AI may be helping cyberattackers increase the speed and scale of their operations, but it is not yet changing their core objectives or the techniques they employ as part of their attack chains.
Phishing, malware, and vulnerability exploitation remain the main techniques in play even as abuse of AI tools has made attacks easier to mount and cheaper for even relatively unskilled attackers, according to security experts.
“Attackers are still identifying targets, performing reconnaissance, establishing a foothold, moving laterally, achieving their objective, covering their tracks, and moving on to the next target,” says Ronald Lewis, director of cybersecurity governance at application security firm Black Duck. “What’s changed is the volume and velocity that AI allows this process to happen.”
Even in the most high-profile example of an AI powered attack to date, in which Claude Code was abused by Chinese state-sponsored actors to mount an AI-orchestrated cyber-espionage campaign in September 2025, conventional attack techniques and procedures laid the foundation, with AI abused as an enabler to support reconnaissance, vulnerability discovery, exploitation, lateral movement, credential harvesting, data analysis, and exfiltration during the GTG-1002 campaign.
JadePuffer, a ransomware campaign disclosed in July 2026, witnessed an LLM-driven agent automating most of the intrusion chain. Initial exploitation was through CVE-2025-3248, a year-old missing-authentication flaw in Langflow, a popular open-source framework for building LLM applications and agent workflows.
Vulnerable internet-facing Langflow instances were looted for cloud credentials, API keys, and other secrets before lateral movement, privilege escalation, and ultimately destructive database encryption.
JadePuffer shows AI’s potential for automating conventional attack methods, but it also underscores how vulnerable software is where AI has been giving attackers the biggest edge to date. AI tools can readily find exploitable flaws in open-source code faster than defenders can patch them, a huge problem for the many enterprises carrying years of technical debt. And security experts see software flaws rising as a root cause of breaches as a result.
What AI enables
In addition to enhancing attackers’ flaw discovery prowess, AI is also enabling attackers to fail or succeed faster. Defenders are witnessing improvements in speed, scale, and operational ability from attackers that correlates strongly with increasing capabilities of AI tools.
“Adversaries are realizing the same gains in development velocity and operations that everyone else is getting from implementing AI,” says Darren Meyer, security research advocate at application security tools vendor Checkmarx.
Black Duck’s Lewis sees this expanding attackers’ reach and empowering more attack experimentation.
“An attacker can potentially investigate more opportunities, try more approaches, and move to the next target at a pace that would be difficult for a human team to match,” he says.
That in turn will increasingly alter a pivotal phase of conventional attack patterns that traditional favors defenders, notes Crystal Morin, senior cybersecurity strategist at cloud security firm Sysdig.“That dwell time, which was often weeks or months, was where detection happened,” she says.
Whereas attackers used to land, sit for a while, and poke around, AI-assisted attackers are showing signs of shortening detection windows. And AI agents won’t wait.
‘Agentic APT’ and AI attack phase specialization
By leveraging agentic AI in their operations, hackers can also draw on a deeper pool of domain expertise — database administration, CI/CD pipelines, etc. — compared to human attack teams where different people tend to specialize in different things such as web app security or malware development.
“Think of it as a database admin, a developer, an IT engineer, a DevOps specialist, a cloud architect, and a hacker combined into a single role,” says Nazar Tymoshyk, CEO and founder of agentic AI security vendor UnderDefense. “We call it agentic APT, and the critical shift is that it is no longer exclusive to nation-state actors.”
Tymoshyk adds: “A threat that previously required a coordinated team of specialists can be deployed by a single person with the right prompt and the right model.”
Security researchers, including UnderDefense, report that attackers favor Chinese models, specifically GLM and Kimi 3, which have significantly fewer content restrictions, rather than their more restricted Western alternatives as a platform to mount attacks.
“Attackers switch between models depending on what the task requires: one for reconnaissance, one for code generation, one for crafting social engineering content,” Tymoshyk says. “The modularity is part of the attack design.”
Attackers often prefer to use local models both because of operational security advantages and because some models may have weaker safeguards against malicious use.
Other experts cautioned that the abuse of particular models is difficult to determine and, in any case, a side issue to the main problem of defending against attacks.
“Attribution of particular attacks to particular models is generally pure speculation from very thin evidence on the ground,” says Checkmarx’s Meyer. “True attribution can only come from infiltration of threat groups or compromise of threat group infrastructure, both of which are rarely available to public researchers.”
The current baseline of attacks consists of AI-orchestrated operations where models surface, validate, and execute attack paths. Security researchers report a general shift from AI-assisted and AI-accelerated attacks toward fully autonomous attacks, with only minimal human roles remaining.
AI attack economics
The economics of mounting attacks is also changing — and is crucial in understanding attackers’ increasing use of AI.
“A human attacker builds a playbook per campaign and reuses it, so every new target costs engineering time to make adjustments,” says Sysdig’s Morin. “An agentic threat actor carries context about a whole class of applications and composes its plan live against whatever it finds. There, the only cost is inference budget. And as running a complex attack gets cheaper, the number of attempts will go up.”
Agentic attacks are still flawed, and breadth of expertise is a poor substitute for depth of knowledge.
“Agents hallucinate and are noisy, which is often why they’re catchable,” notes Sysdig’s Morin. “Jadepuffer had flaws in its ransom note, encryption, wallet, and data exfiltration. There are still many areas in which human analysis and skill still outperform agent memory.”
Countermeasures
“The core objectives of the threat actor haven’t really changed, but the timeframe for a successful attack has been compressed dramatically,” says Nathan Smolenski, CISO at vulnerability management and compliance firm Qualys. “Frontier AI tools accelerate vulnerability discovery and weaponization, shrinking the window between disclosure and exploitation to near zero.”
Smolenski adds: “Defenders can no longer rely on traditional, human-speed 30-day patch cadences or monthly static spreadsheets.”
AI significantly changes the entry dynamic by expanding the attack surface — particularly through end-user devices, API calls, and ungoverned AI agents.
In response, defending organizations must shift away from human-centric gatekeeping toward automated defences while still keeping on top of foundational security defenses such as patching and authentication controls.
“Implementing agentic workflows with human-in-the-loop guardrails enables security teams to automate lower-level triage efforts and focus human expertise on governing agents, validating outputs, and making more critical risk decisions,” Smolenski concludes.
