Attackers are increasingly abusing AI services, a trend experts call “living off the AI land,” by leveraging legitimate tools like model context protocol (MCP) servers, AI assistants and dependency packages. In September 2025 a counterfeit MCP server mimicking Postmark was distributed through a node.js package, attracting 1,500 weekly downloads and siphoning password resets, invoices and memos for days before detection. Malware such as the SesameOp backdoor now hides command-and-control traffic inside the OpenAI Assistants API, while Check Point Research showed that Microsoft Copilot and Grok can be manipulated via public web interfaces to fetch attacker-controlled URLs without an API key. Dependency poisoning also resurfaces: a compromised NPM package seeded the Shai-Hulud worm in September 2025, and the “EchoLeak” command injection vulnerability (CVE-2025-32711) in Microsoft 365 Copilot lets a single email exfiltrate internal files. These tactics expand the AI threat surface beyond prompt injection to agent hijacking and supply-chain attacks. 1