{
 "license": "CC-BY-4.0",
 "attribution": "Fide AI, Agentic Cyber Explorer",
 "url": "https://agentic-cyber-explorer.pages.dev/findings/early-attacker-llm-use-was-productivity/",
 "asOf": "2026-09-26",
 "id": "early-attacker-llm-use-was-productivity",
 "claim": "AI providers’ early reports found threat actors using LLMs mainly as productivity tools for research, scripting help and content, without novel attack capabilities.",
 "evidenceKind": "observed",
 "scope": "Covers provider reports from February 2024 to January 2025, based on activity the providers could see on their own services; actors using other or self-hosted models were outside this view.",
 "topics": [
  "threat-intelligence",
  "ai-enabled-intrusion"
 ],
 "atlas": [],
 "evidence": [
  {
   "event": "microsoft-openai-state-actors-llm-use-2024",
   "note": "Microsoft and OpenAI saw five state-affiliated actors use LLMs for support tasks and no novel AI-enabled techniques."
  },
  {
   "event": "gtig-adversarial-misuse-gemini-2025",
   "note": "Google saw productivity gains but no novel capabilities in government-backed actors’ use of Gemini."
  }
 ],
 "relations": [],
 "statusHistory": [
  {
   "status": "reported",
   "on": "2024-02-14",
   "why": "Microsoft and OpenAI report productivity-level use by state-affiliated actors.",
   "event": "microsoft-openai-state-actors-llm-use-2024",
   "kind": "evidence"
  },
  {
   "status": "corroborated",
   "on": "2025-01-29",
   "why": "Google independently reports the same pattern in Gemini use.",
   "event": "gtig-adversarial-misuse-gemini-2025",
   "kind": "evidence"
  },
  {
   "status": "superseded",
   "on": "2025-11-05",
   "why": "GTIG reports malware that uses LLMs during execution in live operations, a capability beyond productivity use.",
   "event": "gtig-ai-threat-tracker-llm-querying-malware-2025",
   "kind": "evidence"
  }
 ],
 "halfLifeDays": 540,
 "wouldChange": "Superseded. Kept to show how reported attacker behavior changed.",
 "fideQuestions": [],
 "methods": [],
 "review": "assistant-drafted",
 "addedOn": "2026-09-25"
}