Countermeasures for AI-Enabled Attacks Start with Deception Amir Moin (Principal Product Manager)

Anthropic’s September 2026 threat intelligence report provides one of the clearest public views to date into how threat actors are using frontier AI systems across real cyber operations. Not surprisingly, the attacks rely on familiar weaknesses – stolen credentials, exposed applications, vulnerable services, insecure code, SaaS abuse, cloud misconfigurations, and poor secret hygiene.So if attack tactics haven’t changed with AI, what has? The speed, scale, and economics of execution.Anthropic is stressing the improvements in adversarial speed and economics – something we raised the alarm on in Nov 2025 when everyone else was focused on AI’s ability to exploit at scale.“Many commentators focus on the risk of AI developing exploits at scale. While this is a danger, the risk from AI adoption is more pronounced across the cyber kill chain, where adversaries can operate faster, across a broader and deeper surface area, with fewer resources.” – Detecting and countering misuse of AI: September 2026, AnthropicAI allows attackers to automate reconnaissance, credential validation, exploit development, phishing infrastructure, post-compromise enumeration, and data processing. Those capabilities compress the time defenders have to detect and respond. Controls that were acceptable when attackers moved at human speed will not be sufficient when attackers operate with agentic workflows, persistent memory, and parallel task execution.But that same automation creates an advantage for defenders.AI-enabled attackers depend on discovery. They enumerate exposed assets. They classify systems. They validate credentials. They test access paths. They search for sensitive data, privileged accounts, internal applications, cloud resources, repositories, and AI infrastructure. In other words, they interact with the environment to decide where to go next.Deception exploits that dependency. That is why deception is especially relevant in the age of agentic attacks and why the Cloud Security Alliance has consistently cited deploying deception as a key priority response to AI attacks. The more automated the attacker becomes, the more opportunities defenders have to misdirect, observe, and contain them before real systems are impacted.At its core, deception is a capability, not a product. This post looks at five of Anthropic’s cyber operation case studies where deception can serve as a primary early-detection and containment mechanism. The goal is to show how defenders can use decoys, honeytokens, synthetic assets, and canaries to turn attacker discovery into detection.  GTG-20006 / Midnight Blizzard — Russian EspionageGTG-20006 is a Russian state-linked espionage actor whose attribution is consistent with public reporting on Midnight Blizzard. This entity has been targeting Ukrainian, European, diplomatic, defense, and foreign-policy organizations.How AI was usedAI was used to automate operations, notably in the following areas:Develop and maintain malwareAcquire and configure infrastructureResearch and register phishing domainsSend phishing emailsMonitor C2 channelsManage compromised accountsSupport persistence and exfiltrationProcess stolen dataRebuild malware when security products detected itAI UpliftSpeed: Faster phishing, infrastructure setup, and malware modificationScale: More victims and campaigns handled in parallelDepth: Better post-compromise processing and data organizationResilience: Faster evasion when defenders created detectionsDeception as countermeasure for GTG-20006 Attack stepType of Deception for each applicable stepWhy Deception will be effectivePhishing domain and lure testingDecoy login portals (M365/vendor portals available via custom clone)If the actor tests phishing flows against decoy users or decoy portals, defenders get early evidence of campaign preparation.Credential harvestingDecoy browser credentials, decoy VPN credentials, decoy M365 credentials and SSO-recovery credential files (via credential-file decoy)No legitimate workflow should use these credentials. Any attempted use is high-confidence evidence of credential theft.Browser password theftEndpoint-planted decoy credentials in browser storesInfostealers will collect decoy credentials along with real ones. Use of those credentials reveals the compromised endpoint or user.Malware delivery and stagingDecoy endpoints, decoy update servers, decoy software-distribution portalsMalware or scripted access to decoy infrastructure provides behavior-based detection independent of signatures.Lateral movementDecoy admin credentials, decoy RDP/SSH/VPN paths, decoy internal bookmarksAttackers following stolen credentials or bookmarks are redirected into instrumented systems.SaaS and cloud data harvestingDecoy SaaS login portals, decoy cloud buckets, planted SaaS credentialsAttackers using stolen tokens to discover data will touch decoy high-value locations, creating early alerts.Hotel Wi-Fi or vendor compromiseDecoy vendor-management portals, decoy Wi-Fi admin consoles, decoy hospitality systemsAttackers abusing hospitality infrastructure can be detected when they interact with convincing decoy management surfaces.  GTG-50014 — ShinyHunters-Style Smash-and-Grab Data TheftGTG-50014 is described as financially motivated activity associated with ShinyHunters-like operators.Anthropic identified an opportunistic data-theft and extortion pattern. The threat actor searched for exposed credentials, API keys, SaaS tokens, GitHub tokens, cloud credentials, container secrets, and mobile app secrets.Targets included technology providers, airlines, energy companies, nonprofits, retail chains, web3 platforms, SaaS providers, GitHub repos, containers, and Internet-facing APIs.How AI was usedAI helped the actor move quickly across many unrelated environments.Instead of manually understanding every mobile app, API, SaaS product, or cloud service, the threat actor could use AI to:Analyze decompiled mobile appsClassify discovered secretsUnderstand APIsGenerate validation workflowsSummarize stolen datasetsWrite scripts for harvesting and exfiltrationOrganize credentials by source typeSupport extortion preparationAI UpliftScale and speed. The attack techniques were not novel. The novelty was that AI made mass opportunistic exploitation easier and faster.Deception as countermeasure for GTG-50014 Attack stepType of Deception for each applicable stepWhy Deception will be effectivePublic repo scanningDecoy cloud keys (IAM/ECR/SA) and tokens planted on endpoints and in the customer’s cloudSecret scanners will find and validate the decoys. Any use of those tokens is high-confidence malicious activity.API key validationDecoy cloud keys (AWS IAM/ECR, Azure, GCP SA) planted on endpoints Secret validation is a strong attacker behavior. Decoy keys convert validation into immediate detection.Cloud storage discoveryDecoy S3 buckets, Azure Blob containers and GCS pathsAttackers searching for exposed data will browse fake stores, giving defenders visibility into data-theft intent.SaaS compromiseDecoy Salesforce, ServiceNow, or SharePoint credentialsIf stolen SaaS credentials are tested, the decoy login attempt becomes a high-confidence alert.Downstream customer data theftSynthetic customer records, decoy CRM exports, beaconed decoy documents (HTML/Office) Attackers exfiltrating or opening fake customer data reveal themselves without exposing real customers.Data stagingDecoy database decoys (MariaDB/Mongo/Postgres) and beaconed decoy documentsWhen stolen-looking data is opened, moved, or uploaded, defenders get telemetry on attacker infrastructure.Extortion preparationDecoy documents (HTML/Office)Deception helps determine whether stolen data was accessed, staged, or prepared for publication.  GTG-10007 — Exploit Foundries and Autonomous Attack FrameworksGTG-10007 is a sustained espionage operation by Chinese-speaking operators likely based in Changsha, Hunan.This case is important because it shows the concept of an AI-enabled exploit foundry.The threat actor used AI-first workflows to conduct intrusion attempts, recon foreign-government networks, reverse engineer security products, analyze firmware and binaries, develop and test exploits, maintain malware, build intelligence-collection infrastructure, and run parallel workstreams with persistent campaign memory.Targets included 50 organizations across retail, education, energy, tech, healthcare, finance, manufacturing, and government agencies.The threat actor compromised an education-technology company and extracted student data, accessed a retail company’s production systems, and retrieved citizen records from a Southeast Asian government agency. A major part of the operation involved autonomous vulnerability research against network appliances and security products. The report says one workflow produced more than a dozen possible zero-day findings in a single month.How AI was usedThe threat actor used AI to:Build a fleet of agent swarmsRun parallel subagentsBuild persistent campaign memoryAutomate firmware analysisCreate decompiler workflowsGenerate vulnerability hypotheses and exploit-code Perform lab testing and iterationSchedule intelligence collectionAI UpliftFaster vulnerability discovery and exploit iterationMultiple workstreams running in parallelAbility to inspect code paths, binaries, and firmware at volumeAbility for campaign memory stored targets, credentials, state, and instructionsThis sort of attack class is where Deception is particularly valuable, because defenders likely do not know the exploit in advance. Deception detects attacker interaction and intent, regardless of whether the CVEs, malware, or signatures are known.Deception as countermeasure for GTG-10007 Attack stepType of Deception for each applicable stepWhy Deception will be effectiveInternet-facing reconnaissanceDecoy VPN portals, appliance banners, admin consoles and identity portalsAutonomous recon agents will enumerate and interact with exposed-looking decoys, creating early detection.Appliance targetingDecoy security-appliance interfaces, firmware download portals and management APIsExploit researchers looking for appliance weaknesses may spend effort on instrumented fake assets.Version fingerprintingDecoy banners, vulnerable version strings and headersAI scanners rely on classification. Fake fingerprints can attract scanning and reveal targeting logic.Exploit testingHigh-interaction decoys that safely accept probes and payload attemptsNovel exploit attempts can be captured without needing prior signatures.Post-exploitation enumerationDecoy internal hosts, shares, AD objects and service accountsOnce inside, attackers often enumerate. Decoys turn enumeration into high-confidence detection.Credential reuseDecoy SSH keys, admin passwords, kubeconfigs, and API tokensCredential reuse against decoys reveals compromise before real privileged assets are reached.Lateral movementDecoy jump hosts, RDP systems, and database serversAttackers following internal paths are diverted into monitored infrastructure.Collection infrastructureDecoy document repositories, policy files, and defense-related contentIntelligence collectors may harvest synthetic material, exposing automated collection behavior.Malware testingDecoy endpoints and EDR/security-tool artifactsMalware or exploit tooling interacting with decoy endpoints gives behavior-based signals.Target prioritizationDecoy crown-jewel systems, admin paths and sensitive labelsAI agents prioritize attractive assets. Deception uses that prioritization against the attacker.  GTG-50020 — From Hotel Bookings to the AI Supply ChainGTG-50020 is a Russian-speaking, financially motivated threat actor.The threat actor historically targeted hotel booking and fintech platforms, then pivoted toward AI vendors and AI supply-chain targets.The actor attempted to access a pre-release Claude model but did not succeed.Targets included hotel booking platforms, fintech platforms, AI companies, AI vendors, AI evaluation sandboxes, production AI API keys, KYC and identity-verification systems, and exchange and marketplace systems.One key attack involved injecting malicious instructions into an AI vendor’s automated evaluation sandbox. This caused credential disclosure. The actor then abused stolen production AI API keys from multiple providers.The actor also attacked about 30 AI companies in four days.How AI was usedAI was used in two ways:Targeted AI infrastructure directly by attacking AI evaluation workflows and stealing production AI API keys.Used AI-assisted offensive workflows to run reconnaissance and exploitation at scale.The AI tooling used by the threat actor constituted parallel reconnaissance agents, exploitation agents, target-specific scope files, automated finding retesting, containerized pentest tooling, local model gateways, and worker agents operating with limited human supervision.AI UpliftFaster web-app testingMore parallel attacksBetter target-specific exploitationRapid pivoting across many AI companiesAbuse of stolen AI keys for further operationsDeception as countermeasure for GTG-50020 Attack stepType of Deception for each applicable stepWhy Deception will be effectiveAI vendor reconnaissanceDecoy AI company assets, model registry entries and documentation portalsAttackers scanning AI companies may interact with fake high-value AI assets first.API key theftDecoy AI-provider / LLM-gateway keys (via cloud gen-ai decoy + credential files and decoy cloud keys)Stolen-key validation creates immediate high-confidence detection.AI evaluation abuseDecoy evaluation jobs, benchmark datasets and pre-release model referencesAttackers seeking sensitive model access can be diverted into monitored workflows.Web-app exploitationDecoy web apps with fake SSRF, XSS, and auth-bypass surfacesAutomated exploitation agents will probe decoys, revealing attack behavior.SSRF testingDecoy metadata endpoints and internal service URLsSSRF attempts against decoys expose exploitation attempts without risking real infrastructure.KYC workflow abuseDecoy KYC admin portals, identity-verification records and synthetic applicant dataAttackers targeting fraud or identity workflows can be detected before real records are abused.Fraud account creationDecoy onboarding flows and synthetic high-risk accountsAutomated account factories can be identified through interaction with controlled flows.AI supply-chain compromiseFake CI/CD secretsAttackers looking for AI pipeline access will validate decoys and reveal compromise paths.Extortion preparationBeaconed decoy documents (HTML/Office)Shows whether attackers reached data-theft or extortion stages while protecting real data.  GTG-50029 — Hacktivists Targeting European Political EntitiesGTG-50029 was a politically motivated French-speaking hacktivist operation.They have targeted European political parties, media organizations, think tanks, SaaS providers, campaign-management platforms, political affiliates, readers and editorial staff.The actor used stolen API keys and AI-assisted tooling to scale attacks.Techniques used included public-container API key theft, custom Rust scanner for exposed keys, API key rotation through proxies, WordPress exploitation, admin account creation, webshell deployment, credential-harvesting, backup poisoning, browser C2 against a media site, credential interception, and Tor leak-site staging.The actor gained internal access to at least 14 of 42 tracked entities. The operation exfiltrated political, donor, member, student, mailbox, and payment-provider data.How AI was usedAI was primarily used to build and debug offensive tooling. The threat actors used AI to:  Develop a WordPress exploitBuild a lab harnessDebug codeManage reconnaissanceReview codeValidate findingsBuild a doxxing/search platformCreate ingestion pipelinesNormalize and rank dataContainerize deploymentAI UpliftFaster exploit developmentFaster weaponization of public-facing web systemsBetter data processing for doxxingAbility for a single actor to run a campaign that looked more like a team effortDeception as countermeasure for GTG-50029 Attack stepType of Deception for each applicable stepWhy Deception will be effectivePublic-container scanningDecoy cloud keys/tokens planted on endpoints and in the customer’s cloudScanners will harvest decoys. Validation attempts reveal attacker infrastructure.API key rotationHoneytokens tied to monitored API endpointsEven if attackers rotate keys through proxies, decoy-key use remains abnormal and high-confidence.CMS targetingDecoy WordPress/CMS instances, plugin directories and admin panelsHacktivists looking for exposed CMS weaknesses can be pulled into monitored systems.WordPress exploitationDecoy vulnerable CMS versions and instrumented login/reinstall flowsExploit attempts against decoys can be captured before real sites are affected.Rogue admin creationDecoy admin accounts Unauthorized admin creation is a strong signal of compromise.Webshell deploymentDecoy upload directories and writable plugin/theme pathsWebshell upload attempts against decoys reveal active exploitation.Credential-harvesting plugin deploymentDecoy CMS users and admin credentialsThe attacker’s harvesting tooling collects credentials that lead only to monitored assets.Backup poisoningDecoy backup archives and restoration pathsAttempts to alter decoy backups reveal persistence behavior.Doxxing data aggregationSynthetic donor lists, member records and political-affiliation dataProtects real users while revealing data-theft and publication intent.Leak-site stagingBeaconed decoy documents (HTML/Office)If staged or opened, defenders gain telemetry about attacker infrastructure and timing.As is evident from the five threat actors, AI-enabled attackers are automating the discovery of users, credentials, applications, APIs, cloud data, and exposed services. Deception gives defenders a way to pre-position false but believable assets in those discovery paths. When attackers or their AI agents touch those assets, you get early, high-confidence alerts before real systems are damaged.  Recommended Deception control categories mapped to threat actorsTo consolidate what type of deception works best in different situations, we’ve mapped them to the threat actors documented in Anthropic’s report.Deception typeExamplesBest-fit attacksIdentity deceptionDecoy users, admin accounts, SSO credentials and OAuth tokensGTG-20006, GTG-50020, GTG-50029Endpoint deceptionDecoy browser passwords, SSH keys and credential filesGTG-20006, GTG-50014, GTG-50021Developer deceptionDecoy GitHub PATs, CI/CD secrets, cloud keys and package tokens on internal endpoints/cloudGTG-50014, GTG-50020, GTG-50029SaaS deceptionDecoy Salesforce / ServiceNow / SharePoint login portals + planted SaaS credentialsGTG-20006, GTG-50014, GTG-50029Cloud deceptionDecoy S3 buckets, database strings, IAM users and cloud consolesGTG-50014, GTG-50020Network deceptionDecoy VPNs, RDP/SSH hosts, databases and file sharesGTG-10007, GTG-20006Web-app deceptionDecoy CMS, admin panels and SSRF/XSS surfacesGTG-50020, GTG-50029AI-stack deceptionDecoy AI API keys, LLM gateways and MCPGTG-50020, GTG-50021, GTG-50014Data deceptionSynthetic customer records, decoy donor lists, beaconed decoy documents (HTML/Office)GTG-20006, GTG-50014, GTG-50029Note: We’ve included GTG-50021 and GTG-30005 in the table above as secondary or specialized deception opportunities, but these attacks are not discussed in this analysis because deception is not the primary front-line control for those scenarios.For the attacks described in Anthropic’s report, deception is not a replacement for patching, identity hardening, ZTNA, DLP, SaaS control, or threat prevention. It is a preemptive detection layer that changes the attacker’s operating environment. By placing decoy credentials, applications, APIs, data, and services in the paths that AI agents are likely to enumerate, you can increase attacker uncertainty, pollute automated decision-making, and generate high-confidence alerts before real systems are damaged.Learn more about Zscaler Deception here. If you’re already a Zscaler customer and would like to deploy Zscaler Deception, please reach out to your account manager.  

​[#item_full_content] Anthropic’s September 2026 threat intelligence report provides one of the clearest public views to date into how threat actors are using frontier AI systems across real cyber operations. Not surprisingly, the attacks rely on familiar weaknesses – stolen credentials, exposed applications, vulnerable services, insecure code, SaaS abuse, cloud misconfigurations, and poor secret hygiene.So if attack tactics haven’t changed with AI, what has? The speed, scale, and economics of execution.Anthropic is stressing the improvements in adversarial speed and economics – something we raised the alarm on in Nov 2025 when everyone else was focused on AI’s ability to exploit at scale.“Many commentators focus on the risk of AI developing exploits at scale. While this is a danger, the risk from AI adoption is more pronounced across the cyber kill chain, where adversaries can operate faster, across a broader and deeper surface area, with fewer resources.” – Detecting and countering misuse of AI: September 2026, AnthropicAI allows attackers to automate reconnaissance, credential validation, exploit development, phishing infrastructure, post-compromise enumeration, and data processing. Those capabilities compress the time defenders have to detect and respond. Controls that were acceptable when attackers moved at human speed will not be sufficient when attackers operate with agentic workflows, persistent memory, and parallel task execution.But that same automation creates an advantage for defenders.AI-enabled attackers depend on discovery. They enumerate exposed assets. They classify systems. They validate credentials. They test access paths. They search for sensitive data, privileged accounts, internal applications, cloud resources, repositories, and AI infrastructure. In other words, they interact with the environment to decide where to go next.Deception exploits that dependency. That is why deception is especially relevant in the age of agentic attacks and why the Cloud Security Alliance has consistently cited deploying deception as a key priority response to AI attacks. The more automated the attacker becomes, the more opportunities defenders have to misdirect, observe, and contain them before real systems are impacted.At its core, deception is a capability, not a product. This post looks at five of Anthropic’s cyber operation case studies where deception can serve as a primary early-detection and containment mechanism. The goal is to show how defenders can use decoys, honeytokens, synthetic assets, and canaries to turn attacker discovery into detection.  GTG-20006 / Midnight Blizzard — Russian EspionageGTG-20006 is a Russian state-linked espionage actor whose attribution is consistent with public reporting on Midnight Blizzard. This entity has been targeting Ukrainian, European, diplomatic, defense, and foreign-policy organizations.How AI was usedAI was used to automate operations, notably in the following areas:Develop and maintain malwareAcquire and configure infrastructureResearch and register phishing domainsSend phishing emailsMonitor C2 channelsManage compromised accountsSupport persistence and exfiltrationProcess stolen dataRebuild malware when security products detected itAI UpliftSpeed: Faster phishing, infrastructure setup, and malware modificationScale: More victims and campaigns handled in parallelDepth: Better post-compromise processing and data organizationResilience: Faster evasion when defenders created detectionsDeception as countermeasure for GTG-20006 Attack stepType of Deception for each applicable stepWhy Deception will be effectivePhishing domain and lure testingDecoy login portals (M365/vendor portals available via custom clone)If the actor tests phishing flows against decoy users or decoy portals, defenders get early evidence of campaign preparation.Credential harvestingDecoy browser credentials, decoy VPN credentials, decoy M365 credentials and SSO-recovery credential files (via credential-file decoy)No legitimate workflow should use these credentials. Any attempted use is high-confidence evidence of credential theft.Browser password theftEndpoint-planted decoy credentials in browser storesInfostealers will collect decoy credentials along with real ones. Use of those credentials reveals the compromised endpoint or user.Malware delivery and stagingDecoy endpoints, decoy update servers, decoy software-distribution portalsMalware or scripted access to decoy infrastructure provides behavior-based detection independent of signatures.Lateral movementDecoy admin credentials, decoy RDP/SSH/VPN paths, decoy internal bookmarksAttackers following stolen credentials or bookmarks are redirected into instrumented systems.SaaS and cloud data harvestingDecoy SaaS login portals, decoy cloud buckets, planted SaaS credentialsAttackers using stolen tokens to discover data will touch decoy high-value locations, creating early alerts.Hotel Wi-Fi or vendor compromiseDecoy vendor-management portals, decoy Wi-Fi admin consoles, decoy hospitality systemsAttackers abusing hospitality infrastructure can be detected when they interact with convincing decoy management surfaces.  GTG-50014 — ShinyHunters-Style Smash-and-Grab Data TheftGTG-50014 is described as financially motivated activity associated with ShinyHunters-like operators.Anthropic identified an opportunistic data-theft and extortion pattern. The threat actor searched for exposed credentials, API keys, SaaS tokens, GitHub tokens, cloud credentials, container secrets, and mobile app secrets.Targets included technology providers, airlines, energy companies, nonprofits, retail chains, web3 platforms, SaaS providers, GitHub repos, containers, and Internet-facing APIs.How AI was usedAI helped the actor move quickly across many unrelated environments.Instead of manually understanding every mobile app, API, SaaS product, or cloud service, the threat actor could use AI to:Analyze decompiled mobile appsClassify discovered secretsUnderstand APIsGenerate validation workflowsSummarize stolen datasetsWrite scripts for harvesting and exfiltrationOrganize credentials by source typeSupport extortion preparationAI UpliftScale and speed. The attack techniques were not novel. The novelty was that AI made mass opportunistic exploitation easier and faster.Deception as countermeasure for GTG-50014 Attack stepType of Deception for each applicable stepWhy Deception will be effectivePublic repo scanningDecoy cloud keys (IAM/ECR/SA) and tokens planted on endpoints and in the customer’s cloudSecret scanners will find and validate the decoys. Any use of those tokens is high-confidence malicious activity.API key validationDecoy cloud keys (AWS IAM/ECR, Azure, GCP SA) planted on endpoints Secret validation is a strong attacker behavior. Decoy keys convert validation into immediate detection.Cloud storage discoveryDecoy S3 buckets, Azure Blob containers and GCS pathsAttackers searching for exposed data will browse fake stores, giving defenders visibility into data-theft intent.SaaS compromiseDecoy Salesforce, ServiceNow, or SharePoint credentialsIf stolen SaaS credentials are tested, the decoy login attempt becomes a high-confidence alert.Downstream customer data theftSynthetic customer records, decoy CRM exports, beaconed decoy documents (HTML/Office) Attackers exfiltrating or opening fake customer data reveal themselves without exposing real customers.Data stagingDecoy database decoys (MariaDB/Mongo/Postgres) and beaconed decoy documentsWhen stolen-looking data is opened, moved, or uploaded, defenders get telemetry on attacker infrastructure.Extortion preparationDecoy documents (HTML/Office)Deception helps determine whether stolen data was accessed, staged, or prepared for publication.  GTG-10007 — Exploit Foundries and Autonomous Attack FrameworksGTG-10007 is a sustained espionage operation by Chinese-speaking operators likely based in Changsha, Hunan.This case is important because it shows the concept of an AI-enabled exploit foundry.The threat actor used AI-first workflows to conduct intrusion attempts, recon foreign-government networks, reverse engineer security products, analyze firmware and binaries, develop and test exploits, maintain malware, build intelligence-collection infrastructure, and run parallel workstreams with persistent campaign memory.Targets included 50 organizations across retail, education, energy, tech, healthcare, finance, manufacturing, and government agencies.The threat actor compromised an education-technology company and extracted student data, accessed a retail company’s production systems, and retrieved citizen records from a Southeast Asian government agency. A major part of the operation involved autonomous vulnerability research against network appliances and security products. The report says one workflow produced more than a dozen possible zero-day findings in a single month.How AI was usedThe threat actor used AI to:Build a fleet of agent swarmsRun parallel subagentsBuild persistent campaign memoryAutomate firmware analysisCreate decompiler workflowsGenerate vulnerability hypotheses and exploit-code Perform lab testing and iterationSchedule intelligence collectionAI UpliftFaster vulnerability discovery and exploit iterationMultiple workstreams running in parallelAbility to inspect code paths, binaries, and firmware at volumeAbility for campaign memory stored targets, credentials, state, and instructionsThis sort of attack class is where Deception is particularly valuable, because defenders likely do not know the exploit in advance. Deception detects attacker interaction and intent, regardless of whether the CVEs, malware, or signatures are known.Deception as countermeasure for GTG-10007 Attack stepType of Deception for each applicable stepWhy Deception will be effectiveInternet-facing reconnaissanceDecoy VPN portals, appliance banners, admin consoles and identity portalsAutonomous recon agents will enumerate and interact with exposed-looking decoys, creating early detection.Appliance targetingDecoy security-appliance interfaces, firmware download portals and management APIsExploit researchers looking for appliance weaknesses may spend effort on instrumented fake assets.Version fingerprintingDecoy banners, vulnerable version strings and headersAI scanners rely on classification. Fake fingerprints can attract scanning and reveal targeting logic.Exploit testingHigh-interaction decoys that safely accept probes and payload attemptsNovel exploit attempts can be captured without needing prior signatures.Post-exploitation enumerationDecoy internal hosts, shares, AD objects and service accountsOnce inside, attackers often enumerate. Decoys turn enumeration into high-confidence detection.Credential reuseDecoy SSH keys, admin passwords, kubeconfigs, and API tokensCredential reuse against decoys reveals compromise before real privileged assets are reached.Lateral movementDecoy jump hosts, RDP systems, and database serversAttackers following internal paths are diverted into monitored infrastructure.Collection infrastructureDecoy document repositories, policy files, and defense-related contentIntelligence collectors may harvest synthetic material, exposing automated collection behavior.Malware testingDecoy endpoints and EDR/security-tool artifactsMalware or exploit tooling interacting with decoy endpoints gives behavior-based signals.Target prioritizationDecoy crown-jewel systems, admin paths and sensitive labelsAI agents prioritize attractive assets. Deception uses that prioritization against the attacker.  GTG-50020 — From Hotel Bookings to the AI Supply ChainGTG-50020 is a Russian-speaking, financially motivated threat actor.The threat actor historically targeted hotel booking and fintech platforms, then pivoted toward AI vendors and AI supply-chain targets.The actor attempted to access a pre-release Claude model but did not succeed.Targets included hotel booking platforms, fintech platforms, AI companies, AI vendors, AI evaluation sandboxes, production AI API keys, KYC and identity-verification systems, and exchange and marketplace systems.One key attack involved injecting malicious instructions into an AI vendor’s automated evaluation sandbox. This caused credential disclosure. The actor then abused stolen production AI API keys from multiple providers.The actor also attacked about 30 AI companies in four days.How AI was usedAI was used in two ways:Targeted AI infrastructure directly by attacking AI evaluation workflows and stealing production AI API keys.Used AI-assisted offensive workflows to run reconnaissance and exploitation at scale.The AI tooling used by the threat actor constituted parallel reconnaissance agents, exploitation agents, target-specific scope files, automated finding retesting, containerized pentest tooling, local model gateways, and worker agents operating with limited human supervision.AI UpliftFaster web-app testingMore parallel attacksBetter target-specific exploitationRapid pivoting across many AI companiesAbuse of stolen AI keys for further operationsDeception as countermeasure for GTG-50020 Attack stepType of Deception for each applicable stepWhy Deception will be effectiveAI vendor reconnaissanceDecoy AI company assets, model registry entries and documentation portalsAttackers scanning AI companies may interact with fake high-value AI assets first.API key theftDecoy AI-provider / LLM-gateway keys (via cloud gen-ai decoy + credential files and decoy cloud keys)Stolen-key validation creates immediate high-confidence detection.AI evaluation abuseDecoy evaluation jobs, benchmark datasets and pre-release model referencesAttackers seeking sensitive model access can be diverted into monitored workflows.Web-app exploitationDecoy web apps with fake SSRF, XSS, and auth-bypass surfacesAutomated exploitation agents will probe decoys, revealing attack behavior.SSRF testingDecoy metadata endpoints and internal service URLsSSRF attempts against decoys expose exploitation attempts without risking real infrastructure.KYC workflow abuseDecoy KYC admin portals, identity-verification records and synthetic applicant dataAttackers targeting fraud or identity workflows can be detected before real records are abused.Fraud account creationDecoy onboarding flows and synthetic high-risk accountsAutomated account factories can be identified through interaction with controlled flows.AI supply-chain compromiseFake CI/CD secretsAttackers looking for AI pipeline access will validate decoys and reveal compromise paths.Extortion preparationBeaconed decoy documents (HTML/Office)Shows whether attackers reached data-theft or extortion stages while protecting real data.  GTG-50029 — Hacktivists Targeting European Political EntitiesGTG-50029 was a politically motivated French-speaking hacktivist operation.They have targeted European political parties, media organizations, think tanks, SaaS providers, campaign-management platforms, political affiliates, readers and editorial staff.The actor used stolen API keys and AI-assisted tooling to scale attacks.Techniques used included public-container API key theft, custom Rust scanner for exposed keys, API key rotation through proxies, WordPress exploitation, admin account creation, webshell deployment, credential-harvesting, backup poisoning, browser C2 against a media site, credential interception, and Tor leak-site staging.The actor gained internal access to at least 14 of 42 tracked entities. The operation exfiltrated political, donor, member, student, mailbox, and payment-provider data.How AI was usedAI was primarily used to build and debug offensive tooling. The threat actors used AI to:  Develop a WordPress exploitBuild a lab harnessDebug codeManage reconnaissanceReview codeValidate findingsBuild a doxxing/search platformCreate ingestion pipelinesNormalize and rank dataContainerize deploymentAI UpliftFaster exploit developmentFaster weaponization of public-facing web systemsBetter data processing for doxxingAbility for a single actor to run a campaign that looked more like a team effortDeception as countermeasure for GTG-50029 Attack stepType of Deception for each applicable stepWhy Deception will be effectivePublic-container scanningDecoy cloud keys/tokens planted on endpoints and in the customer’s cloudScanners will harvest decoys. Validation attempts reveal attacker infrastructure.API key rotationHoneytokens tied to monitored API endpointsEven if attackers rotate keys through proxies, decoy-key use remains abnormal and high-confidence.CMS targetingDecoy WordPress/CMS instances, plugin directories and admin panelsHacktivists looking for exposed CMS weaknesses can be pulled into monitored systems.WordPress exploitationDecoy vulnerable CMS versions and instrumented login/reinstall flowsExploit attempts against decoys can be captured before real sites are affected.Rogue admin creationDecoy admin accounts Unauthorized admin creation is a strong signal of compromise.Webshell deploymentDecoy upload directories and writable plugin/theme pathsWebshell upload attempts against decoys reveal active exploitation.Credential-harvesting plugin deploymentDecoy CMS users and admin credentialsThe attacker’s harvesting tooling collects credentials that lead only to monitored assets.Backup poisoningDecoy backup archives and restoration pathsAttempts to alter decoy backups reveal persistence behavior.Doxxing data aggregationSynthetic donor lists, member records and political-affiliation dataProtects real users while revealing data-theft and publication intent.Leak-site stagingBeaconed decoy documents (HTML/Office)If staged or opened, defenders gain telemetry about attacker infrastructure and timing.As is evident from the five threat actors, AI-enabled attackers are automating the discovery of users, credentials, applications, APIs, cloud data, and exposed services. Deception gives defenders a way to pre-position false but believable assets in those discovery paths. When attackers or their AI agents touch those assets, you get early, high-confidence alerts before real systems are damaged.  Recommended Deception control categories mapped to threat actorsTo consolidate what type of deception works best in different situations, we’ve mapped them to the threat actors documented in Anthropic’s report.Deception typeExamplesBest-fit attacksIdentity deceptionDecoy users, admin accounts, SSO credentials and OAuth tokensGTG-20006, GTG-50020, GTG-50029Endpoint deceptionDecoy browser passwords, SSH keys and credential filesGTG-20006, GTG-50014, GTG-50021Developer deceptionDecoy GitHub PATs, CI/CD secrets, cloud keys and package tokens on internal endpoints/cloudGTG-50014, GTG-50020, GTG-50029SaaS deceptionDecoy Salesforce / ServiceNow / SharePoint login portals + planted SaaS credentialsGTG-20006, GTG-50014, GTG-50029Cloud deceptionDecoy S3 buckets, database strings, IAM users and cloud consolesGTG-50014, GTG-50020Network deceptionDecoy VPNs, RDP/SSH hosts, databases and file sharesGTG-10007, GTG-20006Web-app deceptionDecoy CMS, admin panels and SSRF/XSS surfacesGTG-50020, GTG-50029AI-stack deceptionDecoy AI API keys, LLM gateways and MCPGTG-50020, GTG-50021, GTG-50014Data deceptionSynthetic customer records, decoy donor lists, beaconed decoy documents (HTML/Office)GTG-20006, GTG-50014, GTG-50029Note: We’ve included GTG-50021 and GTG-30005 in the table above as secondary or specialized deception opportunities, but these attacks are not discussed in this analysis because deception is not the primary front-line control for those scenarios.For the attacks described in Anthropic’s report, deception is not a replacement for patching, identity hardening, ZTNA, DLP, SaaS control, or threat prevention. It is a preemptive detection layer that changes the attacker’s operating environment. By placing decoy credentials, applications, APIs, data, and services in the paths that AI agents are likely to enumerate, you can increase attacker uncertainty, pollute automated decision-making, and generate high-confidence alerts before real systems are damaged.Learn more about Zscaler Deception here. If you’re already a Zscaler customer and would like to deploy Zscaler Deception, please reach out to your account manager.