in building the Linux rootkit. An exposed directory held roughly 170,000 target URLs split into 17 files. The United States, India, the United Kingdom, Germany, and the Netherlands were the top five destinations. The CVEs being exploited are old: Zimbra from 2022, Telerik from 2019, sudo from 2021. Nothing novel was needed at the vulnerability layer, because the automation was applied to the labor layer instead.

Three days earlier, TrendAI documented 14 trojanized npm packages(opens in a new tab) delivering RedC2 4.0. The backdoor runs on module import, with no install hook and no exported function to call. RedC2 4.0 ships with Red Agent, described by the researchers as an LLM-backed command execution layer that turns natural-language intent into beacon commands. Version 2.0 shipped in August 2025, 3.0 sold in January 2026, 4.0 was advertised in June. AI is now a versioned, priced feature in commercial crimeware, and what it sells is the removal of the operator skill floor.

Sophos X-Ops closed the loop on delivery. Reviewing 38 confirmed incidents(opens in a new tab) over roughly a year, researchers found AI brand impersonation had become a standard lure, with Claude appearing in 26 of the 38 and Perplexity, ChatGPT, and Copilot filling out the rest. Thirty of the incidents involved software impersonation. Sophos was blunt that the controls that actually worked keyed on conventional delivery and payload behavior, not on anything AI-specific. Employees shopping for AI tools is a distribution channel.

The cost side arrived the same day. The Cisco-founded AI Workforce Consortium, working from Cornerstone and Indeed data, reported that AI skill requirements in G7 cybersecurity postings(opens in a new tab) doubled from 14.2 percent to 28.5 percent year over year. Positions tagged with AI skills carry a 14.9 percent median pay premium in the United States. Senior roles grew 65 percent while junior roles grew 5.9 percent. Digital forensics analyst roles, the people who investigate an AI system after it fails, grew 453 percent. Forty-nine percent of security leaders say they cannot find entry-level candidates with hands-on agent experience.

Read the four together and the finance question writes itself. The marginal cost of running an intrusion campaign is falling, because the scarce input was always skilled operator time and that is exactly what a natural-language command layer substitutes for. The marginal cost of defending is rising, in a labor market that has repriced the relevant skills by 15 percent and cannot supply the bottom of the pyramid at all. Most AI budgets approved for 2026 fund models, platform, and integration work. Most security budgets were set before agentic tooling existed on either side of the line. The AI security headcount that this week's reporting implies is sitting in neither.

Researched and drafted by an automated workflow, then reviewed and edited by a human editor before publication. Every source is linked. See how we use AI here.

The npm finding deserves separate attention from the AI security conversation it will get filed under. Nothing about RedC2 4.0 attacks a model. It attacks a dependency intake process, and it arrives in packages that do exactly what they claim to do while a beacon loads on import. The reason this matters more than it did two years ago is that the intake rate went up. AI coding assistants pull in transitive dependencies faster than a human reviewer clears them, which widens the window between a package entering the build and anyone looking at it.

Three questions produce useful answers this quarter, and none of them require a new tool.

First, who funds AI security headcount. Not who is responsible for it, who funds it. If the answer is that the security budget absorbed it without an increase, the 14.9 percent premium is coming out of coverage somewhere else, and that trade was never made explicitly.

Second, what the actual latency is between a package entering a build and a human or automated review clearing it. That number exists in the CI logs. Most organizations have never pulled it.

Third, whether any control in the estate would have caught a signed, functioning npm package that runs a beacon on import. Sophos already published the honest answer for the impersonation cases: the controls that worked were the conventional ones. That is good news for the budget, because it means the first fix is coverage and hygiene rather than a new category of spend. It is bad news for anyone who assumed the AI governance program bought them something here. It did not.

Also worth knowing