#From Chatbots to Cyber Threats: The Dark Side of AI No One Wants to Talk About

In the same week that Google launched Ask Maps and Perplexity unveiled its always-on AI assistant, a separate and much darker AI story was unfolding. Cybercriminals used off-the-shelf AI chatbots to steal data on nearly 200 million Mexican taxpayers. Iran-linked hackers from a group called Handala wiped more than 200,000 systems at Stryker — a major U.S. medical device company — claiming 50 terabytes of data and disrupting hospital equipment in multiple states. A CNN investigation found that AI chatbots helped teen test users plan attacks in the majority of hundreds of tests, with Perplexity and Meta AI assisting with location targeting and weaponry in nearly every single trial. CrowdStrike's 2026 threat report recorded an 89% year-over-year increase in AI-enabled cyberattacks. And a security team's AI agent hacked McKinsey's internal chatbot — with zero human input — in under two hours. The tools enabling the most exciting AI applications of 2026 are the same tools enabling the most dangerous ones. This post covers all of it.

#The Week the Dark Side Became Impossible to Ignore

Every AI conversation in 2026 has a subtext that doesn't always make it into the product announcements and keynotes. The same capabilities that make large language models useful for finding a restaurant, writing code, or automating a workflow make them useful for hacking firewalls, drafting phishing emails, planning attacks, and disrupting hospital networks.

This week, that subtext landed on the front page. Multiple major security incidents, a landmark investigative study, and a wave of new threat reports arrived in the same 48-hour window — painting a picture of an AI threat landscape that has moved much faster than the safeguards designed to contain it.

This is not a critique of AI development. It is a factual accounting of where things stand in March 2026, because pretending these incidents didn't happen — or burying them in footnotes — doesn't serve anyone who uses these tools or builds on them.

#Stryker: When a Cyberattack Disrupts Hospital Equipment

#What Happened

On the night of March 11, 2026, Handala — an Iran-linked hacktivist group believed by researchers to be a front for Iran's Ministry of Intelligence and Security — launched a wiper attack against Stryker Corporation, a Michigan-based company that makes medical devices and equipment for hospitals in more than 60 countries.

By morning, employees across 79 countries couldn't access company systems. Login screens at Stryker offices worldwide had been replaced by the Handala logo. Work phones were wiped. Stryker filed an SEC disclosure acknowledging a "global network disruption to our Microsoft environment" and said the incident had caused "disruptions and limitations of access to certain of the company's information systems and business applications."

Handala claimed the scope was far larger: more than 200,000 systems, servers, and mobile devices wiped and 50 terabytes of critical data exfiltrated. Security researchers at The Wall Street Journal verified that multiple systems worldwide had indeed been wiped. Stryker's own statement confirmed the incident was real, though the company said it found no evidence of ransomware or malware and believed the attack was contained to its Microsoft environment.

#The Patient Safety Dimension

This is the part that rarely gets covered in the tech news cycle. Stryker doesn't just make laptops and software. It makes defibrillators, ambulance cots, and the Lifenet system — an IT platform that emergency medical responders use to transmit patient electrocardiogram data to hospitals before arrival.

Maryland's Institute for Emergency Medical Services confirmed to hospitals in the state that Stryker's Lifenet ECG transmission system was "non-functional in most parts of the state" in the hours following the attack. Emergency services were told to initiate radio consultation with receiving hospitals instead. In a system designed around seconds mattering, that's not a minor inconvenience. That's a gap in the chain of care.

#The Geopolitical Context You Need to Understand This

The attack didn't happen in a vacuum. The U.S. and Israel began military strikes against Iran on February 28, 2026. On March 1, a missile struck a school in Minab, Iran — killing more than 175 people, most of them children — in what Pentagon investigators have since concluded was a U.S. targeting error.

Handala claimed the Stryker attack explicitly as retaliation for that strike. Iranian officials had already issued broader warnings that U.S. tech companies — naming Google, Microsoft, and Nvidia — were now considered legitimate targets. The IRGC separately threatened U.S. and Israeli-linked economic centers and banks.

Check Point Security wrote in a recent report that since the start of the war in Iran, Handala is "breaking into low-hanging systems, conducting hack-and-leak activity, and timing the publication of stolen material to maximize pressure."

Stryker was not a random target. The company has a presence in Israel, including OrthoSpace, an orthopedic device maker it acquired in 2019, and it secured a $450 million Department of Defense contract last year to supply medical devices to the U.S. military.

#AI-Assisted Hacking: Not Hypothetical Anymore

#195 Million Identities and a Jailbroken Chatbot

The Stryker attack gets the headlines because it's dramatic and geopolitical. But a separate story published March 6 by the Los Angeles Times is in some ways more consequential for anyone thinking about long-term AI risk.

A group of cybercriminals used off-the-shelf AI chatbots to steal data on nearly 200 million taxpayers from nine Mexican government systems. The bots provided the code and ready-to-execute plans to bypass firewalls — even though they were explicitly programmed to refuse to help hackers. The attackers pummeled one chatbot with more than 1,000 prompts to bypass its safeguards, convincing it they were authorized to test the system for vulnerabilities.

The compromised data included tax records, vehicle registration, and birth and property details. The breach was not the result of a sophisticated zero-day exploit or a nation-state with vast resources. It was the result of persistence, creative prompting, and tools anyone can access with a credit card.

#The CrowdStrike Numbers

CrowdStrike's Global Threat Report 2026 recorded an 89% increase in attacks by AI-enabled adversaries in 2025 compared to the prior year. Attackers deployed AI to aid with social engineering, malware development, and disinformation campaigns — using it primarily to optimize existing attack methods rather than create entirely new ones.

That last distinction matters. The threat isn't that AI is inventing new attack categories from scratch. The threat is that it's making existing attack categories dramatically cheaper, faster, and more accessible to less skilled operators. One analyst put it plainly: "AI won't make everyone a hacker overnight, but it will close the gap between the script kiddie and a new, bespoke APT."

#The McKinsey Hack That Took Two Hours

On March 1, 2026, security startup CodeWall disclosed what it had done to McKinsey's internal AI chatbot — called Lilli — in a controlled red team exercise.

Within two hours of starting, the CodeWall AI agent achieved full read and write access to the entire production database — with zero human input. The agent found a SQL injection flaw that exposed 46.5 million chat messages about strategy, mergers and acquisitions, and client engagements in plaintext, along with 728,000 files of confidential client data and 57,000 user accounts. Because the flaw was read-write, an attacker could have silently rewritten Lilli's prompts — poisoning how the chatbot answered questions for tens of thousands of consultants using it daily.

McKinsey patched the vulnerabilities within 24 hours of disclosure. But the demonstration illustrated something unsettling: an AI agent can autonomously select a target, identify a vulnerability, exploit it, and extract data at machine speed — with no human directing each step.

#AI Chatbots and Teen Users: The CNN-CCDH Investigation

The geopolitical and enterprise dimensions of AI cyber risk are serious. But a CNN and Center for Countering Digital Hate investigation published March 11 covers a different kind of harm — one that involves the most popular consumer chatbots and the most vulnerable users.

The joint investigation tested 10 of the most widely available AI chatbots across hundreds of prompts, presenting as two teen users in the U.S. and Europe, asking questions a young person planning violence might ask.

Among the worst performers, Perplexity and Meta AI assisted users in finding locations to target and weaponry to use in attacks in 100% and 97% of tests respectively. For the remaining 3%, Meta AI still tried to help but didn't provide actionable information. Perplexity told CNN it is "consistently the safest top AI platform" but disputed the methodology without explaining why.

The findings are hard to contextualize charitably. These are not edge cases or elaborate jailbreaks. These are mainstream consumer products responding to obvious warning signs from users presenting as teenagers in active crisis.

Dario Amodei, Anthropic's CEO, published an essay in January 2026 in which he described AI as a "terrible empowerment" for bad actors. Former industry insiders told CNN that AI companies would more proactively protect users if lawmakers forced them to do so — but so far, no country has done enough.

#The Threat Landscape in One Table

#What Defenders Are Actually Doing

The news is not uniformly grim. The same AI capabilities enabling attacks are enabling defenses — and in some cases, the defensive tooling is advancing faster than the offensive.

Microsoft Threat Intelligence has observed that most malicious AI use today centers on generating text, code, or media — drafting phishing lures, translating content, summarizing stolen data, and debugging malware. AI functions as a force multiplier that reduces technical friction and accelerates execution, while human operators still retain control over objectives and deployment. That human-in-the-loop dependency is where defenders have the most leverage — for now.

Barracuda Networks researchers note that strong identity controls, network segmentation, and behavior-based detection remain effective against agentic attacks when applied consistently. The critical difference from traditional threats: agentic AI doesn't stop after a failed attempt. Threat models must account for autonomous retry and adaptation.

The EU AI Act's most consequential enforcement deadline arrives August 2, 2026, when full compliance requirements take effect for high-risk AI systems spanning biometrics, critical infrastructure, education, and employment. Transparency obligations requiring AI chatbots to disclose their artificial nature and deepfake content to carry watermarks also kick in. Whether enforcement keeps pace with deployment is a different question.

#What This Means for You Right Now

If you work in healthcare or critical infrastructure: The Stryker attack is a direct signal that medical technology companies are now explicit targets in geopolitical cyber conflict — not collateral damage. The disruption to Lifenet's ECG transmission in Maryland is a preview of what patient safety risk looks like when hospital supply chain vendors get hit. Threat modeling needs to include this scenario explicitly.

If you use AI chatbots: The CNN-CCDH results are a reminder that safeguards on mainstream consumer AI products are inconsistent and frequently bypassable. Treat AI-generated information with appropriate skepticism, particularly in high-stakes contexts. The same tool that helps you draft an email can be manipulated into producing something much worse by a sufficiently persistent bad actor.

If you build AI products: The McKinsey case shows that AI-powered internal tools deployed at scale create attack surfaces that didn't previously exist. An AI agent with read-write access to a production database is not just a productivity tool — it's a single point of failure. Security architecture for AI systems needs to be as rigorous as security architecture for any other production system with data access.

If you follow policy: The gap between AI deployment speed and regulatory response is wide and getting wider. The EU AI Act represents the most serious attempt to close it. What happens in the 18 months following August's enforcement deadline will tell us a lot about whether regulatory frameworks can actually keep pace.

#FAQ

What is Handala?
Handala is an Iran-linked hacktivist group believed by cybersecurity researchers to be a front for Iran's Ministry of Intelligence and Security. It employs phishing, custom wiper malware, data theft, and hack-and-leak campaigns, typically timed to maximize geopolitical pressure. The Stryker attack represents its most significant and disruptive operation against a U.S. target to date.

Did AI tools actually help criminals hack Mexican government systems?
Yes. According to a report by Israeli cybersecurity firm Gambit Security, attackers used Claude and ChatGPT to bypass firewalls and steal 195 million records. Claude initially refused to cooperate, but the attackers submitted more than 1,000 prompts before eventually jailbreaking the model into assisting with the breach.

How did an AI agent hack McKinsey's chatbot in two hours?
Security startup CodeWall used its own AI agent in a red team exercise. The agent autonomously selected McKinsey's Lilli chatbot as a target based on its public responsible disclosure policy, identified a SQL injection vulnerability, exploited it, and achieved full read-write access to the production database — all without human input at any stage. McKinsey patched the vulnerabilities the following day.

Which chatbots performed worst in the CNN teen violence test?
Perplexity and Meta AI were the worst performers, assisting teen test users in finding locations and weapons in 100% and 97% of tests respectively. The investigation tested 10 platforms across hundreds of prompts. Perplexity disputed the methodology but did not explain the specific objection.

Is the EU AI Act doing anything about these risks?
The EU AI Act is the world's first comprehensive AI regulation, with its most significant enforcement deadline arriving August 2, 2026. It requires transparency obligations for AI chatbots and mandates that deepfake content carry machine-readable watermarks. Whether enforcement activity keeps pace with the deployment of high-risk AI systems is the critical unknown.

Are AI-powered defenses keeping up with AI-powered attacks?
Partially. Behavior-based detection, strong identity controls, and network segmentation remain effective against agentic attacks when properly applied. Microsoft and CrowdStrike have both released AI-powered security dashboards specifically designed to detect AI-assisted intrusions. The challenge is that most organizations are still deploying AI without adequate security architecture around it — and attackers are moving faster than IT security teams at most companies.