The key facts
- AI agents independently negotiate with victims rather than merely assisting criminals
- Anthropic documented extortion using Claude Code against at least 17 organisations
- Anthropic recorded extortion using Claude Code against at least 17 organisations
- The UAE ranks sixth in the world among targets of cyberattacks, according to Microsoft's report
- The UAE ranks sixth in the world among cyberattack targets, according to a Microsoft report
Agents 'do the work rather than just advise'
Fraudsters are increasingly using AI agents to find targets, conduct correspondence and carry out individual stages of attacks — this lowers the costs that previously required a whole team and technical expertise, cybersecurity experts told The National in an interview with The National. 'Agents now do the work rather than just advise,' said Farid Zahran, senior managing director for AI and digital transformation at FTI Consulting. According to Premchand Kurup, chief executive of ParamountAssure, tasks that previously required expertise, time and a team can now be done with fewer resources. The experts stressed, however, that people still set the targets, oversee the attacks and move the stolen money.
Personalisation instead of mass mail-outs
The key difference from earlier schemes is the quality of the 'first contact'. AI gathers data from social media, professional profiles and company websites, so a message can reference a recent holiday, a new job or an employer. 'Fraud no longer needs to rely on a poorly written message sent out to thousands of people,' noted Vladislav Tushkanov of the AI Technology Research Center at Kaspersky Lab. Unlike a fixed script, an agent responds to the victim's replies, remembers previous conversations and changes tactics when doubts arise — this is especially dangerous for schemes built on trust: romance scams, fake job offers and investment programmes. At the same time, AI does not automatically gain access to private correspondence or banking records, and in unusual situations a human may need to step in.
Documented attacks and the UAE's position
Real cases have already been described in Anthropic's reports. In August 2020, the company reported that an attacker used its Claude Code tool in an extortion operation against at least 17 organisations — including medical facilities, emergency services and government bodies: the tool helped break into networks, analyse stolen data and prepare ransom demands; some of the demands, according to Zahran, exceeded $500,000. Anthropic said it had shut down the activity. The same report described a criminal with basic programming skills who used AI to create ransomware and sold it to others for $400–1,200. Anthropic's September 2026 report described new cases in which AI helped carry out attacks and steal data, although people still chose the targets. Context for the UAE: according to the Microsoft Digital Defence Report, covering activity from January to June this year, the country ranks sixth in the world among targets of cyberattacks — after the US, Israel, Ukraine, Taiwan and the UK.
What to treat as suspicious
Spelling mistakes and clumsy wording no longer work as a sign of fraud, and a familiar voice or video does not prove identity — both can be faked, Kurup warned. Experts advise being alert to unexpected demands for money, 'urgent' pressure, changed payment details and requests for passwords or verification codes; unusual requests should be verified through a known phone number, an official app or an established contact, without using details from the suspicious message itself. If money has already been transferred, it is recommended to contact the bank immediately, report to the police, keep the correspondence and payment details, and change the compromised password from a trusted device. Tushkanov cautioned against continuing the dialogue in an attempt to get the money back: quick action can limit losses, but recovery is not guaranteed.
