AI Misuse Threat Intelligence Atlas

The problem

Every frontier lab and several platform vendors now publish threat reports on how their models are being abused. The reports are detailed and largely unstructured — narrative case studies, inconsistent between publishers, with no shared taxonomy and no way to ask a question across them.

So the field has a growing pile of good primary evidence that nobody can query. You can read any single report. You cannot ask what all of them say together.

What I built

Eight publications from OpenAI, Anthropic, Google Threat Intelligence Group and Meta, turned into 55 structured, individually cited operation records, coded against a purpose-built kill chain and a verified MITRE ATLAS mapping. Everything in reports/ is generated from data/ by make build — no figure was typed by hand, so the analysis cannot drift away from the evidence.

Meta's zero is a measured result rather than an omission: it reports networks without the AI-specific fields needed to code an operation.

The finding

A Cambodian scam compound, an Iranian influence operation, a North Korean crypto-theft group and a PRC espionage cluster are all doing the same thing.

It is also the direct counter-measure to the oldest fraud-detection signal there is. Bad language has been the first-pass filter for advance-fee fraud, phishing and romance scams for thirty years, and the language-and-script signal is countered in 20 operations — more adversarial pressure than any other signal in the corpus carries.

MITRE ATLAS has no technique for it. Neither does ATT&CK.

Three more results

MITRE ATLAS covers a quarter of documented AI misuse

Of 252 coded technique instances, 25.0% map to any ATLAS technique and 19.8% map cleanly. Two kill-chain phases have zero coverage: persona and asset fabrication — present in 47% of operations, spanning all seven actor types — and criminal back-office use.

This is not a defect in ATLAS. ATLAS models attacks on AI systems, and most documented misuse is use of AI systems against a third party. But it means "we cover the ATLAS matrix" says nothing about three quarters of what actually happens.

The uplift story is real but rare

Commentary on these reports is dominated by models writing malware and running intrusions. Thirteen of 55 operations sit at the top two rungs of the role ladder — and every long-established intrusion set in the corpus (APT5, APT15, APT41, UNC4899) is coded at the bottom rung. Where uplift appears among state actors it is in newer, agentic activity, not in the mature groups. The modal operation is an ordinary criminal or influence enterprise buying fluency it could not previously hire.

The broadest detection signal is the most contested

Prompt-content classification has the highest generalisation score (0.925) and the second-lowest durability (1.33): it detects 16 operations against behavioural clustering's 35, and 11 operations deploy a documented counter-measure against it. Request-rate anomaly detection has no observed counter-measure at all — evading it means surrendering the speed the adversary went agentic to get — and it caught the most advanced operation in the dataset.

The flagship analysis: Southeast Asian scam compounds

This is the reason the framework carries a phase no other kill chain has. Operational Sustainment exists because of a Myanmar scam centre that used a model to organise schedules, draft internal announcements, allocate desks and dormitories, and manage financial accounts — while some operators asked about the criminal penalties for running online scams.

None of that is an attack on anyone. It is an enterprise administering itself, and no existing framework has anywhere to put it.

A Cambodian romance operation — the widest record in the corpus at 15 techniques across 6 phases — confirmed the pattern: KPI tracking across departments named "Lead Generation", "Reception Team" and "Supervisor Team"; translation between Chinese-speaking supervisors and Indonesian-speaking workers; daily reports assigning each target a value.

I worked cyber-enabled fraud as a police officer, which is where the organisational reading comes from. Every factual claim is cited to a published report and coded in the dataset; interpretation is marked as mine throughout.

Also visible: an entire industry seen through one company's reporting choices

All 7 scam-compound operations, and all 3 operations touching the criminal back office, come from a single publisher. Cambodia has twice as many recorded operations as Iran — found by one company. What the public record contains is partly a fact about adversaries and partly a fact about who chose to write it down.

View the repository