{
 "id": "AIR-2026-0355",
 "slug": "ai-in-the-middle-web-based-ai-services-as-c2-relays",
 "title": "AI in the Middle Web-Based AI Services as C2 Relays",
 "summary": "Researchers demonstrated an attack where malware uses unauthenticated public AI assistants as covert command-and-control relays. The technique leverages standard URL-fetch capabilities to exfiltrate data and receive attacker instructions.",
 "type": "ai_enabled_attack",
 "categories": [
  "ai_assisted_intrusion"
 ],
 "severity": 1,
 "targets": [
  "xAI",
  "Microsoft"
 ],
 "products": [
  "Grok",
  "Microsoft Copilot"
 ],
 "incident_date": "2026-02-17",
 "incident_date_precision": "day",
 "first_reported": "2026-06-30",
 "sources": [
  {
   "url": "https://atlas.mitre.org/studies/AML.CS0061",
   "publisher": "MITRE ATLAS",
   "title": "AI in the Middle: Web-Based AI Services as C2 Relays",
   "published_at": "2026-06-30"
  },
  {
   "url": "https://research.checkpoint.com/2026/ai-in-the-middle-turning-web-based-ai-services-into-c2-proxies-the-future-of-ai-driven-attacks",
   "publisher": "research.checkpoint.com",
   "title": "AI in the Middle: Turning Web-Based AI Services into C2 Proxies & The Future Of AI Driven Attacks",
   "published_at": "2026-06-30"
  }
 ],
 "source_count": 2,
 "confidence": 0.95,
 "status": "published",
 "origin": "seed_atlas",
 "tags": [
  "c2",
  "copilot",
  "grok",
  "ai-in-the-middle"
 ],
 "created_at": "2026-10-18T06:55:08.239Z",
 "updated_at": "2026-10-18T06:55:08.239Z"
}