AI is already making online crimes easier. It could get much worse.

2026-02-12 · Source: MIT Technology Review · Field: Technology & Digital — Artificial Intelligence & Machine Learning, Cybersecurity & Data Privacy · Depth: Intermediate, long

Summary

Cybersecurity researchers are observing a significant increase in AI-powered cyberattacks, with some experts suggesting it's already a "sheer reality." While an initial discovery of "PromptLock" ransomware, which autonomously used large language models (LLMs) for real-time code generation, system mapping, and personalized ransom notes, was revealed to be an academic experiment by New York University researchers, the broader trend of AI in cybercrime is undeniable. Criminals are leveraging generative AI tools, including LLMs and deepfake technologies, to enhance the speed, volume, and sophistication of scams, phishing campaigns, and targeted email attacks. Microsoft reported blocking $4 billion in AI-aided scams by April 2025, and estimates suggest at least 50% of spam emails are now LLM-generated. Attackers are also bypassing AI model guardrails, often by exploiting open-source models, to generate malicious code and identify system vulnerabilities, as demonstrated by a China-linked actor manipulating Google Gemini.

Key takeaway

For cybersecurity leaders assessing evolving threats, the immediate concern is AI's role as a force multiplier for existing attack vectors, not fully autonomous AI superhackers. Your teams should reinforce foundational security programs, as current defenses remain effective against most AI-enhanced malware and phishing. Focus on robust spam filters, user education against deepfake scams, and diligent system updates to counter the increased volume and sophistication of AI-aided attacks.

Key insights

AI is rapidly lowering the barrier for cybercriminals, accelerating attack pace and increasing sophistication.

Principles

• Traditional cybersecurity defenses remain largely effective.
• Open-source AI models are more susceptible to malicious misuse.
• AI's productivity gains for attackers outweigh autonomous threats currently.

Method

Attackers use LLMs for real-time code generation, system mapping, personalized ransom notes, and deepfakes to automate and scale cybercrime operations, often by bypassing model guardrails.

In practice

• Implement foundational security programs.
• Stay vigilant against AI-enhanced phishing and deepfakes.
• Prioritize system updates and patch management.

Topics

• AI Cyberattacks
• Large Language Models
• Deepfakes
• Model Jailbreaking
• Cybersecurity Defenses

Best for: CTO, VP of Engineering/Data, Director of AI/ML, AI Security Engineer, Security Engineer, Research Scientist

Related on AIssential

• Top spy agencies say AI cyber threats will impact you within months. Here’s why — AI-powered cyber threats are rapidly escalating, demanding automated defenses and enhanced individual vigilance within months.
• Common AI-Based Cyber Attacks (2026 Guide) — AI significantly enhances cyber attack sophistication, automation, and personalization across various threat vectors.
• AI Tools Are Helping Mediocre North Korean Hackers Steal Millions — AI tools are democratizing sophisticated cyberattacks, empowering less skilled actors to execute effective campaigns.
• AI for Criminals — AI significantly amplifies criminal capabilities by providing expertise, precision at scale, and real-time adaptability to defensive measures.
• Once, cyber-attacks required great skill. AI is changing that | Bruce Schneier — AI democratizes sophisticated cyber-attacks, making robust AI-driven defense an urgent necessity.
• Meta is rolling out stronger anti-scam tools - here's how they protect you — AI-powered tools enhance scam detection by analyzing diverse signals and contextual details across Meta platforms.

Open in AIssential →

Editorial summary, takeaway, and curation by AIssential. Original article published by MIT Technology Review.