The 2026 AI Threat Landscape Report

A year-long analysis of the platforms, communities, and tools driving AI threats in 2026

The rise of AI has created a new frontier of cyberthreats for organizations and individuals. AI-driven attacks are no longer an emerging risk. Instead, they are increasingly common, accessible, and sophisticated, with new threats being developed in organized online forums daily.

When the most visible platforms shut these forums down, it does not disrupt their activity. Instead, those communities move to fringe platforms with looser moderation and enforcement, allowing them even more freedom to continue their discussions.

This report analyzes multiple social platforms to map where AI exploits are being discovered, refined, and sold today. It also provides concrete guidance on the most common exploits and direction on how to identify them before they affect your organization.

Key Takeaways:

Evidence suggests platform bans pushed AI exploit communities into less-visible spaces often already occupied by active cybercriminals.
The same technology behind documented business fraud attacks is being tested, refined, and shared in semi-public online spaces.
4chan serves as a discovery platform for new exploits, generating 300–350 related posts per day.
Discord is growing quickly as a platform for R&D, hosting invite-only servers that share step-by-step instructions, refined prompt injection strategies, and access to dark LLMs not yet available elsewhere.
Telegram is a commercialization layer, where hobbyist techniques are packaged as purchasable tools. New editions of purchasable exploits, such as the launch of WormGPT 4 in September 2025, correlate with on-platform activity spikes.

Identify online harms with the Open Measures platform.

Organizations use Open Measures every day to track trends related to networks of influence, coordinated harassment campaigns, and state- backed info ops. Click here to book a demo.