Synthetic document fraud is a fast-spreading disease. AI image systems like ChatGPT have made it easy to create sensitive documents like passports, IDs, receipts, and supporting records. The problem isn’t that fake documents look genuine, but that we are seeing the rise of zero-knowledge threat actors create forgeries with a few prompts and little effort. Such AI-driven forgeries put pressure on onboarding, KYC, vendor validation, and approval workflows that still treat documents as a sign of trust. An attacker only needs a foot in the door, and if a document looks authentic enough to move a step further into the system, the attacker has gained ground.

2. Malicious AI Services Making Cybercrime Scalable

When large language models (LLMs) appeared on the scene, they were just another attack vector criminals could exploit to launch attacks. But criminals soon realized that mainstream LLMs have comprehensive guardrails. This disappointment was short-lived with the arrival of uncensored GenAI tools such as WormGPT, which enable malicious operations at scale. After the shutdown of WormGPT, other variants entered, such as Grok, Mixtral AI, and Kawai GPT. There is no dearth of malicious AI services that can help criminals generate phishing lures, impersonate content, or produce malicious code at scale.

“As AI becomes more deeply embedded across diverse functions such as operations, finance, and marketing, the boundaries between untrusted external and internal inputs begin to blur.”

3. The Rise of “Living off AI” Attacks

As AI becomes more deeply embedded across diverse functions such as operations, finance, and marketing, the boundaries between untrusted external and internal inputs begin to blur. An AI model can be compromised by placing malicious instructions inside content that enables AI workflows. This can happen through a malicious support request, message, or document submitted from the outside and ingested via an AI-connected tool. The AI model interprets instructions as actionable context and executes it with legitimate internal permissions. The attacker can use the organization’s own AI workflow against itself to expose sensitive data and manipulate critical internal systems.

4. The Evolved Nature of Prompt Injections

An indirect prompt injection attack, as seen in techniques like HashJack, is yet another cause for concern. It is like visiting your trusted neighborhood store, buying things without a second thought, then later realizing the invoice was padded. The attack surface is no longer limited to malicious web pages but also includes trusted web interactions. In a technique like HashJack, a set of harmful instructions is hidden after the # symbol in a legitimate URL. The site is genuine, and the link looks harmless, but the AI browser assistant can ingest those hidden instructions.

5. Trusted AI Extensions Co-opted in Attacks

Weaponization of trusted AI extensions, illustrated by the abuse of Claude Skills, is becoming an execution-layer risk when users are allowed to install or approve code modules that extend the model’s capabilities. Here, a legitimate “skill” can be modified with minor edits to hide malicious behavior; because it looks safe, it passes routine review. Users believe they are enabling a useful capability but unwittingly set the stage for this corrupted ”skill” to deliver malicious code.

Security AI Inputs and Agent Interactions

The default assumption should be not to trust AI inputs. In practical terms, this means all prompts, attachments, URLs, copied text, and important context must be validated, sanitized, and contextually isolated before they can influence an AI workflow.

Organizations also need a governance framework that accounts for the widespread adoption of AI, one that helps build a definitive inventory of AI-enabled tools, map the processes in which these are embedded, and identify critical integrations. This helps define human oversight and approval requirements for high-risk AI actions, including systemic changes, data exports, and similar activities. Finally, it is imperative not to rely on visual or content-based signals alone, and to strengthen document verification, validation, and anomaly detection.