In 2026, cybercriminals are directly targeting exposed AI tools to weaponize them for their own financial gain. Specifically, over 1,000 internet-exposed instances of ComfyUI, a popular stable diffusion AI platform, have been hijacked and enlisted into cryptocurrency mining and proxy botnets. Attackers utilize purpose-built automated Python scanners to continuously sweep major cloud IP ranges, automatically installing malicious nodes on vulnerable targets. By leaving these AI workflows internet-facing without proper authentication, organizations are inadvertently providing a "free GPU timeshare for criminals".

Beyond hijacking AI infrastructure, AI-driven adversaries are actively exploiting enterprise vulnerabilities, particularly systemic identity gaps. Threat actors are deploying AI-assis ...