How AI is changing the nature of cyberattacks

Publisher excerpt From CSO Online

AI may be helping cyberattackers increase the speed and scale of their operations, but it is not yet changing their core objectives or the techniques they employ as part of their attack chains. Phishing, malware, and vulnerability exploitation remain the main techniques in play even as abuse of AI tools has made attacks easier to mount and cheaper for even relatively unskilled attackers, according to security experts. “Attackers are still identifying targets, performing reconnaissance, establishing a foothold, moving laterally, achieving their objective, covering their tracks, and moving on to the next target,” says Ronald Lewis, director of cybersecurity governance at application security firm Black Duck. “What’s changed is the volume and velocity that AI allows this process to happen.” Even in the most high-profile example of an AI powered attack to date, in which Claude Code was abused by Chinese state-sponsored actors to mount an AI-orchestrated cyber-espionage campaign in September 2025, conventional attack techniques and procedures laid the foundation, with AI abused as an enabler to support reconnaissance, vulnerability discovery, exploitation, lateral movement, credential harvesting, data analysis, and exfiltration during the GTG-1002 campaign. JadePuffer, a ransomware campaign disclosed in July 2026, witnessed an LLM-driven agent automating most of the intrusion chain. Initial exploitation was through CVE-2025-3248, a year-old missing-authentication flaw in Langflow, a popular open-source framework for building LLM applications and agent workflows. Vulnerable internet-facing Langflow instances were looted for cloud credentials, API keys, and other secrets before lateral movement, privilege escalation, and ultimately destructive database encryption. JadePuffer shows AI’s potential for automating conventional attack methods, but it also underscores how vulnerable software is where AI has been giving attackers the biggest edge to date. AI tools can readily find exploitable flaws in open-source code faster than defenders can patch them, a huge problem for the many enterprises carrying years of technical debt. And security experts see software flaws rising as a root cause of breaches as a result. What AI enables In addition to enhancing attackers’ flaw discovery prowess, AI is also enabling attackers to fail or succeed faster. Defenders are witnessing improvements in speed, scale, and operational ability from attackers that correlates strongly with increasing capabilities of AI tools. “Adversaries are realizing the same gains in development velocity and operations that everyone else is getting from implementing AI,” says Darren Meyer, security research advocate at application security tools vendor Checkmarx. Black Duck’s Lewis sees this expanding attackers’ reach and empowering more attack experimentation. “An attacker can potentially investigate more opportunities, try more approaches, and move to the next target at a pace that w…

Excerpt only, shown with attribution. This content belongs to the original publisher and has not been independently verified by CyberSecurity.pk.