Models amplify cyber offense
Social and video analysts warn that advanced language and analysis models are becoming tools for offensive cyber work — speeding vulnerability discovery, automating social‑engineering and supporting autonomous attack workflows (youtube.com). Security observers on X also report a concurrent surge in rapid ransomware activity and improved brute‑force campaigns against network devices, linking model-enabled tactics to real operational threats (x.com).
Artificial intelligence chat models are moving from hacker assistant to attack tool, with governments, labs and vendors all reporting faster offensive cyber work. (ncsc.gov.uk) (projectzero.google) In plain terms, these systems read code, summarize logs, draft phishing lures and chain steps together like a junior analyst who never sleeps. Google Project Zero said on June 20, 2024 that its “Project Naptime” framework pushed benchmark performance for vulnerability discovery up to 20 times over the original CyberSecEval 2 paper. (projectzero.google) The United Kingdom’s National Cyber Security Centre said AI will “almost certainly increase the volume and heighten the impact of cyber attacks over the next two years.” The agency published that assessment as part of its report on the near-term impact of AI on the cyber threat. (ncsc.gov.uk) That warning lands as breach and ransomware data already show attackers leaning on the same weak points: stolen credentials, exposed edge devices and unpatched software. Verizon’s 2025 Data Breach Investigations Report said it analyzed 22,052 incidents and 12,195 confirmed breaches, its largest breach set yet. (verizon.com) Verizon said the year’s report tracked “the growth of the well-known edge device vulnerability exploits” that security teams could not miss. Sophos said exploited vulnerabilities were the No. 1 root cause in its 2025 ransomware survey of 3,400 IT and security leaders across 17 countries. (verizon.com) (sophos.com) The model piece is speed. Microsoft said in its 2025 Digital Defense Report that adversaries are moving “with the speed of AI,” while its public summary says about a third of attackers still get in through simple routes tied to partners, services and other exposed access points. (microsoft.com) The social-engineering piece is scale. OpenAI said in its June 2025 threat report that it disrupted operations involving social engineering, cyber activity, scams and covert influence, and said AI acted as a “force multiplier” for its investigators spotting abuse. (cdn.openai.com) The autonomy piece is what changes the workflow. Anthropic said on November 13, 2025 that it had disrupted what it called the first reported AI-orchestrated cyber espionage campaign, in which a threat actor used agentic tools to attempt infiltration against roughly 30 global targets. (anthropic.com) Not every researcher says current models can replace skilled operators. Project Zero said in the same 2024 write-up that “substantial progress is still needed” before these tools meaningfully change the daily work of security researchers, even after the benchmark gains. (projectzero.google) U.S. agencies are answering with guidance rather than a public claim that the problem is solved. The Cybersecurity and Infrastructure Security Agency now lists AI red teaming, secure deployment guidance and an AI Cybersecurity Collaboration Playbook among its core publications for operators and vendors. (cisa.gov) The near-term picture is not a movie plot about fully automated hacks everywhere. It is a more ordinary shift: better code reading, faster phishing, quicker vulnerability triage and longer attack chains run with less human effort. (ncsc.gov.uk) (projectzero.google)
