Intelligence indicates that state-sponsored actors are increasingly using 'Shadow AI'—unfiltered, self-hosted versions of frontier models—to bypass the safety guardrails of commercial providers like OpenAI or Anthropic. These models are being trained on leaked source code (e.g., Trellix, Microsoft) to identify zero-day vulnerabilities in proprietary software. The NCSC's 'Patch Wave' warning is a direct consequence of this industrialization. We are seeing a transition from 'AI-assisted' hacking to 'AI-orchestrated' campaigns where the model handles everything from target selection to exploit delivery.