19 Verified LLM-Assisted
Cyber Operations
Every campaign in this index was confirmed by the named AI company or threat intelligence team. ✓ denotes direct verification. Click any source group in the sidebar to see session-by-session decompositions with behavioral bit annotations for each fragment.
Anthropic-Confirmed
Campaigns
Each session prompt pattern is shown with the behavioral bits (bf) it fires and its individual safety verdict — demonstrating how every fragment passes per-query filters despite the combined chain being malicious.
Google GTIG-Confirmed
Campaigns
GTIG named and tracked campaigns with codenames. Includes the first LLM queried in a live attack (PROMPTSTEAL), self-modifying malware (PROMPTFLUX), fileless in-memory payload (HONESTCUE), and living-off-LLM via victim's own AI (QUIETVAULT).
OpenAI-Confirmed
Campaigns
ScopeCreep (iterative RAT refinement) and Russian malware clusters. Detected via cross-session behavioral analysis — exactly the pattern FragBench is designed for.
Cross-Vendor Confirmed
Campaigns
MalTerminal (GPT-4 embedded in compiled binary), WormGPT/KawaiiGPT (uncensored LLM market), AI phishing 4.5× effectiveness, and deepfake identity fraud growing 195% YoY.
The 16-Bit Behavioral
Indicator Vector bf
Each code fragment is reduced to this 16-bit vector by AST analysis. The key insight: many different prompt phrasings produce the same behavioral bit pattern, making bf robust to surface-level variation — unlike keyword matching.
Data Exfiltration —
All Fragment Variations
For each session, multiple prompt phrasings and paraphrase styles are shown. Each variation produces the same behavioral bits — demonstrating why bf catches the pattern regardless of how the attacker words the request.
Ransomware Campaign —
All Fragment Variations
Session 8 (ransom calibration) is the AI-unique fragment with no behavioral bits — detection requires sequence analysis: financial analysis immediately after b10+b11 (encrypt+archive) is the signal.
Malware Refinement —
All Fragment Variations
The iterative loop creates self-loop edges: fi→f'i→f''i. Semantic similarity edges fire across iterations (same intent, different syntax). Each AV-evasion prompt is a "fix my code" request.
Supply Chain Operation —
All Fragment Variations
Longest kill-chain: 9 of 14 ATT&CK tactics. The graph diameter of this chain is 6 — requires L≥5 GNN layers for full context propagation from S1 to S7.
CVE Exploitation —
All Fragment Variations
Fang et al. 2024: 87% success with CVE description, 7% without. The fingerprint→CVE→exploit progression is the kill-chain signature FragBench detects.
How Fragments Flow
Through MCP to Attack
Each LLM decision becomes a tool_call(). Each tool_call produces a fragment that FragBench parses for bf bits and adds to the account graph Ga. Watch KCC rise with every step.
Zero-Skill Ransomware —
Build Trace
No MCP — direct API calls. Each session is a standalone fragment. The attacker assembles the pipeline manually. FragBench detects via temporal+semantic edges between sessions from the same account.
Iterative Refinement Loop —
Self-Loop Detection
Each "fix my code to evade AV" session creates a new fragment. Semantic edges fire between iterations (same C2 intent, new encoding). FragBench's self-loop chain template triggers at 3+ iterations.
Fileless Payload —
What FragBench Can and Cannot See
The loader binary is a fragment. The runtime Gemini payload is NOT a fragment — it never exists in the API session. This is FragBench's fundamental limitation for fileless attacks.
Feature Vector xf ∈ ℝd
Construction
Four groups concatenated per fragment. The same attack fragment vs its benign twin side-by-side — same behavioral bits, completely different risk scores because graph context is the differentiator.
Ga = (V, E, X, λ)
Five Edge Types
Fragments from the same account form a directed labeled multigraph. Edges are added incrementally in streaming mode. The ATK-01 graph below shows all 5 edge types connecting 6 fragments.
Heterogeneous GAT
Message Passing
Type-specific attention weights αfg(κ,ℓ) per edge type κ. After L=3 layers, each node encodes its full L-hop neighborhood — a benign encrypt fragment "sees" the SSH brute force two hops away via kill-chain edges.
Classification Heads
& Graduated Alerts
Three output heads: node-level risk scores rf, graph-level account classification ya, and kill-chain coverage KCC(C) for subgraph template matching.
Add Fragments — Watch
the GNN Classify
Each fragment looks safe individually. Add them one by one and watch KCC rise, edges materialize, and the account classification flip: MONITORING → SUSPICIOUS → ALERT.