Ransomware operators are scaling their attacks, and the barriers to entry continue to fall. In the first half of 2026, Flashpoint identified 6,256 ransomware attacks across industries, representing a 45% increase between 2025 and 2026, as Ransomware-as-a-Service (RaaS) operations expanded and threat actors increasingly leveraged AI, stolen credentials, and vulnerability exploits to accelerate their campaigns.
The impact is widespread. Manufacturing accounted for 18% of observed attacks, followed by business services and consulting (13%) and healthcare (9%). Meanwhile, prolific ransomware groups such as Qilin and Akira continue to demonstrate the scale at which these operations can function.
Understanding how ransomware attacks develop, and where they can be interrupted, is critical for defenders.
Introducing Ransomware in the Age of AI: A Survival Guide for Defenders
Flashpoint’s new guide, Ransomware in the Age of AI: A Survival Guide for Defenders, provides cyber threat intelligence professionals, threat hunters, and security leaders with a practical look at the modern ransomware attack lifecycle, from initial reconnaissance and access to incident response and recovery.
Drawing on Flashpoint’s primary-source intelligence and analysis of evolving threat actor tactics, the guide explores how organizations can identify opportunities to disrupt attacks before they escalate, strengthen incident response, and reduce the risk of repeat compromise.
Access the guide to learn:
How modern ransomware attacks unfold: Follow the attack lifecycle, from reconnaissance, phishing, and initial access through lateral movement, encryption, and ransom negotiations.
Where defenders can intervene: Understand how compromised credential monitoring, vulnerability intelligence, and visibility into underground activity can help identify threats before attackers reach critical systems.
How AI is reshaping ransomware operations: Explore how AI-enabled capabilities, commoditized tooling, and RaaS ecosystems are changing the economics and execution of ransomware attacks.
How to strengthen response and recovery: Learn strategies for containing active incidents, restoring operations, improving cross-team coordination, and reducing exposure to repeat attacks.
“In H1 2026, Flashpoint observed a 45% surge in ransomware activity, with critical sectors like manufacturing, business consulting, and healthcare taking the brunt of these attacks. As RaaS syndicates like Qilin and Akira scale their operations alongside a 27% rise in infostealers, access is becoming faster and cheaper. Effective defense requires grounding incident response in primary-source intelligence across every phase of the attack lifecycle.”
Ian GrayVP of Intelligence, Flashpoint
Understanding the Modern Ransomware Attack Lifecycle
Ransomware attacks rarely begin with encryption. Long before systems are locked or ransom demands appear, threat actors may be gathering intelligence on potential targets, exploiting exposed vulnerabilities, or acquiring stolen credentials through underground marketplaces.
Flashpoint observed a 27% increase in infostealer operations in H1 2026 compared to H1 2025, underscoring the growing role of compromised identities in the ransomware ecosystem. Stolen credentials and session data can provide attackers with access to organizational environments, potentially allowing them to bypass traditional defenses and establish a foothold.
These initial access methods are increasingly interconnected with broader criminal operations. RaaS groups can leverage specialized tools and services throughout the attack chain, while AI-enabled capabilities offer additional opportunities to automate and accelerate certain activities.
This creates multiple opportunities for defenders to act. Intelligence about exposed credentials, emerging exploitation activity, and threat actor behavior can help security teams identify risks earlier and prioritize defensive action before an intrusion progresses.
The guide examines these opportunities across the ransomware lifecycle, outlining how proactive intelligence and coordinated response can help organizations minimize operational disruption and strengthen resilience.
Build a More Proactive Defense Against Ransomware
As ransomware operations continue to evolve, organizations need visibility into the threats targeting their environments and the intelligence to respond at every stage of an attack.
From identifying compromised credentials and monitoring emerging threats to containing incidents and preventing repeat attacks, a lifecycle-based approach helps security teams make more informed decisions before, during, and after a ransomware incident.
Get the Ransomware in the Age of AI: A Survival Guide for Defenders to explore the modern ransomware attack lifecycle and learn how Flashpoint’s threat intelligence can help your organization anticipate, disrupt, and recover from ransomware attacks.
AI is becoming a third wheel in relationships, increasingly playing a role in the most intimate parts of our lives.
It shows up in the flirty first text, the polished dating profile, the therapized language we use with a partner after a fight, the strength we gather after heartbreak, and everywhere in between. For some, AI is a source of companionship itself. And even if you’re not personally an AI user, you may still be dating, loving, arguing with, or trusting someone who is.
As AI moves deeper into our relationships, it’s reshaping connection, blurring what feels authentic, and creating new ways for intimacy to be exploited.
AI is starting to replace human interaction
AI is moving into emotional territory once reserved for other people. For some, it’s no longer just a tool, but a source of support, companionship, and even romantic connection.
According to our recent research, about one in six have turned to a chatbot for companionship or emotional support. That climbs to about one in five among Gen Z and Millennials, and nearly one in four among regular AI users (those who use AI daily or multiple times a week). The more time people spend with AI, the more likely they are to humanize its role, making room for it as a friend, confidant, advisor, or even partner.
As AI takes on more intimate roles, it’s also starting to challenge the boundaries of real human relationships. More than one in three (37%) say having a romantic relationship with an AI chatbot while already in a committed relationship isn’t the same as cheating. That view is more common among men (46% versus 30% of women), Gen Z and Millennials (43% and 45%), and regular AI users (48%).
Whether the relationship is platonic or romantic, the more AI is treated like a human, the more personal the stakes become. Just like you have to be cautious when telling a human your deepest, darkest secrets, the experience is similar when using AI. Nearly two-thirds (65%) worry that private conversations they’ve had with AI could be exposed.
One survey respondent said:
“I have used a chatbot…for emotional support, and it is worrying to think those conversations could be leaked.”
The technology may be artificial, but the relationships people form with AI can feel very real. And as with any relationship, that means there are boundaries to work out, privacy to protect, and vulnerabilities to manage.
AI is creating new ways to weaponize intimacy
AI’s growing role in human intimacy also has a darker side. The same technology that can offer comfort, advice, or companionship can also be used to violate the most intimate parts of our lives.
Non-consensual image abuse, sextortion, and other forms of sexual abuse have long been part of the internet’s dark side. Generative AI has made that content easier to create. Someone trying to exploit another person no longer needs an actual intimate photo, video, or private exchange. A regular photo—or even just someone’s likeness—can be transformed into sexual content they never made, never shared, and never consented to.
Most people draw a clear line against that, but not everyone does. About one in six people say it’s acceptable to generate explicit images of someone without their permission for personal use. Another 14% are neutral, bringing the share who do not explicitly oppose the behavior to nearly one in three (31%).
Views differ sharply by age and sex:
Younger adults are more accepting of someone using AI to generate non-consensual content: nearly one in four Gen Z (24%) and Millennials (23%) say it’s okay, compared with 13% of Gen X and just 5% of Boomers+
Men are also more permissive: more than one in five (22%) say it’s okay, compared with 14% of women
Attitudes toward the behavior may vary, but the fear of becoming a target is far more widespread. Overall, nearly two-thirds of people (62%) worry someone could create fake nude or sexually explicit photos or videos of them. Women feel this threat more acutely: nearly seven in ten (69%) are concerned, compared with 57% of men.
For some, this fear has already become a reality:
One in ten say AI has been used to generate nude or sexually explicit imagery of them without permission
One in ten say someone has threatened to release AI-generated compromising or explicit imagery of them
As one respondent recounted:
“I had someone make fake nudes of me using AI on my photos from my social media and threaten to post them on Facebook…[it] made me more cautious about AI.”
The intimate material may be fake, but the fear, coercion, and potential for reputational, emotional, and financial damage are completely real.
AI is making it harder to know who you’re really talking to
The threat doesn’t stop with fabricated sexual content. AI is also making it harder to know whether the person on the other side of a screen is who they claim to be.
Humans have always edited themselves for other people. We choose the most flattering photo, write and rewrite the text before sending it, and present our most interesting selves—especially when forming new relationships. AI dramatically expands what that kind of self-editing can look like, and people aren’t shy about using it:
54% say AI helps them present the best version of themselves
47% say using AI to present your “best self” to employers, friends, or romantic partners does not present a false identity
That rises to 58% of both Gen Z and Millennials and 64% of regular AI users
But where does enhancement end and deception begin? Is an AI-polished dating profile still authentically you? What about a message you didn’t write? A photo that looks like you, only better?
There’s a flipside to using AI to make ourselves look or sound better: If we can do it, so can everyone else. And people are much less comfortable when they’re not the ones controlling the technology. Two-thirds (67%) worry that an online friend or romantic interest could use AI-generated images, videos, or other content to deceive them.
Catfishing, fake photos, and lies on dating profiles aren’t new. AI just makes the deception easier. Someone’s photos, backstory, messages, and even their voice can all be faked.
One person described leaving dating apps after realizing the person they were talking to had gone well beyond simply polishing their profile:
“[The] dating profile had fake pictures…[it] wasn’t just making true events sound interesting and more flirty, but creating completely false photos and information. Left the dating apps again and needed to reset.”
AI can distort identity in the other direction, too. It can also create a version of us we never chose to put into the world.
76% worry about someone creating a fake profile pretending to be them
70% worry about fake images or videos of themselves being created
71% worry AI-generated content could be used to damage their reputation
Relationships are built on mutual trust. AI can distort both sides of the connection: who we think the other person is, and who they think we are.
AI is quietly finding its way into the space between people
Not all of AI’s influence on intimacy is so dramatic. Much of it happens quietly, showing up in how people communicate with each other and navigate relationships:
More than one in three have used AI to help write or edit a message
About one in seven have turned to it for advice about a relationship or personal decision
One in ten say it has already changed how they date or communicate romantically—rising to nearly one in five among Gen Z
The survey responses show what this looks like in real life. For example, one respondent described using AI with their partner as a way to step outside their own point of view:
“Personally, it has helped me. We use AI in our relationship as a reflection tool, and it has sometimes helped us take on the perspective of the other.”
For another, AI helped them work through jealousy:
“So, I used to accuse my partner, and I got really territorial about them but once I talked to AI about it, they gave helpful advice and now we are stronger than ever.”
AI is also showing up in other difficult relationship moments. One person said it helped them “stay calm and communicate” when problems came up with their partner; another said it allows them “to pause and refine [their] thoughts” before responding.
Sometimes the role is simpler. One respondent said AI gives them “new romantic words” for their partner, while another said they’ve asked AI for advice on how to make their partner smile. AI’s growing role in relationships may be unsettling, but the benefits people describe are definitely there.
AI isn’t just helping people find the right words. It’s also helping them decide what version of themselves to put forward in the first place. More than one in three say it’s okay to use AI to create or improve a dating profile; nearly two-thirds aren’t opposed. One respondent described using AI as a “creative advisor” to polish their profile and come up with conversation starters.
AI doesn’t have to replace a relationship to help shape it. It can influence how people communicate, what advice they take, and how they choose to present themselves.
AI’s intimacy problem is ultimately a trust problem
From connection to deception to outright harm, the same question keeps surfacing: Can I trust what’s in front of me? And would I know if I couldn’t?
Nearly nine in ten people (88%) say AI is making it harder to tell what online content is genuinely human or real. And 84% say even convincing video evidence no longer necessarily feels like proof. That uncertainty follows people into dating and relationships, where knowing what—and who—to trust is deeply personal.
AI may make it easier to start a conversation, smooth over a hard one, or feel connected when you’re lonely. But relationships and intimacy of all kinds still come down to trust, and AI is making that trust a little harder to take at face value.
About the research
The research in this article is based on a March 2026 survey about AI, identity, and the collapse of digital trust and was conducted among 1,500 respondents in the United States, United Kingdom, Germany, Austria, and Switzerland. The research was prepared by an independent research consultant and distributed via Forsta.
Something feel off? Check it before you click.
Malwarebytes Scam Guard helps you analyze suspicious links, texts, and screenshots instantly.
Abstract: Capability evaluations aim to surface dangerous model behaviors before deployment, but their reliability depends on the assumption that hidden capabilities can be elicited. We show this assumption does not hold under adversarial conditions by constructing backdoor attacks that embed encrypted neural networks within host model weights, decrypting and executing them only upon receiving a secret trigger. Using digital lockers, these hidden circuits remain provably hard to elicit and interpret under cryptographic assumptions, even given full access to model weights, extending prior work from hiding fixed strings to arbitrary computations. We implement our proof of concept constructions in PyTorch and evaluate elicitation through fine-tuning, weight noising, gradient-based trigger search, and latent adversarial training, using a small chemical reaction prediction task as a proxy for CBRN-relevant capabilities. Our results demonstrate resistance to these methods and, together with our cryptographic guarantees, reveal a limit of elicitation-based capability audits. We release our models to support the improvement of defenses.
AI agents are moving deeper into offensive cyber operations. In a campaign highlighted in September reporting, a Chinese-speaking operator reportedly deployed multiple open-source AI agent frameworks to find and exploit vulnerabilities across several targets, automating work that would ordinarily require hands-on effort from an attacker.
The reported activity illustrates how AI tools are being applied to increasingly complex stages of an attack, including tasks that traditionally require substantial technical expertise and hands-on effort.
Meanwhile, the volume of AI-related activity across illicit communities continues to climb.
In September 2026, Flashpoint analysts identified 8,837,186 posts discussing artificial intelligence in the context of illicit activity, up from 7,461,908 in August. That represents an approximately 18% increase in a single month.
Mentions of AI in conjunction with illicit advertisements and discussions in September 2026. (Source: Flashpoint)
Across forums, marketplaces, and chat services, threat actors continue to advertise AI services, exchange techniques, and explore ways to incorporate AI into fraud, identity verification bypass, social engineering, and offensive cyber operations.
To track these developments, Flashpoint’s monthly AI Threat Report analyzes primary source communities across forums, marketplaces, and chat services. This month’s intelligence highlights a sharp increase in AI-enabled identity verification bypass activity, continued demand for malicious AI capabilities, and emerging examples of AI agent tooling being used in offensive operations.
Where AI Activity Is Concentrated
Telegram remained the dominant source of observed AI service advertisements in September, with 6,309,872 posts, up from 4,899,407 in August. That represents an approximately 29% month-over-month increase.
Activity across other platforms was substantially lower. Flashpoint identified 20,361 posts on GitHub Gist, followed by Pastebin (6,288), Signal (6,123), and Reddit (5,882). Smaller volumes were observed across 4chan, BlackHatWorld, Discord, Mastodon, and other sources.
Posts selling AI services (in red) and posts seeking to purchase AI services (in blue) on Telegram in September 2026. (Source: Flashpoint)
As with previous months, these figures do not represent unique advertisements or services. Threat actors frequently repeat or distribute the same messages across multiple channels and platforms to maximize exposure.
Telegram’s continued dominance underscores its importance as a distribution channel for illicit AI services. Other platforms provide additional avenues for sharing technical material, advertising capabilities, and discussing methods.
The distribution of activity also reinforces why post volume requires context. Repeated advertisements can inflate overall counts, making it important to examine the underlying services and techniques being promoted alongside changes in activity.
AI-Enabled Fraud and Identity Verification Bypass
Discussions of AI-enabled identity verification bypass continued to accelerate in September.
Flashpoint analysts observed 1,171,914 posts advertising or discussing Know Your Customer (KYC) bypass methods using AI technology, including deepfake technology. That compares with 751,644 posts in August, representing an approximately 56% month-over-month increase.
The increase is particularly noteworthy given the growth already observed in August, when KYC-related activity nearly doubled from July. Across the past two months, the number of observed posts has nearly tripled, rising from 394,567 in July to more than 1.17 million in September.
These discussions are concentrated in Telegram channels advertising methods designed to circumvent identity verification controls through generative AI, including deepfake technology.
For financial institutions and other organizations that rely on digital identity verification, this activity warrants close attention. AI-enabled impersonation can create additional challenges for onboarding, account recovery, and other processes that depend on verifying a user’s identity.
The sustained increase in underground discussion also provides security and fraud teams with an important signal about where threat actor interest is concentrated, even when repeated advertisements contribute to the overall volume.
Malicious LLM Usage and Prompt-Based Workflows
Malicious and unrestricted large language models (LLMs) remained part of the AI-related activity observed across Flashpoint Collections in September.
Threat actors continue to develop their own models or seek ways to bypass safeguards imposed by mainstream AI services. These capabilities can support phishing, social engineering, harmful code generation, and the creation of malicious or offensive content.
The top observed malicious LLMs mentioned within Flashpoint Collections in September 2026. (Source: Flashpoint)
The availability of malicious and unrestricted LLMs gives threat actors additional options for incorporating AI into existing workflows. Models designed or modified to circumvent safety restrictions can be used to generate content and technical material that mainstream services would ordinarily reject.
These tools also introduce challenges for security teams assessing how AI-enabled threats are evolving. Understanding which models are being discussed, how they are marketed, and the capabilities being sought by threat actors can provide insight into emerging areas of interest across illicit communities.
Notable AI-Related Activity Observed in September
Flashpoint identified several notable developments involving AI infrastructure and the growing use of AI in offensive cyber operations.
September reporting highlighted a Chinese-speaking operator reportedly using three open-source AI agent frameworks, including Strix and Cairn, to automate vulnerability discovery and exploitation across multiple targets, according to The Register, citing Gambit.
These developments highlight two areas of concern: the targeting of proprietary AI infrastructure and the potential for agent-based tools to accelerate offensive operations. For security teams, both reinforce the importance of protecting AI development environments and addressing exploitable weaknesses before attackers can capitalize on them.
What Security Teams Should Take Away
September’s intelligence points to continued growth in AI-related criminal activity, with particularly sharp increases in discussions surrounding identity verification bypass.
Flashpoint observed more than 8.8 million posts discussing AI and criminal activity, while KYC bypass discussions exceeded 1.17 million posts for the first time in the three-month period examined.
At the same time, reported activity involving AI agent frameworks illustrates how automation is extending into more complex offensive workflows. Threat actors are exploring ways to apply AI to vulnerability discovery and exploitation, alongside its established uses in fraud, impersonation, and social engineering.
For security teams, these developments reinforce the importance of maintaining visibility into the communities where new capabilities are discussed, advertised, and tested. Tracking changes in activity and understanding how tools are being applied can help organizations identify emerging risks and better prioritize their defenses.
To see how Flashpoint can help your team identify and respond to emerging threats, request a demo.
Frequently Asked Questions (FAQ)
What is the Flashpoint AI Threat Report?
The Flashpoint AI Threat Report is a monthly intelligence analysis tracking how threat actors use and discuss artificial intelligence across illicit communities. Built on Flashpoint’s primary source collection, the report provides visibility into underground forums, chat services, marketplaces, and other environments where AI-related criminal activity is discussed and advertised.
How are threat actors currently using AI in cybercrime?
Threat actors are using or exploring AI capabilities across a range of criminal activities, including identity verification bypass, phishing, social engineering, malicious code generation, and vulnerability discovery.
September reporting also highlighted the use of AI agent frameworks to automate elements of offensive cyber operations, including vulnerability discovery and exploitation.
How rapidly is illicit AI activity growing in cybercrime communities?
Flashpoint analysts identified 8,837,186 posts discussing AI and criminal activities in September 2026, compared with 7,461,908 in August. This represents an approximately 18% month-over-month increase.
Activity related to AI-enabled KYC bypass also grew substantially, reaching 1,171,914 posts in September, an increase of approximately 56% from August.
These figures measure observed posts, rather than unique threat actors, services, or confirmed attacks.
Which messaging platforms and forums host the most illicit AI chatter?
Telegram continues to account for the largest concentration of observed AI service advertisements. Flashpoint identified more than 6.3 million posts advertising AI services on Telegram in September.
Other sources included GitHub Gist, Pastebin, Signal, Reddit, 4chan, BlackHatWorld, Discord, and Mastodon.
What are malicious LLMs?
Malicious LLMs are AI models developed, modified, or marketed for purposes that mainstream AI services typically restrict. Threat actors may use these models to generate phishing content, assist with social engineering, create harmful code, or support other criminal activities.
Flashpoint continues to track discussion of these models across illicit communities to understand how their capabilities and use cases are evolving.
.kadence-column480165_4ecc5f-ac > .kt-inside-inner-col{padding-top:20px;padding-right:20px;padding-bottom:10px;padding-left:20px;}.kadence-column480165_4ecc5f-ac > .kt-inside-inner-col{column-gap:var(–global-kb-gap-sm, 1rem);}.kadence-column480165_4ecc5f-ac > .kt-inside-inner-col{flex-direction:column;}.kadence-column480165_4ecc5f-ac > .kt-inside-inner-col > .aligncenter{width:100%;}.kadence-column480165_4ecc5f-ac > .kt-inside-inner-col{background-color:#ffe5e5;}.kadence-column480165_4ecc5f-ac > .kt-inside-inner-col:before{opacity:0.3;}.kadence-column480165_4ecc5f-ac{position:relative;}@media all and (max-width: 1024px){.kadence-column480165_4ecc5f-ac > .kt-inside-inner-col{flex-direction:column;justify-content:center;}}@media all and (max-width: 767px){.kadence-column480165_4ecc5f-ac > .kt-inside-inner-col{flex-direction:column;justify-content:center;}}
In this article
Some Halloween AI video sites ask for personal photos without clearly identifying who runs them.
Outside AI providers may also receive your uploads.
Before uploading, check who gets your photos, how they’re used, and when they’re deleted.
This Halloween, AI is doing the costumes. Upload a photo and you can become a vampire, surround your dog with pumpkins, or star in a viral “zombie love story:” Your partner has turned, you lower the gun, and the zombie’s leap ends in a hug.
But before you upload, do you know who will receive your photos?
We found no malware or phishing on the sites we examined. What concerned us was how little we could establish about who operated them and who would be responsible for the photos people uploaded.
Polished, friendly, and anonymous
These sites look professional and sound reassuring. They promise privacy, have FAQs and refund policies, and some even add consent checkboxes for photos of children. One calls itself “an independent tool with no ties to TikTok or any film studio.”
What they don’t tell you is who is behind them. On the sites we checked, we found no company name, address, or named operator, only a support email on the site’s own domain.
Where do your photos go?
These sites ask for clear, well-lit photos of you, your partner, your friends, your pets, and, with a parent’s permission, your children.
The sites we looked at say they rely on outside AI providers to generate the videos. That means you’re trusting both the website collecting your photos and the providers processing them.
Wherever you upload photos, check who can access them and how they can be used. Scammers can use someone’s likeness to create fake intimate images and demand money to keep them private. In our Face Value report, 10% of respondents said someone had threatened to release AI-generated explicit content of them. We found no evidence of that happening through these Halloween sites, but it’s a reason to be careful where you share your photos.
The sites promise to delete uploads within days, and we have no evidence that they fail to do so. But we couldn’t independently verify those promises. Without an identifiable operator, it’s harder to establish who is accountable for handling your photos and responding to deletion requests.
Google sign-in doesn’t identify everyone handling your photos
These sites use the real Google sign-in window, so you type your password into Google, not the video site. But using Google to sign in doesn’t mean Google endorses the service or guarantees its privacy promises.
Click the app name in Google’s sign-in window and you’ll see Developer info. On one site we checked, the only contact listed was a Gmail address. We saw the same with the September sites. A Gmail address alone doesn’t establish wrongdoing, but it does little to identify the operator.
On another, Google said you were signing in “to continue to neon.tech.” Neon is a legitimate database company and authentication service provider. Its name appearing here doesn’t mean it operates or endorses the Halloween video site.
Login providers can handle Google sign-in on a site’s behalf. Depending on the setup, Google may display the provider’s domain instead of the video site’s name. Here, the sign-in screen gave visitors no clear indication of who operated the Halloween service.
Built from a kit, recycled for the next trend
Sites like these don’t necessarily take a team or months of work. Some use the same $249 website kit we wrote about in September, which promises you can “launch your AI product in one hour.” On one Halloween site, the builders hadn’t even cleared out the kit’s sample content. Hidden in the page was a note saying it was “a demo site” for the template, along with placeholder links like “your-app-name.”
Another site’s code contained remnants of an AI rap and dance video maker, including a “hotel lobby” stage, a recording studio, and AI-written raps. Those remnants suggest the site uses code also intended for other AI video services.
Using a website kit isn’t itself suspicious. But a polished page can be quick to assemble, so its appearance tells you little about the business handling your photos.
Take your time before paying, too
On one site, a single 15-second zombie clip cost $9.99. The pricing page nudged visitors toward bigger packs, bringing the advertised price per video down to $2.99. But that lowest price meant spending $199 on enough credits for roughly 66 zombie films. There were monthly and yearly plans too, costing up to $600 a year.
One site also used countdown offers, reminders in the browser tab, and claims about how many people had made films that day to encourage visitors to buy.
There’s no need to rush. Check the payment terms as carefully as the privacy policy. The sites themselves warn that AI can change faces, so your video may not look much like you. Under the policies we reviewed, credits are returned if a video fails to generate. But if you simply don’t like the result, trying again costs more credits.
Subscriptions renew until you cancel, yearly plans are charged in one go, and some credits expire before you use them.
What to check before uploading your photos
Whichever tool or platform you choose, make sure you’re comfortable with how it will handle your data, your photos, and your payment info.
Find out who runs the service. Look for a named operator and clear contact details. If you can’t establish who would be responsible for your photos, consider another service.
Check where your photos go. Read the privacy policy for information about outside AI providers, retention periods, and whether uploads can be used for AI training.
Look for a deletion process. Check how to request deletion and whether the policy explains what happens to copies held by outside providers.
Be especially careful with children’s photos. A parental consent checkbox doesn’t explain how a service will protect them. Only upload other people’s photos with their permission.
Read Google’s sign-in window. Check the developer details and any permissions requested. Google sign-in doesn’t replace checking the service itself.
Ignore countdowns and check payment terms. Take time to understand the full cost, credit expiry, and whether your purchase starts a subscription.
Review your Google connections afterward. Remove services you no longer use from your Google account’s third-party connections. This doesn’t cancel subscriptions or delete photos or other data already held by the service.
But these tools can’t verify a service’s photo deletion promises. You should still check who operates it and what its privacy terms say before uploading.
Something feel off? Check it before you click.
Malwarebytes Scam Guard helps you analyze suspicious links, texts, and screenshots instantly.
AI agents and associated tooling are becoming increasingly common in corporate infrastructure. Agents can perform a range of actions with the user’s privileges, such as accessing data, running commands, and interacting with external services. This creates new security risks, especially when these tools are used without the security team’s oversight or well-designed policies.
Detecting, tracking, and controlling AI agents is becoming one of the most pressing tasks for security teams today. We closely follow technological developments and continuously update our solutions to respond to new threats in a timely manner amid a rapidly changing technology landscape. This post describes new expertise built into Kaspersky products that helps counter the threats posed by the proliferation of AI agents. We approach this problem from several angles.
First, you need to thoroughly understand the threat you are dealing with. To this end, we added profiles to the Kaspersky Threat Intelligence Portal that describe various AI agents and how attackers exploit them. At their core, AI agents are programs (processes) that run in the operating system on endpoints and can also launch other processes. This means that Endpoint Detection and Response solutions are among the key endpoint controls for this threat. These solutions detect the presence and launch of AI agents, track their activity, and identify potentially dangerous behavior. When needed, they also take action, such as stopping a suspicious process, blocking the activity, or isolating the host, to reduce the likelihood of an incident escalating. For this purpose, we developed specially adapted detection rules.
You can use Kaspersky Endpoint Security, now also available as Kaspersky Next, to control and restrict the launch of AI agents. This solution uses two components to detect AI agents and control how they are used. Application Control categorizes the application processes launched on endpoints, and Web Control manages access to specific categories of web resources for users on endpoints.
Finally, even harmless AI agents can contain malicious instructions (skills), such as those downloaded from unsafe external sources. Kaspersky Scan Engine analyzes installed applications to detect these threats and also checks LLM files for malicious code. Let’s take a closer look at these solutions and technologies.
Popular AI applications and services in organizations
Tools from Anthropic and OpenAI take the top spots in the September 2026 ranking of AI agents by popularity among Kaspersky users. This list is based on telemetry from Kaspersky solutions. It shows the number of users who had the relevant AI vendors’ products installed at the time of the study.
#
AI product
1
Claude
2
Claude Code
3
Codex
4
OpenCode
5
Zed
6
Wispr Flow
7
LM Studio
8
ZCode
9
Chatbox
10
Cherry Studio
The data shows that agentic systems, especially AI agents for software development, are the most popular AI applications. The TOP 10 also includes an application for running large language models locally (LM Studio) and a voice note-taking app (Wispr Flow).
According to open sources, these are the most widely used AI services in 2026:
Number of published vulnerabilities in LLMs, AI tools, and plugins with similar functionality, 2025–2026 (download)
* Data for previous quarters was updated and may differ slightly from previously published data.
Application Control and Web Control
To enforce the organization’s security policy for AI agents and other AI applications on the corporate network, Kaspersky products offer application control based on KL categories. These categories classify installed software and give you granular control over which approved applications can run in the organization.
Application Control analyzes the processes launched on endpoints, tracking which AI agents are running in corporate systems at any given moment, on which hosts, and under which accounts. Application Control also shows how long a given program has been in use.
This makes it easier for the Kaspersky Security Center (KSC) administrator to control applications. Administrators can use KL categories to allow or block AI agents inside the company for specific groups of employees.
Here is what this functionality looks like to KSC administrators:
KL categories available when configuring Application Control
For details on how to configure Application Control in KSC, follow this link.
In Kaspersky Endpoint Security (KES), Application Control can operate in two modes:
Denylist. In this mode, Application Control lets users run any applications except those blocked by Application Control rules. This is the default mode.
Allowlist. In this mode, Application Control blocks users from running any applications except those explicitly allowed by Application Control rules.
Below are the steps to configure Application Control to block AI tools.
Configuring Application Control for the AI Tools category in KES
With this setup, when a user tries to launch an AI agent, they get a notification and the agent doesn’t start.
KES notification about an attempt to launch an AI agent
The View applications drop-down list shows products for a specific vendor.
Similarly, Web Control lets you manage user access to web resources. If a user tries to open a denylisted website, KES blocks access and shows a warning.
KES notification about an attempt to access a prohibited web resource
When configuring access, the administrator can block websites that provide AI as a service.
Website categories
For more on configuring Web Control, follow this link. The help portal also provides information on website categories that can be assigned to resources to configure access control.
Kaspersky Endpoint Detection and Response
To an EDR solution, an AI agent is a regular process. It has its own executable, a tree of child processes, and network communications, all of which need to be monitored for suspicious activity. An attacker can use an AI agent as an automation tool. An AI agent installed as a legitimate user tool can also be leveraged in a ClickFix attack, where it executes a malicious instruction received from an untrusted source, such as a document, web page, or email. That said, unsafe actions by an agent do not always indicate an attack. There may be no malicious intent in the chain at all. An incident can result from what looks like an ordinary instruction from a user who doesn’t fully understand the consequences of having it executed. The mere fact that an agent was launched does not reveal whether it is being used in an attack. That is why Kaspersky EDR (KEDR) uses both conventional behavioral rules and rules written and adapted to detect AI tools. The latter identify risky agent actions and settings, and help determine which AI tool was involved in suspicious activity.
Conventional KEDR rules detect the vast majority of familiar malicious techniques, including when performed by an AI agent. A suspicious PowerShell launch, persistence via Task Scheduler, or an attempt to steal credentials leaves clear, identifiable traces. These traces look the same no matter what initiated the actions. The rules analyze launch parameters, process relationships, affected files, network activity, and other telemetry events.
For example, in a recent Armored Likho campaign, we found signs that AI had been used to create loader and dropper samples, which were later compiled with NSIS (Nullsoft Scriptable Install System). The key telltale artifacts were icons in the scripts and excessive comments on every function, which is uncharacteristic of human-written code. In addition, the group continues to generate new modules for its BusySnake Stealer and BusySnake RAT samples. For example, the attackers used AI to develop a module that runs multiple checks for virtual environment artifacts and calculates a score. Depending on the score, the sample either runs or exits with code 0. Even though the initial access samples, payloads, and their modules were AI-generated, the commands they execute via rundll32 and PowerShell are detected by the shell_creation_by_rundll32 and suspicious_powershell_cmd_or_script_spawning rules.
So, for detecting an attack like this, it is not important who wrote the loader, the payload, or its modules: they are given away by the commands they execute, process relationships, and other traces of activity in the system. AI can be involved both in preparing the code and in carrying out the attack directly on the device.
In the latter case, the attacker uses the agent to carry out their tasks and lets it choose and run the required commands within the privileges it has. For effective protection, it is critical to link suspicious actions back to the AI tool and the conditions under which it operates. In KEDR, several specialized rules handle this task.
We have created separate rules for popular AI agents, ai_agent_*_access_to_sensitive_file_**, where * is the tool name and ** is the operating system. They generate alerts when an agent accesses files that contain credentials, tokens, or keys.
The ai_agent_dangerous_execution_mode rule detects agents launched with auto-approval of all actions (so-called YOLO mode) or with the sandbox disabled. These settings do not indicate an attack on their own, but they let the agent perform dangerous actions without user confirmation.
The suspicious_mcp_server_artifact rule triggers when MCP server scripts are created or modified in hidden, temporary, or cache directories. Attackers can place an MCP server in these locations to quietly connect it to the agent: through the MCP server, they can pass instructions to the agent, call third-party tools, and access the user’s data.
The llm_api_access_by_unusual_apps rule generates an alert when an application on Windows, Linux, or macOS connects to the API of a known external LLM service, unless this activity falls under predefined exclusions. This helps spot model access by applications that do not normally behave this way.
Some Kaspersky EDR rules tag events for investigation but do not generate alerts. For example, the ai_agent_**_execution rules flag launches of known agents on Windows, Linux, and macOS. The local_ai_model_artifact rule records the creation or modification of AI model files in typical application, runtime, and cache directories. These events reveal AI tools on the device, including tools that run on local models and never call an external API.
The Kaspersky Threat Intelligence Portal offers a large number of software profiles, including profiles of AI agents. You can sort them by the ai_ prefix:
AI agent profiles on Kaspersky TIP
The profile of an AI agent such as Claude Desktop includes a detailed description of the software, the privilege level required to run it, supported platforms, and threat actor groups known to use it. It also lists tactics and techniques mapped to the MITRE ATT&CK framework, with descriptions of the procedures the tool can be used for.
Claude profile on Kaspersky TIP
The description also lists ways to detect the software through standard system auditing mechanisms:
Windows: events from standard audit logs and Sysmon events
Linux: syscall audit events and Sysmon events
Network auditing: a set of protocols and the traffic generated by the software
The detection section lists the main artifacts the software leaves in the system: command lines, possible launch parameters, names of the services and scheduled tasks it creates, and the key network artifacts.
Detection section in the Claude profile
Hunt Hub
In December 2025, the Kaspersky Threat Intelligence Portal added Hunt Hub (HH), a repository of detection rules. This is a unique Kaspersky project, and we developed it in response to growing market demand.
This functionality is available in the Threat Landscape section of the portal. It gives analysts access to detection rules: their descriptions and their mapping to MITRE ATT&CK tactics and techniques, as well as to the associated cybercriminal groups.
In the Hunt Hub section, customers can explore the detection logic of EDR, NDR, and NGFW products, including the logic for detecting AI agents.
Rules in the Hunt Hub repository
The rule card provides:
Detailed description
Rule’s severity level, confidence level, and alert format
Detection tips
Description of possible false positives
Platforms the rule can run on
Tactics, techniques, and sub-techniques covered by the rule
Groups that use the technique covered by the rule
Detection logic that shows what exactly triggers the rule
Detection rule card in Hunt Hub
Kaspersky Scan Engine
Skills are a key component of the AI agent ecosystem. They’re prewritten sets of natural-language instructions that extend agent functionality. We previously covered the risks that malicious skills pose to agent users. A skill can require the usage of additional programs and services, come with helper scripts (for example, written in Python), or contain a malicious command embedded right in the instruction text. This means that adding skills to an originally harmless AI agent opens up several new ways for malicious code to enter the system. To prevent this, any skills obtained from external sources must be scanned. Kaspersky Scan Engine is well suited for this task. This is a cyberthreat detection and response solution that seamlessly integrates with various applications. It can detect malicious code in agent skills, associated scripts, and in files generated by running agents.
Detection of a malicious agent skill in Kaspersky Scan Engine
Trained LLMs come in many formats. Some of them (PTH, PT, PKL, KERS, and others) also store parameters and weights (training datasets). These files can also contain malicious code, so it’s critical to scan them before running and using them. Kaspersky Scan Engine scans potentially dangerous LLM formats for infected data. It can deserialize and analyze models to detect malicious code regardless of model size.
Detection of an LLM with malicious code in Kaspersky Scan Engine
Conclusion
AI agents are rapidly making their way into corporate environments: they help employees work faster and take on a wide range of tasks, but they also open up new opportunities for attackers. To take advantage of this technology without compromising security, organizations need to build multi-layered protection and minimize risks. A range of Kaspersky solutions can help with this:
Kaspersky TIP keeps you up to date on current scenarios in which attackers use AI agents, and its Hunt Hub section provides rules for detecting suspicious AI agent activity.
Kaspersky EDR detects AI agents in the infrastructure and monitors their activity on endpoints. If it detects potentially dangerous actions, the product can log the event, notify the SOC, and take response actions, such as stopping the process or isolating the host.
Application Control in Kaspersky products can fully restrict the use of AI agents within the company by using application categorization. The Web Control component can restrict access to AIaaS web resources.
Kaspersky Scan Engine can be integrated into various company processes to detect malicious code in any files, including AI agent skills and LLMs.
When companies combine the tools described above in a comprehensive approach, they can adopt AI agents in an informed way: with an understanding of the associated risks and effective means of minimizing them.
The AfD has confirmed that hackers breached its hosting provider. A leak site now claims to offer 421,179 of the party’s internal emails, and shows AI-written summaries rather than the emails themselves.
Read more in my article on the Hot for Security blog.
In the first half of 2026, Flashpoint tracked more than 22 million threat actor posts discussing, sharing, or advertising AI toolkits for criminal deployment. The figure reflects AI’s growing presence across the cybercriminal underground, where adversaries are using new capabilities to accelerate attacks and develop malicious tooling with fewer resources.
For enterprise defenders, these developments are adding pressure to threat intelligence programs already managing high alert volumes, limited analyst capacity, and expanding responsibilities.
Missed the live webinar? We’ve rounded up the key takeaways below, and the full session is now available to watch on demand.
AI Is Changing the Economics and Speed of Cybercrime
AI is helping threat actors develop capabilities and execute attacks faster, reducing the time and expertise required for activities that previously demanded greater resources.
Several developments illustrate the broader shift in cybercrime economics and attack velocity:
Initial access costs have declined by approximately 69%, reflecting the continued commoditization of access to compromised environments.
Attackers published 637 malicious package versions in just 22 minutes during a software supply chain compromise.
Nearly one in five vulnerabilities disclosed during the first half of this year had public or functional exploit code available, narrowing the window for defenders to address exposed systems.
AI is primarily accelerating established techniques, particularly during the early stages of the attack chain, including reconnaissance, social engineering, vulnerability discovery, and exploitation.
For defenders, this creates an opportunity to identify and disrupt malicious activity during its preparation stages. However, it also raises expectations around how quickly intelligence teams can recognize emerging threats, prioritize relevant findings, and act before an attack progresses.
AI Is Changing How Cybercriminals Develop Tools and Share Knowledge
AI is also changing how threat actors acquire the skills and capabilities needed to carry out attacks, creating new challenges for intelligence collection.
Historically, underground communities enabled cybercriminals to collaborate, exchange expertise, and obtain specialized services. Increasingly, threat actors can use AI to troubleshoot code, develop malicious tooling, and learn unfamiliar techniques independently, reducing their reliance on public collaboration.
“No longer do they need a community to build up their skills like they previously had. So we’ll see less of the development, and what we do see is a finished tool showing up for sale.”
Ian GrayVP of Intelligence, Flashpoint
Reduced activity in underground communities does not necessarily mean cybercriminal activity is declining. While forums, encrypted messaging platforms, and other illicit communities remain important intelligence sources, collection strategies must account for changes in how and where adversaries develop and distribute their capabilities.
Threat Intelligence Teams Are Struggling to Keep Up with Growing Demands
As adversaries accelerate their operations, enterprise threat intelligence teams are contending with growing workloads and limited resources.
Independent research commissioned by Flashpoint surveying threat intelligence budget owners and influencers at large North American enterprises identified several leading operational challenges:
65% cited alert noise and false positives.
55% identified analyst bandwidth and effectiveness.
50% pointed to the evolving threat landscape.
50% cited tool integration and interoperability challenges.
Note: Respondents could select up to three challenges.
High alert volumes, disconnected systems, and manual investigations consume analyst time that could otherwise be spent addressing emerging threats.
As one healthcare threat intelligence leader explained:
“Good analysts take time to develop and train, and we can’t hire our way out of that problem.”
These challenges are prompting organizations to examine how they can improve existing workflows, reduce repetitive investigations, and make better use of analyst expertise.
Threat Intelligence Budgets Are Growing, with AI Threats Leading Investment Priorities
Despite operational pressures, organizations are continuing to invest in threat intelligence.
Flashpoint’s research found that 50% of respondents expect their threat intelligence budgets to increase over the next 12 months, including 35% anticipating increases of at least 10%. Another 40% expect budgets to remain essentially flat, while 0% anticipate a decrease.
AI-related threats emerged as the leading priority for expanded intelligence coverage, particularly:
Deepfakes and synthetic media, including their use in impersonation, fraud, and social engineering.
AI-accelerated vulnerability exploitation, as adversaries identify and exploit weaknesses more quickly.
Emerging AI-enabled attack vectors, including changes in threat actor tactics, techniques, and procedures.
Organizations are also investing in additional intelligence feeds, expanded security use cases, and further development of their intelligence programs.
These priorities reinforce the importance of translating AI-related threats into specific intelligence requirements aligned with organizational risk.
Agentic AI Adoption Is Underway, but Trust and Measurable Value Remain Essential
Alongside investments in AI-related threat coverage, organizations are exploring how agentic AI can improve their own intelligence operations.
Flashpoint’s research found that:
25% are already using agentic AI in production.
20% are piloting agentic AI or conducting proofs of concept.
35% are planning adoption within the next 12 to 24 months.
20% are taking a wait-and-see approach.
Early implementations focus primarily on information retrieval, alert prioritization, contextual enrichment, intelligence platform queries, and MITRE ATT&CK mapping.
Organizations remain more cautious about granting agents autonomy over consequential actions, such as blocking IP addresses or changing security controls.
One research participant captured the concern:
“An agent that’s confidently wrong is worse than one that’s slow.”
Accuracy, data privacy, auditability, predictable costs, and human oversight remain central considerations. Organizations also expect AI investments to demonstrate measurable value through time savings, improved efficiency, and faster response.
“We’re out of the phase of treating AI as inherently good and giving it a blank check. Now, it’s about figuring out how to make it work within existing teams, workflows, and priority intelligence requirements.”
Joe Sawyer Chief Market Officer, Flashpoint
Preparing Your Threat Intelligence Strategy for 2027
As organizations prepare for 2027, four priorities can help guide threat intelligence planning:
Plan for threats you cannot readily observe. Identify potential gaps in intelligence collection and examine emerging attack methods, including weaknesses in internal security processes.
Prepare for machine-speed attacks. Evaluate detection, prioritization, and response capabilities against increasingly compressed attack timelines.
Turn AI threats into actionable intelligence requirements. Map emerging techniques to relevant adversaries, established frameworks, defensive controls, and business risks.
Use agentic AI where it can extend analyst capacity. Prioritize repeatable workflows that deliver measurable value while maintaining appropriate data controls and human oversight.
Sign up here to receive Bellingcat’s biggest investigations by email as soon as they are published.
In September, the AI company Anthropic published a blog post that claimed its models were approaching “superhuman capabilities for geolocating outdoor photos”. Anthropic made this claim by comparing its models’ performance to that of players of the popular online game GeoGuessr, which challenges users to geolocate Google Street View images.
Bellingcat has been running its own benchmark tests on AI models since June 2025, right around the time when Large Language Models (LLMs) began to challenge reverse image searches for assisting with geolocation tasks. In our first round, GPT 4o-mini from OpenAI appeared to be the best tool for geolocating, a title which was taken by Google AI mode when we performed our second round of tests a few months later in August 2025.
This time, we significantly upped the ante for the models, providing increasingly challenging photos and asking for only one set of coordinates. We tasked not only closed-weight models from Claude, Grok, Gemini, ChatGPT, and Mistral, but also open-weight models from Moonshot AI’s Kimi, commercial provider GeoSeer and the non-generative geolocation model GeoClip. In total, we fed each model 52 photos that had not been published anywhere on the internet before.
The results showed that the current generation of models have markedly improved geolocation capabilities. Anthropic’s Opus and Fable, as well as Google’s recent Gemini 4 Argon model, performed the best on geolocation tasks, narrowing down locations from images faster than a human could under specific conditions. Preliminary tests of a set of agentic skills and tools being developed internally by Bellingcat also showed promising results in further improving the geolocation performance of generic-use AI agents.
But crucially, the tests also showed why humans remain necessary for accurate and trustworthy geolocation work, as no models were foolproof. This is particularly important given the increased use of AI in military contexts. The Anthropic blog post focused specifically on geolocating photos for military and intelligence purposes such as targeting, a historically labour-intensive process requiring significant human expertise.
While our tests showed some models performed extremely well at narrowing down results to the correct general area, none were close to being perfect at finding the exact spot a picture was taken. That accuracy is extremely important in geolocation, especially in military contexts where the cost of incorrect information can be life or death. It is also important for organisations like Bellingcat whose reputation relies on pinpoint factual accuracy.
Our Methods
To compare model results, we used two metrics built on the distance in kilometres between a prediction and the real location. GeoGuessr Score was used to assess whether models could systematically identify the general area, while the Mean Log Score (explained below) measured which models most accurately pinpointed the correct location in the final few kilometres.
The GeoGuessr Score metric is based on the online game of the same name, whose scoring system Stanford University academics reverse-engineered in a 2024 study. This system rewards answers close to the general area an image was taken, but does not strongly distinguish between guesses close to the precise location. For example, an answer 200km from the correct location with more points than one 2,000km away. However, an answer 500m from where a picture was taken and another 5km away achieve a similar score. For real-world geolocations, that distance matters a great deal.
For more precision, we introduced a custom metric that grades models higher if they narrow down the search in the last few kilometres. This metric, the Mean Log Score, assigns a value from 0 (completely inaccurate) to 100 (perfect model) and works on a logarithmic scale instead of a linear one like GeoGuessr score.
Therefore, a 10-fold improvement in distance means the same whether it is from 5km to 500m or from 500km to 50km. You can compare both metrics here.
Below are the model results sorted by either metric, showing how many photos each model geolocated within distance bands from the true location.
Several models placed at least 10 out of the 52 photos correctly within one kilometre, and the top-performing models placed over 50 percent of the photos within 25 kilometres.
NOTE: Geoseer-fast refused to answer on four of the 52 photos, claiming “This image is not suitable for geolocation”, while Mistral-large-4 refused once with “insufficient information in image to identify location”. Kimi-k2.6 also failed to provide a set of coordinates on one photo, and Gemini 4 Argon timed out repeatedly on one photo.
Our Test
To independently assess the models, we sought to give them very specific instructions and some images that were harder to geolocate than those provided in our past tests. The prompt asked for a single set of coordinates reflecting the photographer’s location. The purpose of restricting the response in this way was to prevent hedging, such as multiple guesses or confidence scores, and make the grading more uniform across different models. Models were allowed to use their providers’ built-in tools: search, code execution and page fetch. We capped their token output at 64,000 and ran each model under its default effort setting with a maximum time of 15 minutes per photo. If a model did not return coordinates on the first prompt, we also allowed a single rescue prompt asking it to do so using its previous reasoning and without using any tools.
The images provided were unique, from around the world, not published on the internet before, scrubbed of metadata and provided without any context. They did not contain significant landmarks. We also included images in snowy, foggy and nighttime conditions.
The results show that the LLMs tested could, in many circumstances, successfully narrow down a location much faster than a human can geolocate even without any context. This is not limited to Google Street View-style images. Take, for example, this image of vegetation and a very small part of a rooftop.
An example of a photo used for testing, with annotation added after the test to highlight the only man-made object visible. Credit: Bellingcat.
For an average person, identifying the country this photo was taken in without any context could take a significant amount of time. However, multiple models quickly narrowed it down to Kenya. You can navigate their answers in the map below. Notice how several correctly inferred enough vegetation details to narrow down the exact part of the world and the park itself, but also that for many, the final response was a best guess only. It is important to note that even though some models were correct, others were significantly off.
The full model results for all 52 photos can be seen in the table below.
Of the models tested, Gemini 4 Argon scored highest on the Mean Log Score, and Claude’s models (Opus and Fable) were at the top of the table regardless of the score metric. Even Claude Sonnet, the weakest of its lineup, consistently came close to the real location while being the fastest to answer across all models.
This was followed by GPT-6 Astra and GPT-6.1 Sol, as well as other Claude and Gemini models, and then the geolocation-specific model, GeoSeer Fast, which provided good results but also timed out frequently. We tested GeoSeer’s more competent Agent model, but it refused to answer on eight photos and regularly timed out.
For secondary factors like time and cost, Claude also performed well on both metrics, and Gemini Argon, while much slower, came at a similar cost to Opus. Based on API rates, Argon and Opus models offered the best balance of accuracy and cost, especially compared to Fable and Grok. Grok was the most expensive option and had an underwhelming bottom-half performance. Meanwhile, GeoClip was freely available but only outperformed Claude Haiku.
Model Limitations
While we sought to analyse the most prominent models, there was one that we could not include as it has yet to be fully released.
Support Bellingcat
Your donations directly contribute to our ability to publish groundbreaking investigations and uncover wrongdoing around the world.
In its blog post, Anthropic claimed its Mythos model beats “even the strongest human baseline on median distance error, scoring 37.0km and 47.2km across 6,000 photos (placing 23.7 percent and 23.1 percent within 1km).“ But Nuno Moniz, Associate Research Professor at the Lucy Family Institute for Data & Society at the University of Notre Dame, told Bellingcat that “the median represents a strong simplification of what would be acceptable to compare AI-based system performance with regards to humans”.
Anthropic compared its models to competitive GeoGuessr players and their success in identifying the location of Google Street View images. The entire set of test images was online and there was no guarantee the models were processing the imagery for the first time.
While Anthropic has been relatively open about these methods, not all developers have been as forthcoming. It is therefore difficult to assess whether the same limitations will impact all other models, or whether there will be further caveats that we are simply not aware of.
Moniz said that “the increasing availability of benchmarking tools and datasets has made it somewhat difficult to measure reliability in test results such as these”. Specifically, due to the ”uncertainty as to whether that data was included in its training”. This is why we ran our Bellingcat tests with non-published photos sourced from Bellingcat staff and the Bellingcat Volunteer Community.
A further limitation of any models comparing performance to GeoGuessr scores is that the game uses images from Google Street View, which is limited to a select number of countries, and within these, a limited number of roads. Street View is also intentionally skewed to feature clear, high-quality photos taken during daytime that are useful for navigation, and users can pan around their view. There are also some well-known tricks that allow GeoGuessr players to bypass actual geolocation to correctly guess the location of photos: for example, Google is known to use a black car in Jordan and a white car in the UAE to capture imagery. While this wouldn’t necessarily impact model performance, it is a drawback of measuring against GeoGuessr score as the game has a set of workarounds that can bypass geolocation skill.
Anthropic’s data consisted of thousands of social media photos of various scenes. Once again, though, these photos were online and may have featured in the model’s training data. Anthropic’s blog post contained four images as an example of this dataset.
Images used as part of Anthropic’s dataset. Credit: Anthropic.
The examples Anthropic shared are relatively easy to geolocate as they feature recognisable buildings and signs. But footage that requires geolocation often comes from regions where access is limited and which do not feature on social media or Street View.
Specifically, in a military and intelligence context, footage often involves low-resolution material and intentionally obscured details recorded in remote or inaccessible areas. Context that could be found online can be uncertain or plain wrong, especially during a developing situation, such as the image below that Bellingcat investigators geolocated when verifying a US strike on a school in the city of Minab in Iran that killed at least 120 children earlier this year.
An example of footage geolocated by Bellingcat. Screen shot from Mehr News.
Anthropic researchers acknowledge this caveat, writing that it “does not as clearly emulate the task of precisely pinning down a location in near-real-time in a less populated battlefield setting; that is a task for future research.”
As noted, it is also possible that similar caveats need to be applied to other models when seeking to understand and interpret any geolocation-related benchmarking.
Supercharged Models
In parallel to the above models, we also tested a set of agentic skills and tools being developed internally by Bellingcat. These are researcher-informed instructions and code that can equip generic-use AI agents to augment their geolocation ability. For instance, we designed skills such as allowing it to download Environmental Systems Research Institute (ESRI) satellite imagery tiles. We also designed another skill that enabled direct access to data from Bellingcat’s OpenStreetMaps search tool, which aims to assist geolocation efforts by comparing items identified in imagery (like the position of a pylon compared to a nearby railway line) to OpenStreetMaps data. GeoSleuth is a similar project that has already been published, which we used for comparison. We picked Claude’s Opus 5.5 model to run both skills customisations because of its strong performance and reasonable pricing, and ran all the photos through the supercharged models under the same conditions – except that they had no timeout enforced as the supercharged models required more time to utilise their extra skills.
The different timeout conditions and expanded toolset do not allow for a direct comparison of the customised models to the previous off-the-shelf models’ results, even if they both outperformed the barebones Opus model they were based on, and all other models on GeoGuessr Score, with only Argon ranking above Bellingcat’s agent in Mean Log Score.
Still, this test allows us to showcase why skill customisations can bring value. Take the following photo.
An image captured at the Global Campus of Human Rights in Venice. Credit: Bellingcat.
This is not an exceptionally hard geolocation, and 11 of 17 models answered within 5km of the actual capture location in Venice, Italy. GPT-Sol answered with the correct monastery, but only Bellingcat’s agent and GeoSleuth answered with the exact camera position coordinates. This was possible because both model customisations can download and compare satellite imagery tiles, which allows them to validate not just which monastery the photo was taken at but also the correct courtyard position and orientation from visual cues. You can click the buttons in the list below to audit each model’s final answer.
While in this instance the supercharged models got the exact spot, there were other instances where they did not, as the scores in the results table above show. This again emphasises that even with extra skill sets added, these models were still far from infallible.
Tests Conclusions
Despite increased model improvement, our analysis shows that important caveats remain and it is important to keep a human in the loop when seeking to guarantee a geolocation is precise and correct.
Our tests show that the coordinates models provide as answers are rarely an exact match, even with supercharged models. Invariably, even the best models, with the best tools, can confidently claim a wrong position. Anthropic says its Mythos model was able to pinpoint less than a quarter of its social media photos dataset within a 1km radius. But narrowing down a location is rarely the trickiest part of geolocation work. A large part of important geolocation work is in the final stretch: finding specific coordinates from a general area. This level of specificity is needed because a general area is not a match. Matching features and perspective are necessary for an accurate geolocation, and in many cases that is done on very low-quality images or even by cross-referencing multiple sources.
This level of precision is essential for investigations where it matters what building a person could be found at, what lines of sight individuals might have had, or what impact an air strike might have led to.
Since LLMs can still confidently get things wrong, as our analysis shows, all results still have to be verified independently. Strong human geolocation skills therefore remain crucial, as the more one understands about geolocations, the better one can verify or take to completion an automated result.
Though it can speed up geolocation work significantly, especially in narrowing down an area of interest, AI models remain a useful assistant rather than a tool we can blindly delegate geolocations to.
Bellingcat is a non-profit and the ability to carry out our work is dependent on the kind support of individual donors. If you would like to support our work, you can do so here. You can also subscribe to our Newsletter and follow us on Bluesky here, Instagram here, Reddit here and YouTube here.
Table Of Contents
