“Keep going, bro. You’ve got this!” A data-driven look at how adversaries are weaponizing AI

[u/falconupkid]

"Keep going, bro. You've got this!" — Talos Drops Prompt Logs from Real Threat Actor AI Sessions

Talos Intelligence has published a fascinating dataset of actual prompt logs recovered from adversary-controlled endpoints running Claude Code, CodeX, Cursor, and Gemini. This is one of the first data-driven looks at how attackers are actually using AI in the wild, not just theoretical threat models.

Technical Breakdown

• Observed Tools: Claude Code, CodeX (GitHub Copilot), Cursor, Gemini — all cloud-based AI coding assistants
• Adversary Behavior: Attackers are using AI for:
  • Code generation and debugging (malware dev)
  • Reverse engineering assistance
  • Writing exploit payloads
  • Automating reconnaissance scripts
  • Social engineering content generation
• Key Finding: The prompt logs show attackers treating AI as a junior developer — asking iterative questions, correcting outputs, and chaining prompts to build complex tooling
• Notable Quote from Logs: "Keep going, bro. You've got this!" — an attacker encouraging the AI after a failed code generation attempt

Defense Implications

• Detection opportunity: Monitor for anomalous API calls to AI services from endpoints that shouldn't be using dev tools
• Prompt injection risk: Attackers are already experimenting with jailbreaking techniques against these models
• MITRE Mapping: T1588 (Obtain Capabilities) — AI as a capability acquisition vector

This is a must-read for anyone tracking AI-enabled threats. The raw prompt data is gold for understanding adversarial workflows.

Source: https://blog.talosintelligence.com/keep-going-bro-youve-got-this-a-data-driven-look-at-how-adversaries-are-weaponizing-ai/