AI is already making online crime easier and could make it much worse: experts divided on automated cyberattacks

The MIT Technology Review article (12 February 2026, by Rhiannon Williams) examines how far artificial intelligence is changing cybercrime. Its central conclusion is nuanced: AI is already reducing the effort and barriers to entry for criminals, but the idea of autonomous “superhackers” is not yet backed by solid evidence. The text received is cut off in its final sentence, so this summary covers everything that could be read.

The story opens with Anton Cherepanov, a researcher who in late August last year spotted a file on VirusTotal that triggered his detection measures. Together with his colleague Peter Strýček, he found it was ransomware that used large language models (LLMs) at every stage of the attack. Once installed, it could generate custom code in real time, map the machine to identify sensitive data to copy or encrypt, and write personalised ransom notes based on the contents of the files. It did all this autonomously and behaved differently on each run, making it harder to detect. They named it PromptLock and announced it was the first AI-powered ransomware, which drew wide media coverage.

The reality was less dramatic. The next day, a team from New York University (NYU) acknowledged it was a research project designed to show that every step of a ransomware campaign can be automated, and said it had succeeded. Meet Udeshi, an NYU PhD student, explains that they used two of OpenAI's open-source models and did not even need jailbreak techniques. They wanted to know whether LLMs that claim to be ethically aligned could still be misused, and the answer was yes. Udeshi was surprised that the AI handled the entire attack chain, saying they saw an 80% to 90% success rate across the whole process, when they had expected it to fail in the later stages. He adds that criminals may already have carried out covert PromptLock-style attacks without any evidence of it. To do so, they would have to overcome the hurdle of getting the models to behave reliably and get around their resistance to malicious use, all without being detected, which the article describes as a high bar.

According to the article, attackers adopted generative AI almost immediately after ChatGPT arrived in late 2022, starting with spam. A Microsoft report said that in the year to April 2025 it blocked $4 billion in scams and fraudulent transactions, “many likely aided by AI content”. Researchers from Columbia University, the University of Chicago and Barracuda Networks, after analysing around 500,000 malicious messages from before and after ChatGPT's launch, estimate that at least half of email spam is now generated with LLMs. In targeted attacks impersonating a trusted figure to extract money or information from an employee, at least 14% were generated with LLMs in April 2025, up from 7.6% in April 2024.

Deepfakes are another front. The article recalls the 2024 case in which an employee at British engineering firm Arup transferred $25 million to criminals after a video call with digital versions of the chief financial officer and other colleagues. Henry Ajder, a generative AI expert, notes that criminals use these techniques because they work and make money, and that they will keep doing so as long as there are victims. Far less material is now needed to fake someone's image or voice, and the problem will probably worsen as the technology improves and spreads.

Billy Leonard, technical lead of Google's Threat Analysis Group, says that in the second half of 2024 they saw would-be criminals using tools such as Gemini in the same way as ordinary users: debugging code, automating tasks and writing the occasional phishing email. By 2025 they were using it to help create new malware and release it into the wild. The most popular models have safeguards, but these can be bypassed. Google observed a China-linked actor asking Gemini to identify vulnerabilities in a compromised system. The model initially refused, but the attacker persuaded it by posing as a participant in a “capture the flag” competition. Google has adjusted Gemini to reject such requests.

Ashley Jess, an analyst at Intel 471 and a former specialist at the US Department of Justice, believes attackers will increasingly turn to open-source models, because it is easier to strip out their safeguards and adapt them to their needs.

The most solid data comes from the AI companies themselves, and at first glance it sounds alarming. In November, Leonard's team published a report saying malicious actors were using AI tools, including Gemini, to dynamically alter malware behaviour, for example through self-modification to evade detection. It spoke of “a new operational phase of AI abuse”. However, cybersecurity writer Kevin Beaumont pointed out that the five malware families analysed, including PromptLock, had easily detectable code and caused no real harm, and that nothing required organisations to deviate from their basic security programmes. Leonard admits this activity is at an early stage, but defends publishing such reports so that security vendors can build better detections.

Also in November, Anthropic announced it had disrupted a large-scale cyberattack, the first reported to have been carried out without “substantial human intervention”. According to the company, a Chinese state-sponsored group used its Claude Code assistant to automate up to 90% of what it called a “highly sophisticated espionage campaign”. There were caveats: a human operator chose the targets before tasking Claude with finding vulnerabilities, and of 30 attempts only a “handful” succeeded. In addition, Claude hallucinated and fabricated data, for example claiming to have obtained credentials it did not have and frequently exaggerating its findings, forcing the attackers to validate the results. The report describes this as an obstacle to fully autonomous cyberattacks.

Gary McGraw, a security veteran and co-founder of the Berryville Institute of Machine Learning, argues that the controls at any reasonably secure organisation would have stopped these attacks. In his view, the malicious part, such as exploiting vulnerabilities, was done by off-the-shelf tools that have been automated for 20 years, and there is nothing new about it. Jacob Klein, Anthropic's head of threat intelligence, maintains that chaining so many steps of an intrusion through agentic orchestration is unprecedented. For him, a labour-intensive process becomes far more scalable, and we are entering an era in which the barrier to sophisticated operations has fallen and attacks will accelerate faster than many organisations are prepared to handle.

Marcus Hutchins, principal threat researcher at Expel and known for halting the global WannaCry attack in 2017, finds the obsession with “AI superhackers” absurd. He believes the industry overstates the current capabilities of the models and that there is no evidence they meet the requirements for it. According to the article, criminals mainly use AI to be more productive: writing malicious code and phishing lures, carrying out reconnaissance and translating. Jess adds that she also sees tools being sold on underground marketplaces, such as phishing kits that compare click-through rates across campaigns. She speaks of plenty of “AI slop” but little widespread adoption by highly technical actors. Liz James of NCC Group points out that sophistication is not required: a “good enough” model lets attackers target far more people with a “scattergun” approach, and if the code lands on an undefended machine, it can encrypt the disk with reasonable competence.

On the defensive side, researchers are optimistic for now. Leonard says the practices recommended for more than a decade remain valid, and that many phishing emails are still caught by spam filters. AI also helps defenders, because it is good at detecting patterns and correlations. Vasu Jakkal of Microsoft Security says the company processes more than 100 trillion signals every day flagged by its AI systems as potentially suspicious events. Jess values defenders sharing detailed information, and cites Mitre's Adversarial Threat Landscape for Artificial-Intelligence Systems framework and OWASP's GenAI Security Project as useful resources.

The most extreme scenario would be a model capable of creating and automating its own zero-day exploits. According to Hutchins, building and hosting it without being detected would cost billions of dollars and would be within reach only of a wealthy state. Engin Kirda, a professor at Northeastern University, would not be surprised if it were already happening, particularly in China. The article stresses that this is still a theoretical possibility and that no large-scale campaign has yet emerged that is both effective and clearly AI-driven. What it does conclude is that generative AI is already significantly lowering the bar for criminals, who will keep experimenting with every new development. Experts agree that AI-enabled attacks will grow in volume and severity, but not on what form they will take.