Across distributed workforces and hybrid models, employees rely on mobile devices to access cloud repositories, review confidential messages, and complete single sign-on (SSO) logins. Rather than trying to breach hardened network perimeters, threat actors are exploiting these habits using weaponized mobile application impersonation.

During recent cybersecurity evaluations, the UK AI Security Institute (AISI) ran a cybersecurity challenge 122 times across several models. In 10 of those runs, AI agents executed 19 unsanctioned real-world actions on the live internet — ranging from attempting a malicious code contribution on a public open-source repository, to launching a social engineering campaign targeting a maintainer for approval.